Products › lamboot-tools › Tool Reference
Tool Reference
All 11 core tools plus 2 bundled Rust binaries. v0.9.1.
lamboot-diagnose
Non-destructive full-system boot audit. The recommended first tool to run on any machine.
lamboot-diagnose # Run all checks (equivalent to 'all')
lamboot-diagnose all # All check categories
lamboot-diagnose esp # ESP health and content
lamboot-diagnose bootloader # GRUB/systemd-boot/rEFInd config and binaries
lamboot-diagnose nvram # NVRAM boot order and entries
lamboot-diagnose secureboot # Secure Boot state and key enrollment
lamboot-diagnose vm # VM guest detection and lamboot state
| Flag | Description |
|---|---|
| --category CAT | Run only the named check category. |
| --min-severity LEVEL | Only show findings at or above: info, warning, error, critical. |
| --fail-on LEVEL | Exit non-zero if any finding at or above this level is found. Default: error. |
| --suggest | Print a recommended lamboot-repair or lamboot-migrate command for each actionable finding. |
lamboot-esp
EFI System Partition inspection, clean-up, resizing, and repair.
lamboot-esp status # Check ESP health and usage
lamboot-esp list # List all files on the ESP
lamboot-esp clean # Remove stale kernel images and unused EFI entries
lamboot-esp resize TARGET_MB # Resize ESP (creates backup first)
lamboot-esp repair # Fix structural issues found by 'status'
lamboot-esp mount # Mount the ESP at /boot/efi if unmounted
Safety: resize and repair create an automatic backup before making any change. The backup path is included in --json output as backup_dir. Use --dry-run to preview actions.
lamboot-nvram
UEFI NVRAM boot entry management. Create, delete, reorder, and export boot entries without using efibootmgr directly.
lamboot-nvram list # List all NVRAM boot entries
lamboot-nvram show ID # Show details for a specific entry
lamboot-nvram create # Add a new EFI boot entry
lamboot-nvram delete ID # Delete an entry by BootXXXX ID
lamboot-nvram reorder ID... # Set a new boot order
lamboot-nvram export # Export all entries to JSON
lamboot-nvram import FILE # Restore entries from exported JSON
lamboot-backup
Create, list, verify, and restore boot-environment snapshots. Every mutating tool calls this automatically before making changes.
lamboot-backup save [LABEL] # Snapshot ESP + NVRAM to /var/backups/lamboot/
lamboot-backup list # List snapshots sorted newest-first
lamboot-backup show ID # Show what a snapshot contains
lamboot-backup verify ID # Verify the integrity of a snapshot
lamboot-backup restore ID # Restore an ESP + NVRAM snapshot
lamboot-backup delete ID # Delete a snapshot
| Flag | Description |
|---|---|
| --backup-dir DIR | Store or read backups at an alternate location. Default: /var/backups/lamboot/. |
| --include-disk | Save the raw ESP partition image in addition to a file-tree copy. Allows byte-level restoration. |
lamboot-repair
Apply targeted fixes to issues discovered by lamboot-diagnose. Always creates a backup first.
lamboot-repair run # Apply all safe, automated fixes
lamboot-repair run --category esp # Fix only ESP-category findings
lamboot-repair run --finding ID # Fix a specific finding by ID
lamboot-repair preview # Show what 'run' would do (equivalent to --dry-run)
Repairs are idempotent: re-running after a partial failure is safe and will only re-apply changes that are still needed. Pass --backup-dir DIR to control where the pre-repair backup is stored.
lamboot-migrate
Convert between boot modes: CSM/BIOS to UEFI, UEFI to Secure Boot, standard kernel to Unified Kernel Image.
lamboot-migrate to-uefi # Convert BIOS/CSM → UEFI
lamboot-migrate to-secureboot # Enroll keys and enable Secure Boot
lamboot-migrate to-uki # Build and register a Unified Kernel Image
lamboot-migrate status # Report current boot mode and readiness
lamboot-migrate preflight # Run pre-migration checks without changes
| Flag | Description |
|---|---|
| --stage STAGE | Resume a migration from a specific stage. Useful after a partial run or reboot. |
| --target-disk DEV | Target a different disk. Defaults to the boot disk. |
| --reboot | Reboot automatically at the end of the migration once user confirms. |
Critical: Run lamboot-migrate preflight before any migration. Always run from a bootable rescue environment if converting the primary boot drive of a production system. Does not support --offline.
