stuff

common/boot.nix

@@ -1,4 +1,5 @@
-{config, inputs, ...}: {
+{ config, inputs, ... }:
+{
   imports = [
     inputs.lanzaboote.nixosModules.lanzaboote
   ];

common/git.nix

@@ -1,4 +1,5 @@
-{pkgs, ...}: {
+{ pkgs, ... }:
+{
   programs.git = {
     enable = true;
     lfs.enable = true;

common/nini.nix

@@ -1,4 +1,5 @@
-{inputs, ...}: {
+{ inputs, ... }:
+{
   imports = [
     inputs.nini.nixosModules.default
   ];

common/secure-boot.nix

@@ -1,12 +1,24 @@
-{self, attrName, config, lib, pkgs, ...}: let
+{
+  self,
+  attrName,
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
   inherit (config.age) secrets;
-in{
+in
+{
   age.secrets.secure-boot.file = self + /secrets/secure-boot/${attrName}.tar.age;
 
-  system.activationScripts.secureboot = let
-    target = config.boot.lanzaboote.pkiBundle;
-  in ''
-    mkdir --parents ${target}
-    ${lib.getExe pkgs.gnutar} --extract --file ${secrets.secure-boot.path} --directory ${target}
-  '';
+  system.activationScripts.secureboot =
+    let
+      target = config.boot.lanzaboote.pkiBundle;
+    in
+    ''
+      rm --recursive --force -- ${lib.escapeShellArg target}
+      mkdir --parents -- ${lib.escapeShellArg target}
+      ${lib.getExe pkgs.gnutar} --extract --file ${lib.escapeShellArg secrets.secure-boot.path} --directory ${lib.escapeShellArg target}
+    '';
 }