lanzaboote-stub: init at 0.3.0 #231951

RaitoBezarius · 2023-05-14T23:13:02Z

Description of changes

This brings https://github.com/nix-community/lanzaboote UEFI stub in-tree.

Dependents:

nixos/boot/systemd-boot: add UEFI Secure Boot via lanzaboote #263713

Dependencies:

Either of:
- lib.systems.inspect: isEfi → hasEfi rename #263711
- lib.systems.inspect: deprecate isEfi #264297

Stub and tool are packaged in the global hierarchy as: lanzaboote-tool and lanzaboote-uefi-stub, no assumption on the system are encoded inside their package respectively.

It is expected to build the UEFI stub using a UEFI system with a UEFI compiler.

The linker is a flavored linker which will propagate adequately the lld Windows-style driver for arguments.

lanzaboote-tool is supposed to be wrapped to know about its lanzaboote-stub, unfortunately, this is impossible to achieve inside of nixpkgs, multiple attempts were proposed to the reviewers in the next section and were all rejected. Therefore, the only solution is to give up on having a wrapped lanzaboote-tool and propose a semi-wrapped lanzaboote-tool and expect the user to understand they have to export the LANZABOOTE_STUB environment variable to know about the stub itself.

This is what we do in the systemd-boot NixOS module ourselves and we expect to work in many cases, either case, author would like to move this PR forward ideally and not concern themselves further with the semi wrapping issue stemming from the impossibility to build a package as a data via cross-compilation inside of nixpkgs, alas.

What has been tried?

Trivial implementation using nixpkgs reimport inside of pkgs/ hierarchy: NACK because it reimports nixpkgs inside nixpkgs.
Introduction of a UEFI system example: NACK because there is divergence on the system data, see discussion on MinGW style vs MSVC and GNU-Config as a general.
Complicated implementation by locally rebooting nixpkgs inside the package definition of the tool to compile the stub using a hacked stdenv: NACK because it's too complicated.
Complicated implementation by locally rebooting a new package scope called uefiPkgs for cross compilation inside nixpkgs without a direct reimport: NACK because it's too complicated and does not compose well.

Some funny questions

It seems like this PR tries to move to make UEFI a proper target in nixpkgs, but there's already plenty of "data as UEFI binaries" inside of nixpkgs without any cross compilation involved per se:

EDK2/OVMF firmware
systemd-boot
GRUB EFI

Ideally, we should treat the same way as in this PR, I suppose this will be very hard given their build system.

Things done

nixos/modules/system/boot/loader/systemd-boot/systemd-boot.nix

pkgs/tools/system/lanzaboote/tool.nix

pkgs/top-level/all-packages.nix

nixos/modules/system/boot/loader/systemd-boot/systemd-boot.nix

pkgs/tools/system/lanzaboote/stub.nix

nixos/modules/system/boot/loader/systemd-boot/systemd-boot.nix

pkgs/tools/system/lanzaboote/tool.nix

nixos/modules/system/boot/loader/systemd-boot/systemd-boot.nix

pkgs/tools/system/lanzaboote/stub.nix

pkgs/tools/system/lanzaboote/tool.nix

pkgs/tools/system/lanzaboote/stub.nix

ghost · 2023-06-19T07:20:25Z

#235230 is done; reviewing this PR is next on my list.

pkgs/tools/system/lanzaboote/tool.nix

pkgs/tools/system/lanzaboote/stub.nix

nixos/modules/system/boot/loader/systemd-boot/systemd-boot.nix

ghost · 2023-11-01T07:54:46Z

Pushed to this branch:

6bc656b to fix CI.
a17e894 to drop the gnu-config patch.

When I run CI locally it passes. Let's see what ofborg says.

ghost

Got CI to pass.

My opinion remains unchanged: UEFI is a boondoggle.

But if the boon must be doggled, at least it will be done using Nix and Rust. 🤷‍♂️

ghost · 2023-11-01T08:05:54Z

pkgs/os-specific/uefi/lanzaboote-stub/default.nix

+    homepage = "https://github.com/nix-community/lanzaboote";
+    license = licenses.gpl3Only;
+    mainProgram = "lanzaboote_stub.efi";
+    platforms = [ "x86_64-uefi" "i686-uefi" "aarch64-uefi" ];


Suggested change

platforms = [ "x86_64-uefi" "i686-uefi" "aarch64-uefi" ];

hydraPlatforms = [ lib.systems.inspect.platformPatterns.isUefi ];

ghost · 2023-11-01T08:07:01Z

pkgs/os-specific/uefi/lanzaboote-stub/default.nix

+    platforms = [ "x86_64-uefi" "i686-uefi" "aarch64-uefi" ];
+    # i686: Builtins errors
+    # aarch64: compile fine but...
+    broken = stdenv.isi686 || stdenv.isAarch64;


