# nix-community/lanzaboote

Secure Boot & Measured Boot for NixOS [maintainers=@blitz @raitobezarius @nikstur]

Repository: https://github.com/nix-community/lanzaboote
Canonical: https://ross.abutalabs.com/products/lanzaboote
Homepage: https://nix-community.github.io/lanzaboote/
Language: Rust
License: GPL-3.0
License Family: copyleft
Topics: efi, nix, nixos, nixpkgs, rust, security, uefi, measured-boot, secure-boot, tpm2
Last push: 2026-08-25T11:47:15+00:00

## Health v2 (maintenance only)
Score: 84/100 (v2, computed 2026-09-02T17:46:02.011165+00:00)
- activity 99, release rhythm 57, longevity 98
- inputs: {"age_days": 1381, "days_push": 8, "days_rel": 72, "gap_med": 193, "n_releases_24m": 4}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1818, forks 117 (observed 2026-08-28T04:05:40.138352+00:00)

## What it is
Lanzaboote is Rust tooling that brings UEFI Secure Boot and Measured Boot support to NixOS. Its lzbt tool signs boot components, builds Unified Kernel Images, and installs them to the EFI System Partition, with TPM-based measurement for binding secrets.

## Use cases
- enable secure boot on nixos
- sign nixos kernel and initrd for uefi secure boot
- set up measured boot with tpm2 on nixos
- create unified kernel images for nixos
- protect luks encryption keys with tpm measurements
- replace systemd-boot with a secure boot bootloader on nixos

## When to choose
- you run NixOS with systemd-boot and want UEFI Secure Boot with your own keychain
- you want TPM2 Measured Boot to bind disk encryption secrets to boot state
- you need a reproducible, Nix-integrated signing and UKI installation flow

## When to avoid
- you are not comfortable with recovery tools or lack a backup, since misconfiguration can leave the system unbootable
- your system is not installed in UEFI mode or does not use systemd-boot
- you need guaranteed support across arbitrary hardware, as firmware behavior is inconsistent

## Facets
- artifact type: cli-tool
- maturity: active
- function: security, cryptography, cli, developer-tools
- domain: security, operating-systems, developer-tools
- platform: rust, cli
- tags: secure-boot, uefi, nixos, measured-boot, tpm2, unified-kernel-image, systemd-boot, bootloader, linux

## Member repositories
- nix-community/lanzaboote (main) score 84

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:05:40.138352+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T03:20:08.862234+00:00, confidence not recorded.
  - readme: https://github.com/nix-community/lanzaboote (fetched 2026-08-28T04:05:40.138352+00:00, sha 2b635a285d07)
  - homepage: https://nix-community.github.io/lanzaboote/ (fetched 2026-08-29T10:59:07.421946+00:00, sha 4d45b6fb86b0)
- Data as of 2026-08-30T08:39:29.467469+00:00.