Time to flash is now - but how?

Hardware Librem 5
12

Regarding re-flashing L5

For me, it’s hard because the instructions assume end user knows how to install to a SD, and what little I think I know, I doubt I have the tools to run a cable to SD.

Your step guide is something many here understand but I am the very small minority (of 1?) who is trying to learn,

  1. Is that the SD that came w/ it, or the one the retailer put in it, or, do we purchase a special one, and where does it go? I know there is a mini-slot that the provider put in there. Is there room for another?
    (☋) I know there is room, and already have 64G in it. It took me a while to figure out how to - now then, how to access it.

  2. Somehow, we install PureOS on a SD card using, say a laptop.
    What’s a “eMMC” and how would we know it’s not in use but shows up as a device. How do we ask it if it’s in use?

  3. How is “dd” used with a .img? Where do we find “dd:” and where does the image come from?
    Too, It looks like we we need to input commands, I take it using the L5 keypad?

  4. Without a SD card, or deleting anything on SD, will that not disable what the mobile provider put in? :thinking:

There you have my “Or if not, why not’”
No one need to take the time to answer. I’ll just use PureOS on a dektop and burn to a USB stick and boot that - maybe. The SIM(?) card that’s in there has mobile setup by the mobile provider - do not want to use that card if I can. Too, the mobile provider just announced we need to update our mobile card and I’m still backing up stuff like photos and especially, pics attached to Chats before the dreaded flashing.

~s

3 Likes
13

More misunderstood stuff. I have nothing against reading, never meant to imply that. But I’ve had several good folk take the time to provide links which I read. And, something like ‘Use uuu to…’ I need to look up uuu, and most every other command. I looked up eMMC verses SSD, and the use term SD. Now wonder why a eMMC is even in it.

I mentioned before that it seems most people have years of experience, and is a hobby of sorts. People that have the time to leap over the geekinese and such.

If I had my druthers, I’d take it to shop and pay them to do it. But I don’t know of any who are capable.

I must put this aside -again, and read more.
~s

2 Likes
14
4 Likes
15

To be absolutely clear: install on the desktop.

Bear in mind that these instructions have to work even when you have completely broken your Librem 5 install and it is not even possible to install anything on the Librem 5.

Hence, in order to reflash, while the Librem 5 must be connected via USB cable to your host computer at the right step in the process, nothing is done by you on the Librem 5. All the commands / software steps are done on the host computer.

Might be a good approach if you can boot from an SD card. However in the worst case where you have completely scrozzled the content of your eMMC drive, my understanding is that you won’t be able to boot from an SD card. So there still needs to be a procedure to recover from the worst case - and that involves a host computer.

If you do decide to have a go with a procedure involving using an SD card, bear in mind that a typical Linux install can’t mount two file systems simultaneously with the same UUID. Using the procedure that you wrote, you will end up with the same UUID on the SD card and the eMMC drive. While that may not ever be a problem, you should give consideration to changing the UUID on the eMMC drive (new random) immediately after using dd to write the disk image to the eMMC drive.

Another step of course involves changing the master encryption key if using the LUKS variant of the disk image, again new random, but of course that always applies i.e. whether reflashing from host or trying your approach of going via SD card.

2 Likes
16

I’ve rewritten the instructions from @david.hamner’s video here in more direct language in a few simple steps. See if this helps.

Flashing the Librem 5 (Evergreen version)

These instructions are for the Evergreen version only, not the earlier development models. All data and downloaded apps will be erased, so back up any files you want to keep to either the micro-SD card or some other separate drive. Make note of any apps you will want to reinstall later.

On a computer running PureOS 10 byzantium or later, or Ubuntu 22.04 LTS jammy or later, or Debian 11 bullseye or later, or another Linux distribution that is based on those releases or later, and…

with the Librem 5 not yet attached:

1- Open the terminal, copy and paste the following to the command line, then press Enter to execute:

sudo apt install git python3-jenkins python3-tqdm uuu

That installs the needed python dependencies (Python is a programming language), and the uuu package: “Universal Update Utility.”

