Run any Skill in Manus with one click

lanzaboote

Stars4

Forks1

UpdatedJuly 2, 2026 at 09:55

Use this skill when the user needs to work with UEFI Secure Boot on NixOS — signing UKIs, managing sbctl keys, or configuring the boot chain integrity. Applies when discussing Secure Boot, `systemd-boot`, or bootloader hardening, even if the user doesn't say "lanzaboote".

Installation

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

Run Skill in Manus

Source

BastianAsmussen

BastianAsmussen/dotfiles

View GitHub Repository View Creator Repositories

Download

Run Skill in Manus

Related occupationsSOC

Based on SOC occupation classification

Software DevelopersComputer and Mathematical Occupations·SOC 15-1252

File Explorer

2 files

SKILL.md

readonly

name	lanzaboote
description	Use this skill when the user needs to work with UEFI Secure Boot on NixOS — signing UKIs, managing sbctl keys, or configuring the boot chain integrity. Applies when discussing Secure Boot, `systemd-boot`, or bootloader hardening, even if the user doesn't say "lanzaboote".
metadata	{"input_rev":"7c9a54a7f87b4539ddbd8bda09a8a5f5f9361aa9","input_hash":"sha256-hqijVSEETttmo8Okql9/LG0Ua34hdciKW1a5zzlj8mU=","when_to_use":"lanzaboote, secure boot, uki, sbctl, pkiBundle, systemd-boot, uefi signing, boot chain"}

Pin check

grep -A4 '"lanzaboote"' flake.lock | grep narHash Expected: sha256-hqijVSEETttmo8Okql9/LG0Ua34hdciKW1a5zzlj8mU= If different, update metadata.input_hash and metadata.input_rev.

Action

The base module modules/nixosModules/base/lanzaboote.nix imports inputs.lanzaboote.nixosModules.lanzaboote and configures signing.
Import self.nixosModules.lanzaboote in epsilon's configuration.nix:35.
Persist /var/lib/sbctl via preservation — without it, the next rebuild can't sign the boot chain.
Manage keys with sbctl (available in environment.systemPackages).

Gotchas

Only epsilon uses lanzaboote. Delta uses Limine, eta uses systemd-boot without Secure Boot, and mu has no bootloader. Importing lanzaboote on other hosts will fail.
/var/lib/sbctl must be persisted (line 369-376 in epsilon config). If you forget this, the signing keys are lost on reboot and the boot chain breaks.

Verification

nix eval .#nixosConfigurations.epsilon.config.boot.lanzaboote.enable

More from this repository

same repository

update-pins

BastianAsmussen/dotfiles

After `nix flake update`, sync `input_rev` and `input_hash` metadata in all flake-input skill files to match new `flake.lock`.

2026-07-024

api-and-interface-design

BastianAsmussen/dotfiles

Guides stable API and interface design. Use when designing APIs, module boundaries, or any public interface. Use when creating REST or GraphQL endpoints, defining type contracts between modules, or establishing boundaries between frontend and backend.

2026-07-024

browser-testing-with-devtools

BastianAsmussen/dotfiles

Tests in real browsers via Chrome DevTools MCP. Use when building or debugging anything that runs in a browser. Use when you need to inspect the DOM, capture console errors, analyze network requests, profile performance, or verify visual output with real runtime data. Requires the chrome-devtools MCP server to be configured.

2026-07-024

ci-cd-and-automation

BastianAsmussen/dotfiles

Automates CI/CD pipeline setup. Use when setting up or modifying build and deployment pipelines. Use when you need to automate quality gates, configure test runners in CI, or establish deployment strategies.

2026-07-024

code-review-and-quality

BastianAsmussen/dotfiles

Conducts multi-axis code review. Use before merging any change. Use when reviewing code written by yourself, another agent, or a human. Use when you need to assess code quality across multiple dimensions before it enters the main branch.

2026-07-024

code-simplification

BastianAsmussen/dotfiles

Simplifies code for clarity. Use when refactoring code for clarity without changing behavior. Use when code works but is harder to read, maintain, or extend than it should be. Use when reviewing code that has accumulated unnecessary complexity.

2026-07-024

name	lanzaboote
description	Use this skill when the user needs to work with UEFI Secure Boot on NixOS — signing UKIs, managing sbctl keys, or configuring the boot chain integrity. Applies when discussing Secure Boot, `systemd-boot`, or bootloader hardening, even if the user doesn't say "lanzaboote".
metadata	{"input_rev":"7c9a54a7f87b4539ddbd8bda09a8a5f5f9361aa9","input_hash":"sha256-hqijVSEETttmo8Okql9/LG0Ua34hdciKW1a5zzlj8mU=","when_to_use":"lanzaboote, secure boot, uki, sbctl, pkiBundle, systemd-boot, uefi signing, boot chain"}

Pin check

grep -A4 '"lanzaboote"' flake.lock | grep narHash Expected: sha256-hqijVSEETttmo8Okql9/LG0Ua34hdciKW1a5zzlj8mU= If different, update metadata.input_hash and metadata.input_rev.

Action

The base module modules/nixosModules/base/lanzaboote.nix imports inputs.lanzaboote.nixosModules.lanzaboote and configures signing.
Import self.nixosModules.lanzaboote in epsilon's configuration.nix:35.
Persist /var/lib/sbctl via preservation — without it, the next rebuild can't sign the boot chain.
Manage keys with sbctl (available in environment.systemPackages).

Gotchas

Only epsilon uses lanzaboote. Delta uses Limine, eta uses systemd-boot without Secure Boot, and mu has no bootloader. Importing lanzaboote on other hosts will fail.
/var/lib/sbctl must be persisted (line 369-376 in epsilon config). If you forget this, the signing keys are lost on reboot and the boot chain breaks.

Verification

nix eval .#nixosConfigurations.epsilon.config.boot.lanzaboote.enable