Suggested change

broken = stdenv.isi686 || stdenv.isAarch64;

broken = with stdenv.hostPlatform; isi686 || isAarch64;

ghost · 2023-11-01T08:07:21Z

lib/systems/examples.nix

+    linker = "lld";
+  };
+
+


Suggested change

ghost · 2023-11-01T08:34:59Z

lib/systems/doubles.nix

  redox         = filterDoubles predicates.isRedox;
  windows       = filterDoubles predicates.isWindows;
  genode        = filterDoubles predicates.isGenode;
+  uefi          = filterDoubles predicates.isEfiEnvironment;


Suggested change

uefi = filterDoubles predicates.isEfiEnvironment;

uefi = filterDoubles predicates.isUefi;

ghost · 2023-11-01T08:35:17Z

lib/systems/inspect.nix

    isMusl         = with abis; map (a: { abi = a; }) [ musl musleabi musleabihf muslabin32 muslabi64 ];
    isUClibc       = with abis; map (a: { abi = a; }) [ uclibc uclibceabi uclibceabihf ];

+    isEfiEnvironment = [


Suggested change

isEfiEnvironment = [

isUefi = [

ghost · 2023-11-01T08:36:02Z

pkgs/os-specific/uefi/lanzaboote-stub/default.nix

+    mainProgram = "lanzaboote_stub.efi";
+    platforms = [ "x86_64-uefi" "i686-uefi" "aarch64-uefi" ];
+    # i686: Builtins errors
+    # aarch64: compile fine but...


Suggested change

# aarch64: compile fine but...

# aarch64: compile fine but unable to test on real hardware

shouldn't it be # aarch64: compiles fine but unable to test on real hardware?

ghost · 2023-11-01T21:41:23Z

If you rebase this to a more recent staging (or switch branch to master) I think the ofborg rebuild tags will go away.

RaitoBezarius · 2023-11-02T10:02:40Z

If you rebase this to a more recent staging (or switch branch to master) I think the ofborg rebuild tags will go away.

I just need to do it when I don't feel like I will fuck up :D.

TobiPeterG · 2024-06-03T22:45:57Z

Is there any progress on this? :)

baloo · 2024-11-03T04:38:01Z

Got CI to pass.

@ghost

I'm a bit late to the party, but I'm trying to revive it in #353050, but I'm getting compilation errors on compiler-rt and I'm not sure which derivation you tried to build. None of the options I tried worked.

nixos-discourse · 2025-01-17T20:43:49Z

This pull request has been mentioned on NixOS Discourse. There might be relevant details there:

https://discourse.nixos.org/t/installation-medium-has-invalid-secure-boot-signature/58952/6

Mic92 · 2025-01-19T17:35:50Z

This pull requests is stalled.

RaitoBezarius · 2025-01-19T17:55:32Z

This pull requests is stalled.

Can I ask you the courtesy to ping the author of PR whom you close PRs? (Or put the documentation of that new nixpkgs process in your closing messages?)

Thank you.

Mic92 · 2025-01-20T09:06:38Z

Well, do you want to work on this? You said me in several occasions that you don't want to contribute to nixpkgs anymore and working on your NixOS fork. I do not think we should add too many processes to nixpkgs because it will make it too hard to understand how to make changes, so please just re-open the pull request again if you want to work on this. Otherwise just delete the branch.

RaitoBezarius · 2025-01-20T10:35:22Z

Well, do you want to work on this? You said me in several occasions that you don't want to contribute to nixpkgs anymore and working on your NixOS fork. I do not think we should add too many processes to nixpkgs because it will make it too hard to understand how to make changes, so please just re-open the pull request again if you want to work on this. Otherwise just delete the branch.

Again, all of this has nothing to do with my request. Simply ask before doing what when it comes to other people's work is what I would like you to do. Thank you.

Mic92 · 2025-01-20T11:11:48Z

Well, usually I ask them to re-open their pull request if they want to continue to work on the pull request. But I was 95% sure you would want not do that, so I kept it at that.

RaitoBezarius · 2025-01-20T11:20:05Z

Well, usually I ask them to re-open their pull request if they want to continue to work on the pull request. But I was 95% sure you would want not do that, so I kept it at that.

If you want to make up your own rules, please consider discussing it with others before applying them out of the blue, especially when it comes to the work of others. "Closing then asking to re-open" is not courtesy, it's just you doing whatever you think is acceptable to do at any time, and you are continuing to shove your view.

rrbutani mentioned this pull request May 15, 2023

bintools-wrapper: support lld's -flavor argument #231960

Draft

12 tasks

RaitoBezarius force-pushed the lanzaboote branch from 111edf3 to c9fb579 Compare June 13, 2023 01:07

github-actions bot added 6.topic: nixos Issues or PRs affecting NixOS modules, or package usability issues specific to NixOS 8.has: module (update) This PR changes an existing module in `nixos/` labels Jun 13, 2023

RaitoBezarius changed the title ~~lanzaboote: init at 0.3.0~~ lanzaboote-tool, lanzaboote-stub: init at 0.3.0, nixos/systemd-boot: init secureboot with lanzaboote Jun 13, 2023

RaitoBezarius requested review from blitz, danielfullmer and nikstur June 13, 2023 01:07

RaitoBezarius force-pushed the lanzaboote branch from c9fb579 to e1c2349 Compare June 13, 2023 01:36

RaitoBezarius requested review from ElvishJerricco and alyssais June 13, 2023 01:36

RaitoBezarius force-pushed the lanzaboote branch from e1c2349 to c521016 Compare June 13, 2023 01:56

Kranzes reviewed Jun 13, 2023

View reviewed changes

nixos/modules/system/boot/loader/systemd-boot/systemd-boot.nix Outdated Show resolved Hide resolved

ElvishJerricco reviewed Jun 13, 2023

View reviewed changes

This comment was marked as duplicate.

