Jeden Skill in Manus ausführen
mit einem Klick

Jeden Skill in Manus mit einem Klick ausführen

lanzaboote

Sterne4

Forks1

Aktualisiert2. Juli 2026 um 09:55

Use this skill when the user needs to work with UEFI Secure Boot on NixOS — signing UKIs, managing sbctl keys, or configuring the boot chain integrity. Applies when discussing Secure Boot, `systemd-boot`, or bootloader hardening, even if the user doesn't say "lanzaboote".

Installation

Mit Codex oder Claude installieren Kopieren Sie diesen Prompt, fügen Sie ihn in Codex, Claude oder einen anderen Assistant ein und lassen Sie die Skill-Seite prüfen und installieren.

In Manus ausführen

Quelle

BastianAsmussen

BastianAsmussen/dotfiles

GitHub-Repository öffnen Creator-Repositorys ansehen

Download

In Manus ausführen

Verwandte BerufeSOC

Basierend auf der SOC-Berufsklassifikation

SoftwareentwicklerInformatik- und Mathematikberufe·SOC 15-1252

Datei-Explorer

2 Dateien

SKILL.md

readonly

name	lanzaboote
description	Use this skill when the user needs to work with UEFI Secure Boot on NixOS — signing UKIs, managing sbctl keys, or configuring the boot chain integrity. Applies when discussing Secure Boot, `systemd-boot`, or bootloader hardening, even if the user doesn't say "lanzaboote".
metadata	{"input_rev":"7c9a54a7f87b4539ddbd8bda09a8a5f5f9361aa9","input_hash":"sha256-hqijVSEETttmo8Okql9/LG0Ua34hdciKW1a5zzlj8mU=","when_to_use":"lanzaboote, secure boot, uki, sbctl, pkiBundle, systemd-boot, uefi signing, boot chain"}

Pin check

grep -A4 '"lanzaboote"' flake.lock | grep narHash Expected: sha256-hqijVSEETttmo8Okql9/LG0Ua34hdciKW1a5zzlj8mU= If different, update metadata.input_hash and metadata.input_rev.

Action

The base module modules/nixosModules/base/lanzaboote.nix imports inputs.lanzaboote.nixosModules.lanzaboote and configures signing.
Import self.nixosModules.lanzaboote in epsilon's configuration.nix:35.
Persist /var/lib/sbctl via preservation — without it, the next rebuild can't sign the boot chain.
Manage keys with sbctl (available in environment.systemPackages).

Gotchas

Only epsilon uses lanzaboote. Delta uses Limine, eta uses systemd-boot without Secure Boot, and mu has no bootloader. Importing lanzaboote on other hosts will fail.
/var/lib/sbctl must be persisted (line 369-376 in epsilon config). If you forget this, the signing keys are lost on reboot and the boot chain breaks.

Verification

nix eval .#nixosConfigurations.epsilon.config.boot.lanzaboote.enable

Mehr aus diesem Repository

gleiches Repository

update-pins

BastianAsmussen/dotfiles

After `nix flake update`, sync `input_rev` and `input_hash` metadata in all flake-input skill files to match new `flake.lock`.

2026-07-024

api-and-interface-design

BastianAsmussen/dotfiles

Guides stable API and interface design. Use when designing APIs, module boundaries, or any public interface. Use when creating REST or GraphQL endpoints, defining type contracts between modules, or establishing boundaries between frontend and backend.

2026-07-024

browser-testing-with-devtools

BastianAsmussen/dotfiles

Tests in real browsers via Chrome DevTools MCP. Use when building or debugging anything that runs in a browser. Use when you need to inspect the DOM, capture console errors, analyze network requests, profile performance, or verify visual output with real runtime data. Requires the chrome-devtools MCP server to be configured.

2026-07-024

ci-cd-and-automation

BastianAsmussen/dotfiles

Automates CI/CD pipeline setup. Use when setting up or modifying build and deployment pipelines. Use when you need to automate quality gates, configure test runners in CI, or establish deployment strategies.

2026-07-024

code-review-and-quality

BastianAsmussen/dotfiles

Conducts multi-axis code review. Use before merging any change. Use when reviewing code written by yourself, another agent, or a human. Use when you need to assess code quality across multiple dimensions before it enters the main branch.

2026-07-024

code-simplification

BastianAsmussen/dotfiles

Simplifies code for clarity. Use when refactoring code for clarity without changing behavior. Use when code works but is harder to read, maintain, or extend than it should be. Use when reviewing code that has accumulated unnecessary complexity.

2026-07-024

name	lanzaboote
description	Use this skill when the user needs to work with UEFI Secure Boot on NixOS — signing UKIs, managing sbctl keys, or configuring the boot chain integrity. Applies when discussing Secure Boot, `systemd-boot`, or bootloader hardening, even if the user doesn't say "lanzaboote".
metadata	{"input_rev":"7c9a54a7f87b4539ddbd8bda09a8a5f5f9361aa9","input_hash":"sha256-hqijVSEETttmo8Okql9/LG0Ua34hdciKW1a5zzlj8mU=","when_to_use":"lanzaboote, secure boot, uki, sbctl, pkiBundle, systemd-boot, uefi signing, boot chain"}

Pin check

grep -A4 '"lanzaboote"' flake.lock | grep narHash Expected: sha256-hqijVSEETttmo8Okql9/LG0Ua34hdciKW1a5zzlj8mU= If different, update metadata.input_hash and metadata.input_rev.

Action

The base module modules/nixosModules/base/lanzaboote.nix imports inputs.lanzaboote.nixosModules.lanzaboote and configures signing.
Import self.nixosModules.lanzaboote in epsilon's configuration.nix:35.
Persist /var/lib/sbctl via preservation — without it, the next rebuild can't sign the boot chain.
Manage keys with sbctl (available in environment.systemPackages).

Gotchas

Only epsilon uses lanzaboote. Delta uses Limine, eta uses systemd-boot without Secure Boot, and mu has no bootloader. Importing lanzaboote on other hosts will fail.
/var/lib/sbctl must be persisted (line 369-376 in epsilon config). If you forget this, the signing keys are lost on reboot and the boot chain breaks.

Verification

nix eval .#nixosConfigurations.epsilon.config.boot.lanzaboote.enable