Ejecuta cualquier Skill en Manus
con un clic

Ejecuta cualquier Skill en Manus con un clic

lanzaboote

Estrellas4

Forks1

Actualizado2 de julio de 2026 a las 09:55

Use this skill when the user needs to work with UEFI Secure Boot on NixOS — signing UKIs, managing sbctl keys, or configuring the boot chain integrity. Applies when discussing Secure Boot, `systemd-boot`, or bootloader hardening, even if the user doesn't say "lanzaboote".

Instalación

Instalar con Codex o Claude Copia este prompt, pégalo en Codex, Claude u otro asistente, y deja que revise la página de la skill y la instale por ti.

Ejecutar en Manus

Fuente

BastianAsmussen

BastianAsmussen/dotfiles

Abrir repositorio de GitHub Ver repositorios del creador

Descarga

Ejecutar en Manus

Ocupaciones relacionadasSOC

Basado en la clasificación ocupacional SOC

Desarrolladores de softwareOcupaciones informáticas y matemáticas·SOC 15-1252

Explorador de archivos

2 archivos

SKILL.md

readonly

name	lanzaboote
description	Use this skill when the user needs to work with UEFI Secure Boot on NixOS — signing UKIs, managing sbctl keys, or configuring the boot chain integrity. Applies when discussing Secure Boot, `systemd-boot`, or bootloader hardening, even if the user doesn't say "lanzaboote".
metadata	{"input_rev":"7c9a54a7f87b4539ddbd8bda09a8a5f5f9361aa9","input_hash":"sha256-hqijVSEETttmo8Okql9/LG0Ua34hdciKW1a5zzlj8mU=","when_to_use":"lanzaboote, secure boot, uki, sbctl, pkiBundle, systemd-boot, uefi signing, boot chain"}

Pin check

grep -A4 '"lanzaboote"' flake.lock | grep narHash Expected: sha256-hqijVSEETttmo8Okql9/LG0Ua34hdciKW1a5zzlj8mU= If different, update metadata.input_hash and metadata.input_rev.

Action

The base module modules/nixosModules/base/lanzaboote.nix imports inputs.lanzaboote.nixosModules.lanzaboote and configures signing.
Import self.nixosModules.lanzaboote in epsilon's configuration.nix:35.
Persist /var/lib/sbctl via preservation — without it, the next rebuild can't sign the boot chain.
Manage keys with sbctl (available in environment.systemPackages).

Gotchas

Only epsilon uses lanzaboote. Delta uses Limine, eta uses systemd-boot without Secure Boot, and mu has no bootloader. Importing lanzaboote on other hosts will fail.
/var/lib/sbctl must be persisted (line 369-376 in epsilon config). If you forget this, the signing keys are lost on reboot and the boot chain breaks.

Verification

nix eval .#nixosConfigurations.epsilon.config.boot.lanzaboote.enable

Más de este repositorio

mismo repositorio

update-pins

BastianAsmussen/dotfiles

After `nix flake update`, sync `input_rev` and `input_hash` metadata in all flake-input skill files to match new `flake.lock`.

2026-07-024

api-and-interface-design

BastianAsmussen/dotfiles

Guides stable API and interface design. Use when designing APIs, module boundaries, or any public interface. Use when creating REST or GraphQL endpoints, defining type contracts between modules, or establishing boundaries between frontend and backend.

2026-07-024

browser-testing-with-devtools

BastianAsmussen/dotfiles

Tests in real browsers via Chrome DevTools MCP. Use when building or debugging anything that runs in a browser. Use when you need to inspect the DOM, capture console errors, analyze network requests, profile performance, or verify visual output with real runtime data. Requires the chrome-devtools MCP server to be configured.

2026-07-024

ci-cd-and-automation

BastianAsmussen/dotfiles

Automates CI/CD pipeline setup. Use when setting up or modifying build and deployment pipelines. Use when you need to automate quality gates, configure test runners in CI, or establish deployment strategies.

2026-07-024

code-review-and-quality

BastianAsmussen/dotfiles

Conducts multi-axis code review. Use before merging any change. Use when reviewing code written by yourself, another agent, or a human. Use when you need to assess code quality across multiple dimensions before it enters the main branch.

2026-07-024

code-simplification

BastianAsmussen/dotfiles

Simplifies code for clarity. Use when refactoring code for clarity without changing behavior. Use when code works but is harder to read, maintain, or extend than it should be. Use when reviewing code that has accumulated unnecessary complexity.

2026-07-024

name	lanzaboote
description	Use this skill when the user needs to work with UEFI Secure Boot on NixOS — signing UKIs, managing sbctl keys, or configuring the boot chain integrity. Applies when discussing Secure Boot, `systemd-boot`, or bootloader hardening, even if the user doesn't say "lanzaboote".
metadata	{"input_rev":"7c9a54a7f87b4539ddbd8bda09a8a5f5f9361aa9","input_hash":"sha256-hqijVSEETttmo8Okql9/LG0Ua34hdciKW1a5zzlj8mU=","when_to_use":"lanzaboote, secure boot, uki, sbctl, pkiBundle, systemd-boot, uefi signing, boot chain"}

Pin check

grep -A4 '"lanzaboote"' flake.lock | grep narHash Expected: sha256-hqijVSEETttmo8Okql9/LG0Ua34hdciKW1a5zzlj8mU= If different, update metadata.input_hash and metadata.input_rev.

Action

The base module modules/nixosModules/base/lanzaboote.nix imports inputs.lanzaboote.nixosModules.lanzaboote and configures signing.
Import self.nixosModules.lanzaboote in epsilon's configuration.nix:35.
Persist /var/lib/sbctl via preservation — without it, the next rebuild can't sign the boot chain.
Manage keys with sbctl (available in environment.systemPackages).

Gotchas

Only epsilon uses lanzaboote. Delta uses Limine, eta uses systemd-boot without Secure Boot, and mu has no bootloader. Importing lanzaboote on other hosts will fail.
/var/lib/sbctl must be persisted (line 369-376 in epsilon config). If you forget this, the signing keys are lost on reboot and the boot chain breaks.

Verification

nix eval .#nixosConfigurations.epsilon.config.boot.lanzaboote.enable