nixos/limine: switch to UKI from bzImage

[JohnRTitor]

Currently Limine packs the kernel into bzImage format, which means they can not be directly invoked by bootloaders like systemd-boot or rEFInd.

There is a much better way of shipping a kernel image, which is to say, by using UKIs (Unified Kernel Image).¹ In addition, UKIs can even be individually signed by sbctl, so there's no issue launching them independently, in a Secureboot system.²

Note that on Nixpkgs, we already have mechanisms to generate an UKI³, and boot loaders like systemd-boot default to that.

Pinging maintainers:

@programmerlexi @lzcunt @phip1611 @surfaceflinger @Prince213

Footnotes

1. https://wiki.archlinux.org/title/UKI ↩

2. https://wiki.archlinux.org/title/Limine ↩

3. https://github.com/NixOS/nixpkgs/blob/6a51e9eec9a08bd5e5430cffcfc027a910067bc4/nixos/modules/system/boot/uki.nix#L10 ↩

[Prince213]

Took a look at systemd-boot and I think it's also using bzImage. I doubt if any boot loader is using UKI at the moment.

[surfaceflinger]

How about BIOS? Should limine module handle both bzImage and UKI then?

[Prince213]

How about BIOS? Should limine module handle both bzImage and UKI then?

We can check that by efiSupport and only install UKI when efiSupport && !biosSupport.

[Prince213]

For the current appoach to discover UKIs, we need this information in Bootspec (NixOS/rfcs#165).

[JohnRTitor]

Took a look at systemd-boot and I think it's also using bzImage

You sure? I was using Lanzaboote AFAIK and it was using UKI (I could boot them using rEFInd.

[Prince213]

You sure? I was using Lanzaboote AFAIK and it was using UKI (I could boot them using rEFInd.

Since you're asking about systemd-boot and not limine, I answered the question in #413077 (comment).

[programmerlexi]

For the current appoach to discover UKIs, we need this information in Bootspec (NixOS/rfcs#165).

How about an putting it into an extension?

Took a look at systemd-boot and I think it's also using bzImage

Yes, they are.

You sure? I was using Lanzaboote AFAIK and it was using UKI (I could boot them using rEFInd.

Lanzaboote bundles kernel and initrd into an UKI on its own. Maybe we can use a similar solution, if putting UKIs in the standard bootspec (or an extension) doesn't work.

[JohnRTitor]

Can we utilise https://github.com/NixOS/nixpkgs/blob/6a51e9eec9a08bd5e5430cffcfc027a910067bc4/nixos/modules/system/boot/uki.nix?

If we want to wait for Bootspec v2, it will be long one as nobody steers the RFC actively yet.

[programmerlexi]

Can we utilise https://github.com/NixOS/nixpkgs/blob/6a51e9eec9a08bd5e5430cffcfc027a910067bc4/nixos/modules/system/boot/uki.nix?

I can't really tell where the UKI ends up. If the script can find it easily, yes. Bootspec extension is preferred.

If we want to wait for Bootspec v2, it will be long one as nobody steers the RFC actively yet.

When using an extension there isn't any need to wait for bootspec v2. I think.