Exécutez n'importe quel Skill dans Manus
en un clic

Exécutez n'importe quel Skill dans Manus en un clic

lanzaboote

Étoiles4

Forks1

Mis à jour2 juillet 2026 à 09:55

Use this skill when the user needs to work with UEFI Secure Boot on NixOS — signing UKIs, managing sbctl keys, or configuring the boot chain integrity. Applies when discussing Secure Boot, `systemd-boot`, or bootloader hardening, even if the user doesn't say "lanzaboote".

Installation

Installer avec Codex ou Claude Copiez ce prompt, collez-le dans Codex, Claude ou un autre assistant, puis laissez-le vérifier la page du skill et l'installer pour vous.

Exécuter dans Manus

Source

BastianAsmussen

BastianAsmussen/dotfiles

Ouvrir le dépôt GitHub Voir les dépôts du créateur

Téléchargement

Exécuter dans Manus

Métiers associésSOC

Basé sur la classification professionnelle SOC

Développeurs de logicielsProfessions informatiques et mathématiques·SOC 15-1252

Explorateur de fichiers

2 fichiers

SKILL.md

readonly

name	lanzaboote
description	Use this skill when the user needs to work with UEFI Secure Boot on NixOS — signing UKIs, managing sbctl keys, or configuring the boot chain integrity. Applies when discussing Secure Boot, `systemd-boot`, or bootloader hardening, even if the user doesn't say "lanzaboote".
metadata	{"input_rev":"7c9a54a7f87b4539ddbd8bda09a8a5f5f9361aa9","input_hash":"sha256-hqijVSEETttmo8Okql9/LG0Ua34hdciKW1a5zzlj8mU=","when_to_use":"lanzaboote, secure boot, uki, sbctl, pkiBundle, systemd-boot, uefi signing, boot chain"}

Pin check

grep -A4 '"lanzaboote"' flake.lock | grep narHash Expected: sha256-hqijVSEETttmo8Okql9/LG0Ua34hdciKW1a5zzlj8mU= If different, update metadata.input_hash and metadata.input_rev.

Action

The base module modules/nixosModules/base/lanzaboote.nix imports inputs.lanzaboote.nixosModules.lanzaboote and configures signing.
Import self.nixosModules.lanzaboote in epsilon's configuration.nix:35.
Persist /var/lib/sbctl via preservation — without it, the next rebuild can't sign the boot chain.
Manage keys with sbctl (available in environment.systemPackages).

Gotchas

Only epsilon uses lanzaboote. Delta uses Limine, eta uses systemd-boot without Secure Boot, and mu has no bootloader. Importing lanzaboote on other hosts will fail.
/var/lib/sbctl must be persisted (line 369-376 in epsilon config). If you forget this, the signing keys are lost on reboot and the boot chain breaks.

Verification

nix eval .#nixosConfigurations.epsilon.config.boot.lanzaboote.enable

Plus depuis ce dépôt

même dépôt

update-pins

BastianAsmussen/dotfiles

After `nix flake update`, sync `input_rev` and `input_hash` metadata in all flake-input skill files to match new `flake.lock`.

2026-07-024

api-and-interface-design

BastianAsmussen/dotfiles

Guides stable API and interface design. Use when designing APIs, module boundaries, or any public interface. Use when creating REST or GraphQL endpoints, defining type contracts between modules, or establishing boundaries between frontend and backend.

2026-07-024

browser-testing-with-devtools

BastianAsmussen/dotfiles

Tests in real browsers via Chrome DevTools MCP. Use when building or debugging anything that runs in a browser. Use when you need to inspect the DOM, capture console errors, analyze network requests, profile performance, or verify visual output with real runtime data. Requires the chrome-devtools MCP server to be configured.

2026-07-024

ci-cd-and-automation

BastianAsmussen/dotfiles

Automates CI/CD pipeline setup. Use when setting up or modifying build and deployment pipelines. Use when you need to automate quality gates, configure test runners in CI, or establish deployment strategies.

2026-07-024

code-review-and-quality

BastianAsmussen/dotfiles

Conducts multi-axis code review. Use before merging any change. Use when reviewing code written by yourself, another agent, or a human. Use when you need to assess code quality across multiple dimensions before it enters the main branch.

2026-07-024

code-simplification

BastianAsmussen/dotfiles

Simplifies code for clarity. Use when refactoring code for clarity without changing behavior. Use when code works but is harder to read, maintain, or extend than it should be. Use when reviewing code that has accumulated unnecessary complexity.

2026-07-024

name	lanzaboote
description	Use this skill when the user needs to work with UEFI Secure Boot on NixOS — signing UKIs, managing sbctl keys, or configuring the boot chain integrity. Applies when discussing Secure Boot, `systemd-boot`, or bootloader hardening, even if the user doesn't say "lanzaboote".
metadata	{"input_rev":"7c9a54a7f87b4539ddbd8bda09a8a5f5f9361aa9","input_hash":"sha256-hqijVSEETttmo8Okql9/LG0Ua34hdciKW1a5zzlj8mU=","when_to_use":"lanzaboote, secure boot, uki, sbctl, pkiBundle, systemd-boot, uefi signing, boot chain"}

Pin check

grep -A4 '"lanzaboote"' flake.lock | grep narHash Expected: sha256-hqijVSEETttmo8Okql9/LG0Ua34hdciKW1a5zzlj8mU= If different, update metadata.input_hash and metadata.input_rev.

Action

The base module modules/nixosModules/base/lanzaboote.nix imports inputs.lanzaboote.nixosModules.lanzaboote and configures signing.
Import self.nixosModules.lanzaboote in epsilon's configuration.nix:35.
Persist /var/lib/sbctl via preservation — without it, the next rebuild can't sign the boot chain.
Manage keys with sbctl (available in environment.systemPackages).

Gotchas

Only epsilon uses lanzaboote. Delta uses Limine, eta uses systemd-boot without Secure Boot, and mu has no bootloader. Importing lanzaboote on other hosts will fail.
/var/lib/sbctl must be persisted (line 369-376 in epsilon config). If you forget this, the signing keys are lost on reboot and the boot chain breaks.

Verification

nix eval .#nixosConfigurations.epsilon.config.boot.lanzaboote.enable