Ask linuxhackermann about shim keys #1239

New Issue

Qubasa · 2024-04-17T11:10:38Z

Qubasa commented

2024-04-17 11:10:38 +00:00

The goal is to have a shim signed that trusts their vendor keys, which will allow them to sign necessary parts for an installer.
This installer would then be able to generate and apply Machine Owner Keys (MOKs) and sign systems with lanzaboote, enabling user-configured setups to boot.
The project is largely completed as per their GitHub repository https://github.com/raitobezarius/nixos-shim, but they are still missing:
1. A signing infrastructure where the vendor key is secured in a hardware token.
2. The completion and submission of a shim-review application, which is partly dependent on setting up the signing infrastructure.
3. Implementation of the MOK-related features, intended as a project for a second funding round that has not yet been successful.
Hackerman expressed a lack of motivation due to financial constraints and broader challenges within the Nix community.

- The goal is to have a shim signed that trusts their vendor keys, which will allow them to sign necessary parts for an installer. - This installer would then be able to generate and apply Machine Owner Keys (MOKs) and sign systems with lanzaboote, enabling user-configured setups to boot. - The project is largely completed as per their GitHub repository https://github.com/raitobezarius/nixos-shim, but they are still missing: 1. A signing infrastructure where the vendor key is secured in a hardware token. 2. The completion and submission of a shim-review application, which is partly dependent on setting up the signing infrastructure. 3. Implementation of the MOK-related features, intended as a project for a second funding round that has not yet been successful. - Hackerman expressed a lack of motivation due to financial constraints and broader challenges within the Nix community.

Qubasa self-assigned this 2024-04-17 11:10:38 +00:00

lassulus was assigned by Qubasa

2024-04-17 11:10:38 +00:00

Qubasa added this to the Clan_Kanban_Board project 2024-04-17 11:10:38 +00:00

Qubasa closed this issue

2024-04-23 13:06:12 +00:00

Sign in to join this conversation.