2- Now copy and paste the following to the command line, then press Enter to execute:

git clone https://source.puri.sm/Librem5/librem5-flash-image.git

That creates a directory (i.e. folder) on your computer, called “librem5-flash-image” and downloads the available flashing scripts to it. (Git is used by software developers to coordinate their work and keep track of changes in a software project.)

3- Now copy and paste the following to the command line, then press Enter to execute:

cd librem5-flash-image

That puts you inside the librem5-flash-image directory so that you can run the following commands. (“cd” is a terminal command meaning change to directory x.) Stay in this directory.

4- Now copy and paste only one of the following to the command line, then press Enter to execute:

(If you don’t want to bother with luks encryption, use:)

sudo ./scripts/librem5-flash-image --variant plain

(If you do want to use luks to encrypt the Librem 5:)

sudo ./scripts/librem5-flash-image --variant luks

That downloads the chosen OS image (disk image) and verifies the integrity of the download, and creates the needed .lst file, whereupon it executes uuu to flash the disk image to the Librem 5.

5- Once the scripts download has finished, follow the on-screen prompt to attach the Librem 5 for flashing. The phone itself will not provide an indication of the boot mode – the script will simply continue once you follow these steps. With the USB-A end of the cable attached to the computer, next:

    Ensure that the phone is switched off.

    Turn all Hardware-Kill-Switches off

    Remove battery

    Hold volume-up

    Insert the USB-C cable into the Librem 5: (red light blinks, no green light)

    Reinsert the battery: (red light is constantly on, the script will continue)

    Release volume-up

Note: If the instructions above do not appear to work, try flipping the USB-C end of the cable over and replugging it into the phone.

In the terminal, you should see output similar to this, but not exactly the same:

uuu (Universal Update Utility) for nxp imx chips -- libpureos/1.2.91+0git6b465-62-g9c56e46

Success 1 Failure 0

6- Remove the USB-C cable and hold down the power button for 15-18 seconds to reset the phone.

Your phone should now be running the latest stable image.

EDIT: The package librem5-flash-image is now available from the latest Ubuntu-based repositories for direct install, and includes all dependencies. However, as it may necessitate alterations to the above steps, and no official instructions have been made available yet, the new procedure will be left for another time.

12 Likes
17

Minor suggested edits:

In step 2 …

downloads the available OS images to it

The git clone only downloads scripts. No OS images are downloaded I believe. (Hence this step is quite quick.)

In step 4 …

That downloads the scripts for flashing the OS image.

I believe that actually does the following job of:

  • downloading the chosen OS image (disk image)
  • verifying the download (do SHA256 and compare with the value from another file that gets downloaded, a small metadata file)
  • creating an additional file that is needed in order to use uuu (the .lst file)
  • and finally executes uuu to flash the disk image to the Librem 5.

(but doesn’t download any scripts)

On a s…l…o…w… internet connection, that can make the timing tricky - since the download could take a very long time and then suddenly uuu is running on the host computer and wanting you to connect the Librem 5 via USB cable and meanwhile you have wandered off to do something else.

I did submit a merge request to improve this doco a little. I think that MR may have stalled. However from that discussion it emerged, as you already know, that if you are really using a recent Ubuntu-based Linux distro, you don’t need the git clone at all because the script (package librem5-flash-image) is actually available in the distro’s repo and with correct dependencies that will install automatically. In other words, Purism has managed to upstream the needed script.

So this is both a good thing and a bad thing. It’s a good thing because potentially things get simpler. It’s a bad thing because potentially the instructions get less simple as they try to cover both customers who are using a suitable (recent) distro - and those who aren’t. :wink:

4 Likes
18

Fixed. Thanks for clarifying!

I’ll add a comment about the git command possibly not being needed.

2 Likes
19

It’s actually steps 1 and 2 that may not be needed. So you really need a Step 0. Install that package.

If it works (package exists) then skip Step 1 and 2. If it doesn’t work then do Steps 1 and 2

… but … steps 3 and 4 will be different too, I would guess, because the script location and directory location will be different.

I think you can see why the MR has stalled. :wink:

3 Likes
20

Just tested sudo apt install librem5-flash-image on my latest updated system. It succeeds, installs dependencies, etc., but does not create a directory called librem5-flash-image. Maybe step 4 is no longer needed? (Check above; I’m in the process of renumbering the steps.)

