Hello all, I’ve finished writing a build script to build coreboot from scratch. You can grab it from here:
Advantages of this script:
- You’ll build coreboot yourself and be sure that nobody has tampered with it.
- You’ll update your machine to the latest version (see the change log to know what each new version brought). Some of the feature updates include:
- 2017-08-21: Fix “coreinfo”
- 2017-10-12: The script now neutralizes and disables the Intel ME.
- 2018-02-22: VT-d, IOMMU and TPM are now working, and the Linux kernel no longer gives ATA errors with SATA in 6Gbps mode.
You should first install some of the dependencies needed to build coreboot, with this command:
apt install git build-essential bison flex m4 zlib1g-dev gnat libpci-dev libusb-dev libusb-1.0-0-dev dmidecode bsdiff
Those are the dependencies needed to build it, from a freshly installed PureOS—if you run a different distribution, you may need to install different packages (or the same ones but with different package names).
Then simply run the script on your librem itself, and select which machine you have and let it build. It will first ask you if you want to build it for Librem 13 v1, Librem 13 v2, or Librem 15 v1/v2 or Librem 15 v3, then if you want to grab the required binary blobs from your local machine (which I highly suggest, and which is why you should run the script on your librem itself), it will then verify the hashes of all the binary blobs, then it will ask you for the serial number of the machine (it will auto-grab it from your system though, which makes it easier) then it will build the coreboot cross-compiler (which takes about an hour to build) then finally build coreboot itself, then it will verify that the hash of coreboot is what it expects (thanks to coreboot’s reproducible builds, we can do that), making sure 100% that the image you have built is the same as everyone else’s and it’s guaranteed to work. It will then ask you if you want to flash your system (If the image hash doesn’t match what we expect, it won’t ask you if you want to flash it). Make sure your battery isn’t dead and that the power supply is connected, and do not interrupt the process, then it should flash it and on your next reboot, you’ll have the latest coreboot build.
That’s all there is to it.
If you have any issues with the script, let me know, and of course, if it doesn’t say that the final hash matches what it expected and present you with the choice to flash coreboot, then don’t flash the image it produced!