Secureboot with Shim

SecureBoot support on a Linux distribution requires a shim binary signed by Microsoft to be loaded before boot, and there was some efforts to make it happen on NixOS.

• https://github.com/lheckemann/shim-review
• https://github.com/RaitoBezarius/nixos-shim

A lot has changed since then, both above mentioned people are not actively participating in Nixpkgs, and we have an entirely new management structure with the SC.

Could the SC move forward with this? I believe it's not something a random contributor like us, can move it to the finish line. A security contact from the foundation/organisation is needed.

We can argue over and over about how SecureBoot setup benefits Microsoft, and the UX design is just bad, but it has undoubtedly been adopted by all modern hardware vendors.

Currently, to install NixOS, one needs to disable SecureBoot, which just ends up painting the bad picture, unlike Fedora or Ubuntu, which installs fine from the ISO out of the box. Disabling SecureBoot is not something good for security, even though it has its caveats.

Sure, we can reuse the shim binary that are provided by Ubuntu or Fedora, but again reusing things from other distros is not a good idea. We'd not have any control over the builds, and those distros can just stop making those builds publicly accessible.

It's time we actually address this issue.

Start by reviewing the linked shim-review and nixos-shim efforts, then establish whether the SC and a foundation security contact can own the work. Done would require an agreed path for producing and maintaining a Microsoft-signed shim for NixOS, rather than another individual implementation attempt.