1 Like
21

Very likely. Because I have not used that package, I don’t know what the directory and script locations are. I think Step 5 will be slightly incorrect too (wrong script location).

PS You have a formatting glitch in the command in Step 1.

2 Likes
22

OK, maybe, in the absence of better documentation, I’ll just revert my post to the original steps, and mention the new method (awaiting clarification) at the bottom. Thoughts?

EDIT: In the meantime, I found it by searching the File System:
/usr/share/doc/librem5-flash-image

2 Likes
23

Have two procedures. One for “package available” and one for “package not available”. And don’t attempt to document the new procedure until you have a chance to run through the new procedure yourself. So the doco would necessarily be incomplete for now.

My guess is that if the package is available then the script will be in your path.

2 Likes
24

Revised the text. See what you think.
Thanks.

1 Like
25

:+1:

Now we just need someone to run through it for testing.

1 Like
26

“Someone” who only recently flashed to byzantium, maybe…? :wink:

2 Likes
27

Nah, m8, my internet’s too **** - so that the procedure won’t actually work. I have to run the script “twice” - once to download the disk image and once to flash the disk image (where that first “once” might end up being “lots”).

The script offers options to separate out the downloading from the flashing.

I’m assuming that @Sharon has first-world internet and so won’t be concerned with that problem.

Also, I wanted to separate those steps anyway because after downloading and before flashing, I want to change the disk encryption master key (new random) and strengthen the slot encryption parameters. However that is only relevant if someone chooses the LUKS variant.

I wasn’t raising any of this, so as to keep the instructions at least somewhat concise and simple.

2 Likes
28

And actually David Hamner already demonstrated the commands working correctly in his video. I simply copied them from his blog post. (And added the bit you previously mentioned about designating the variant.)

1 Like
29

I guess it matters what a “s…l…o…w…” is.

of the two desktops, the one I will use to flash with, can get 300 - 350 Mbps.
Is that slow at my end too slow, medium. I still have a 300 “baud” modem tho :slight_smile:
I went out to get a Fem USB A to male USB C. I got groceries, wine and some wine and forgot the reason I went out. Darn! I can get other things ready till my ride comes again. Lots of reading to do here till then.

Thanks for the help
~s.

1 Like
30

What would your vote be between “LUKS” or whatever the other is?
~s

31

That is not slow. Not even close. You are good to go with that !

LUKS means “encrypted” and the other variant is “plain” which means “not encrypted”.

My personal choice would 100% be encrypted (LUKS).

If you keep personal or private information on your phone (such as the contents of your text message exchanges, emails, … and your contacts … and, for poorly implemented applications, potentially also login credentials) and if the phone is lost or stolen then

  • With LUKS, your information is safe. Sure, you still lost the phone but the financial cost of losing information could be higher than the cost of the phone and then there’s the non-financial cost of losing information.
  • With the unencrypted variant, your information is potentially stolen too. (This might be acceptable if the above covers your threat model and you keep absolutely no information actually on the phone e.g. everything is cloud-based or e.g. you just don’t use it to hold or access private information.)

Edit: Adding: If you store private information on the µSD card then in order to protect all your information then you need both the root file system and the file system on the µSD card to use LUKS. The choice that you make during flashing only covers the root file system.

The downside of encrypted is that if you forget the passphrase for the encryption then you have irrevocably lost access to the information - and you would most likely want to choose a passphrase that is at least a little challenging (although that depends on your threat model).

For the threat model that most people face, choosing a medium complexity passphrase (something that you can easily remember and type, but not something trivial) and just writing the passphrase down and storing it somewhere at home is adequate to mitigate this risk.

If your threat model includes nation state adversaries, including your own government, then it’s a no-brainer that you would use LUKS.

I hope that helps with your decision.

By the way, it is quite difficult (let’s say impossible) to change your decision after the fact - other than reflashing and starting again from scratch. So it is important that you decide up front which variant to use. (I would even go as far as saying: just choose LUKS and use a trivial passphrase e.g. 1234 or space if you actually don’t want the hassle of a passphrase. You can always quickly and easily strengthen the passphrase later on.)

5 Likes