lamboot-doctor
Guided repair session. Calls lamboot-diagnose internally, groups findings by priority, proposes fixes, and walks through each interactively.
lamboot-doctor run # Full interactive repair session
lamboot-doctor run --auto # Automated session (answers yes, no prompts)
Doctor is the recommended starting point for unfamiliar systems. It runs the full diagnostic suite, groups findings by priority, explains each issue in plain language, and asks for confirmation before applying any change. Changes are applied by calling the relevant specialized tool, so its side-effect contract is the union of all the tools it invokes.
lamboot-uki-build
Assemble, sign, and register Unified Kernel Images. Wraps ukify and sbsign with sensible defaults and an integrated Secure Boot signing path.
lamboot-uki-build build # Build a UKI from the running kernel
lamboot-uki-build build --kernel VERSION # Build for a specific kernel version
lamboot-uki-build sign FILE # Sign an existing UKI without rebuilding
lamboot-uki-build install # Install a built UKI to the ESP
lamboot-uki-build verify FILE # Verify a UKI signature
lamboot-signing-keys
Generate, manage, and enroll Secure Boot signing keys (Platform Key, Key Exchange Key, Signature Database).
lamboot-signing-keys status # Check current key enrollment
lamboot-signing-keys generate # Generate a new PK/KEK/db key set
lamboot-signing-keys enroll # Enroll generated keys via UEFI Setup Mode
lamboot-signing-keys export # Export public certificates
lamboot-signing-keys backup # Backup key material to an encrypted archive
lamboot-inspect
Deep inspection of boot artefacts: PE/COFF EFI binaries, UKI sections, kernel cmdline, initrd contents, and Secure Boot certificate chains.
lamboot-inspect efi FILE # Inspect a PE/COFF EFI binary
lamboot-inspect uki FILE # Decode all sections of a UKI
lamboot-inspect initrd FILE # List initrd contents and extraction points
lamboot-inspect cert FILE # Decode a DER/PEM certificate
lamboot-inspect cmdline # Show current kernel cmdline and sources
All subcommands are fully offline-capable: pass any file path, not just system paths. Useful for inspecting artefacts from other machines or verifying builds before deployment.
lamboot-toolkit
Top-level dispatcher for the suite. A convenient entry point when you want to explore available tools or run toolkit-wide operations.
lamboot-toolkit status # Suite-wide health overview
lamboot-toolkit list # List every installed tool with version and description
lamboot-toolkit update # Check GitHub Releases for a new toolkit version
lamboot-toolkit doctor # Alias for lamboot-doctor run
$ lamboot-toolkit status
lamboot-tools 0.9.1 ─ 11 tools ─ x86_64 ─ UEFI native boot
lamboot-diagnose 0.9.1 ✔
lamboot-esp 0.9.1 ✔
lamboot-nvram 0.9.1 ✔
lamboot-backup 0.9.1 ✔
lamboot-repair 0.9.1 ✔
lamboot-migrate 0.9.1 ✔
lamboot-doctor 0.9.1 ✔
lamboot-uki-build 0.9.1 ✔
lamboot-signing-keys 0.9.1 ✔
lamboot-inspect 0.9.1 ✔
lamboot-toolkit 0.9.1 ✔
lamboot-capcheck 0.1.0 ✔ (bundled Rust binary)
lamboot-reader 0.1.0 ✔ (bundled Rust binary)
Rust binaries bundled with 0.9.1
lamboot-capcheck 0.1.0
Probes 12 UEFI firmware capability domains and emits a structured capability report. Useful for pre-migration preflight and for building site-wide firmware inventories.
lamboot-capcheck
lamboot-capcheck --json | jq .capabilities
12 domains: SecureBoot, TPM2, UEFI32, NVMe, USBBoot, PXEBoot, ReliableBoot, Fastboot, UEFI Shell, HTTPS Boot, OVMF detection, Shim presence.
lamboot-reader 0.1.0
Low-level PE/COFF and UKI section reader. Used by lamboot-inspect internally, but also available standalone for integration into build pipelines.
lamboot-reader --sections /boot/efi/EFI/Linux/linux-6.8.efi
lamboot-reader --verify-sig /boot/efi/EFI/BOOT/BOOTx64.EFI