How to update coreboot offline

[MrChromebox]

@fsflover

Qubes OS allows to securely install OS packages even in offline VMs (via TemplateVMs, which are also offline).

but the version of flashrom needed to update the mini v2/L14 aren’t packaged, at all. Currently, it has to be built from source.

@fsflover

This means, we are not very far from a possibility to apply the Coreboot updates securely. We only need to add files and packages to the PureOS live .iso, right? If Purism cannot do it once a month, could you at least provide instructions for that? Users would need to know the exact list of needed files and packages (ideally with download links and signing keys), and a method to add those files to the .iso without making it non-bootable.

(re)packaging ISOs is not something I’ve done or have any familiarity with. But at a minimum, you’d need the coreboot utility script, the files in the releases repo which correspond to the releases repo hash in the script, the packages for the dependencies listed in the script, and a cloned flashrom repo set to the commit hash listed in the script.

[fsflover]

@MrChromebox

but the version of flashrom needed to update the mini v2/L14 aren’t packaged, at all. Currently, it has to be built from source.

It doesn’t matter whether the packages are official or not. Of course, one can compile from source securely as well.

@MrChromebox

But at a minimum, you’d need the coreboot utility script, the files in the releases repo which correspond to the releases repo hash in the script, the packages for the dependencies listed in the script, and a cloned flashrom repo set to the commit hash listed in the script.

Would you be able to provide the links to all those files? I don’t mind to download them all and let the flash script find what it needs by itself. Maybe I can try using two USB sticks for a start.

[fee]

Shooting form the hips: Could it be possible to refactor the script in a way so it does all the checking, all the downloading and all the installing in three separate and individually executable steps? The way I understand it all the functionality is already there?!

[fsflover]

I would appreciate any help explaining how to download the update script with all necessary packages, so that it will not ask to go online.

[radiant]

i am currently having problems with pureboot + librem key and it has been suggested that i reflash pureboot.

Librem key problems: reset key + signing files in /boot

There is a lot missing from the documentation, but we are going to ignore discussing it for now and simply deal with your issue first. Follow these instructions to reflash PureBoot. The order of operation I suggest is to flash Coreboot first, then flash PureBoot over it in a separate sequential session. After rebooting, you will be prompted to do a factory reset in PureBoot. Accept it and you will be able to properly use the Librem Key for boot firmware tamper protection purposes.

given this most recent post, i expect nothing has moved on this front, which is disappointing.

i recently updated the embedded controller on a librem 14 and updating that does indeed have its own image and process that does not require pureos or going online.

[jonathon.hall]

There has been a lot of work on coreboot_util.sh, which now works much better in a Qube, container, or off-host.

If you are using PureBoot (with any installed OS), then PureBoot does the real flashing work. You can run coreboot_util.sh to download the new ROM, or you can download it yourself from the releases repo (firmware / releases · GitLab). Just put the ROM on a flash drive and flash it within PureBoot.

On the other hand, if you use coreboot/SeaBIOS (or are switching between the two), then coreboot_util.sh ideally will actually flash the update. If you are a Qubes + coreboot/SeaBIOS user, this is where it might be simpler to use PureOS Live. If you don’t want to do that though, coreboot_util.sh will still prepare the ROM for you in a Qube, with bootorder/serial/etc. Then you would have to move the file to dom0 and flash yourself with flashrom.

So overall, this is much smoother now, especially if you use PureBoot. If you do use Qubes with coreboot/SeaBIOS, you might want to consider trying PureBoot Basic instead, which has the capability to update itself like PureBoot but doesn’t require a Librem Key.

If you do still have issues, or there’s an OS/firmware combination that’s not served well right now, feel free to ping me in a relevant thread or open an issue in the utility repo (firmware / utility · GitLab).

[fsflover]

Thank you so much for your help! It looks great now.

One question is left for me: how do I find my serial number in dom0, without running the utility? Or should I go to the coreboot for that?

[jonathon.hall]

To see the serial number, just run this in a dom0 terminal: sudo dmidecode -s system-serial-number

[fsflover]

Thank you, it worked!