Installation medium has invalid secure boot signature

waffle8946 · January 17, 2025, 8:43pm

That’s correct. It’s not part of nixpkgs yet.

github.com/NixOS/nixpkgs

lanzaboote-stub: init at 0.3.0

NixOS:staging ← NixOS:lanzaboote

opened 11:13PM - 14 May 23 UTC

RaitoBezarius

+76 -4

###### Description of changes This brings https://github.com/nix-community/la…nzaboote UEFI stub in-tree. Dependents: - https://github.com/NixOS/nixpkgs/pull/263713 Dependencies: - Either of: - https://github.com/NixOS/nixpkgs/pull/263711 - https://github.com/NixOS/nixpkgs/pull/264297 Related: - https://github.com/NixOS/nixpkgs/pull/263712 - https://github.com/NixOS/nixpkgs/pull/263714. ###### Current design Stub and tool are packaged in the global hierarchy as: `lanzaboote-tool` and `lanzaboote-uefi-stub`, no assumption on the system are encoded inside their package respectively. It is expected to build the UEFI stub using a UEFI system with a UEFI compiler. The linker is a flavored linker which will propagate adequately the `lld` Windows-style driver for arguments. `lanzaboote-tool` is supposed to be wrapped to know about its `lanzaboote-stub`, unfortunately, this is impossible to achieve inside of nixpkgs, multiple attempts were proposed to the reviewers in the next section and were all rejected. Therefore, the only solution is to give up on having a wrapped `lanzaboote-tool` and propose a **semi-wrapped** `lanzaboote-tool` and expect the user to understand they have to export the `LANZABOOTE_STUB` environment variable to know about the stub itself. This is what we do in the systemd-boot NixOS module ourselves and we expect to work in many cases, either case, author would like to move this PR forward ideally and not concern themselves further with the semi wrapping issue stemming from the impossibility to build a package as a data via cross-compilation inside of nixpkgs, alas. ###### What has been tried? - [x] Trivial implementation using nixpkgs reimport inside of `pkgs/` hierarchy: NACK because it reimports nixpkgs inside nixpkgs. - [x] Introduction of a UEFI system example: NACK because there is divergence on the system data, see discussion on MinGW style vs MSVC and GNU-Config as a general. - [x] Complicated implementation by locally rebooting nixpkgs inside the package definition of the tool to compile the stub using a hacked stdenv: NACK because it's too complicated. - [x] Complicated implementation by locally rebooting a new package scope called `uefiPkgs` for cross compilation inside nixpkgs without a direct reimport: NACK because it's too complicated and does not compose well. ###### Some funny questions It seems like this PR tries to move to make UEFI a proper target in nixpkgs, but there's already plenty of "data as UEFI binaries" inside of nixpkgs without any cross compilation involved per se: - EDK2/OVMF firmware - systemd-boot - GRUB EFI Ideally, we should treat the same way as in this PR, I suppose this will be very hard given their build system. ###### Things done - Built on platform(s) - [ ] x86_64-linux - [ ] aarch64-linux - [ ] x86_64-darwin - [ ] aarch64-darwin - [ ] For non-Linux: Is `sandbox = true` set in `nix.conf`? (See [Nix manual](https://nixos.org/manual/nix/stable/command-ref/conf-file.html)) - [ ] Tested, as applicable: - [NixOS test(s)](https://nixos.org/manual/nixos/unstable/index.html#sec-nixos-tests) (look inside [nixos/tests](https://github.com/NixOS/nixpkgs/blob/master/nixos/tests)) - and/or [package tests](https://nixos.org/manual/nixpkgs/unstable/#sec-package-tests) - or, for functions and "core" functionality, tests in [lib/tests](https://github.com/NixOS/nixpkgs/blob/master/lib/tests) or [pkgs/test](https://github.com/NixOS/nixpkgs/blob/master/pkgs/test) - made sure NixOS tests are [linked](https://nixos.org/manual/nixpkgs/unstable/#ssec-nixos-tests-linking) to the relevant packages - [ ] Tested compilation of all packages that depend on this change using `nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD"`. Note: all changes have to be committed, also see [nixpkgs-review usage](https://github.com/Mic92/nixpkgs-review#usage) - [ ] Tested basic functionality of all binary files (usually in `./result/bin/`) - [23.05 Release Notes (or backporting 22.11 Release notes)](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md#generating-2305-release-notes) - [ ] (Package updates) Added a release notes entry if the change is major or breaking - [ ] (Module updates) Added a release notes entry if the change is significant - [ ] (Module addition) Added a release notes entry if adding a new NixOS module - [ ] Fits [CONTRIBUTING.md](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md).