Sign in to view

RaitoBezarius mentioned this pull request Jun 16, 2023

boot: Development (& experimental) setup for SecureBoot #202497

Closed

23 tasks

oxalica suggested changes Jun 16, 2023

View reviewed changes

nikstur reviewed Jun 16, 2023

View reviewed changes

pkgs/tools/system/lanzaboote/stub.nix Outdated Show resolved Hide resolved

pkgs/tools/system/lanzaboote/tool.nix Outdated Show resolved Hide resolved

pkgs/tools/system/lanzaboote/stub.nix Outdated Show resolved Hide resolved

pasqui23 requested review from a user, ElvishJerricco and Kranzes June 17, 2023 12:36

SuperSandro2000 reviewed Jun 28, 2023

View reviewed changes

RaitoBezarius force-pushed the lanzaboote branch 3 times, most recently from 5586367 to e2723f0 Compare July 8, 2023 17:11

gnu-config: drop support-uefi-triples.patch patch

a17e894

ghost approved these changes Nov 1, 2023

View reviewed changes

ghost mentioned this pull request Nov 4, 2023

mesa: fix cross compilation to x86_64 #233628

Merged

12 tasks

wegank added the 12.approvals: 1 This PR was reviewed and approved by one person. label Mar 9, 2024

wegank added the 2.status: merge conflict This PR has merge conflicts with the target branch label May 3, 2024

wegank added the 2.status: stale https://github.com/NixOS/nixpkgs/blob/master/.github/STALE-BOT.md label Jul 4, 2024

This was referenced Nov 2, 2024

uefi build support #353050

Closed

lanzaboote-stub: init at 0.3.0 #353052

Draft

stale bot removed the 2.status: stale https://github.com/NixOS/nixpkgs/blob/master/.github/STALE-BOT.md label Nov 3, 2024

wegank added the 2.status: stale https://github.com/NixOS/nixpkgs/blob/master/.github/STALE-BOT.md label Jan 2, 2025

Mic92 closed this Jan 19, 2025

wolfgangwalther deleted the lanzaboote branch August 14, 2025 08:04

	platforms = [ "x86_64-uefi" "i686-uefi" "aarch64-uefi" ];
	hydraPlatforms = [ lib.systems.inspect.platformPatterns.isUefi ];

	broken = stdenv.isi686 \|\| stdenv.isAarch64;
	broken = with stdenv.hostPlatform; isi686 \|\| isAarch64;

	uefi = filterDoubles predicates.isEfiEnvironment;
	uefi = filterDoubles predicates.isUefi;

	# aarch64: compile fine but...
	# aarch64: compile fine but unable to test on real hardware

Uh oh!

lanzaboote-stub: init at 0.3.0 #231951

lanzaboote-stub: init at 0.3.0 #231951

Uh oh!

Conversation

RaitoBezarius commented May 14, 2023 • edited by ghost Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description of changes

Current design

What has been tried?

Some funny questions

Things done

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

This comment was marked as duplicate.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

ghost commented Jun 19, 2023

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

ghost commented Nov 1, 2023 • edited by ghost Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ghost left a comment • edited by ghost Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ghost Nov 1, 2023

Choose a reason for hiding this comment

Uh oh!

ghost Nov 1, 2023

Choose a reason for hiding this comment

Uh oh!

ghost Nov 1, 2023

Choose a reason for hiding this comment

Uh oh!

ghost Nov 1, 2023

Choose a reason for hiding this comment

Uh oh!

ghost Nov 1, 2023

Choose a reason for hiding this comment

Uh oh!

ghost Nov 1, 2023

Choose a reason for hiding this comment

Uh oh!

Janik-Haag Nov 1, 2023

Choose a reason for hiding this comment

Uh oh!

ghost commented Nov 1, 2023

Uh oh!

RaitoBezarius commented Nov 2, 2023

Uh oh!

TobiPeterG commented Jun 3, 2024

Uh oh!

baloo commented Nov 3, 2024

Uh oh!

nixos-discourse commented Jan 17, 2025

Uh oh!

Mic92 commented Jan 19, 2025

Uh oh!

RaitoBezarius commented Jan 19, 2025

Uh oh!

RaitoBezarius commented May 14, 2023 •

edited by ghost

Loading

ghost commented Nov 1, 2023 •

edited by ghost

Loading

ghost left a comment •

edited by ghost

Loading