starkle
September 4, 2026, 6:34pm
1
Just saw this fairly recent issue about end-to-end boot security in NixOS. Interested to see how it plays out. In the meantime I’ll be looking at sealed Fedora Atomic desktops.
opened 02:27AM - 05 Aug 26 UTC
1.severity: significant
5.scope: tracking
@ElvishJerricco and I are working on bringing support for end‐to‐end trusted boo… t to upstream NixOS, thanks to NLnet funding and building on experience using and maintaining Lanzaboote, our systemd integration, and the NixOS installer images.
Our planned approach will enable more seamless integration with Nix builds and upstream infrastructure, and extend the chain of trust to cover the entire stage 2 system closure. The primary target is TPM‐based Measured Boot to allow flexible attestation and validation of the entire boot chain, with Secure Boot covering early boot machinery and UEFI drivers. The approach can support both user‐controlled keys and future out‐of‐the‐box Secure Boot support using the official Microsoft keys.
The core components of the effort are:
* **[autopen](https://github.com/emilazy/autopen)**: A new cryptographic signing tool that enables the integration of signing directly into Nix builds while maintaining essential purity and reproducibility properties. This allows building systems with Secure Boot support without stepping outside of the Nix build model, and will make it possible for the official NixOS Hydra to build reproducible ISOs with Secure Boot support, while keeping private keys safe. See the [detailed explanation of the design from a Nix perspective](https://github.com/emilazy/autopen/blob/main/docs/nix-perspective.md) for more detail on how autopen accomplishes these goals.
* **UEFI Secure Boot support for NixOS:** We are working on upstreaming optional support for using autopen to sign essential packages like shim, systemd‐boot, fwupd, and Linux kernel images, including NixOS integration. We intend to target the [shim review requirements](https://github.com/rhboot/shim-review) including kernel lockdown to ensure that the Secure Boot guarantees are maintained and get ready for [having our shim signed by the Microsoft keys](https://techcommunity.microsoft.com/blog/hardware-dev-center/updated-microsoft-uefi-signing-requirements/1062916) in future, while still maximizing flexibility and user freedom by seamlessly supporting Machine Owner Keys and fully user‐controlled signing chains.
* **Stage 2 measurement:** Using a new design for content‐based Nix store integrity inspired by [composefs](https://github.com/composefs/composefs), we plan to implement optional support for pinning and measuring a cryptographic hash of the entire NixOS system closure. This will provide guarantees approaching those of existing dm-verity approaches to system integrity used for fixed‐function appliances, while being fully compatible with mutable stores and standard NixOS upgrade mechanisms, enabling future applications like hardware‐backed disk encryption locked to the system configuration, and validation of remote server integrity.
## Pull requests
* https://github.com/NixOS/nixpkgs/pull/545457
* https://github.com/NixOS/nixpkgs/pull/549373
## Funding
This project is funded through [NGI Fediversity Fund](https://nlnet.nl/fediversity/), a fund established by [NLnet](https://nlnet.nl/) with financial support from the European Commission’s [Next Generation Internet](https://ngi.eu/) program. Learn more at the [NLnet project page](https://nlnet.nl/project/NixOS-verifiedboot/).
5 Likes