Time to flash is now - but how?

Hardware Librem 5
30

What would your vote be between “LUKS” or whatever the other is?
~s

31

That is not slow. Not even close. You are good to go with that !

LUKS means “encrypted” and the other variant is “plain” which means “not encrypted”.

My personal choice would 100% be encrypted (LUKS).

If you keep personal or private information on your phone (such as the contents of your text message exchanges, emails, … and your contacts … and, for poorly implemented applications, potentially also login credentials) and if the phone is lost or stolen then

  • With LUKS, your information is safe. Sure, you still lost the phone but the financial cost of losing information could be higher than the cost of the phone and then there’s the non-financial cost of losing information.
  • With the unencrypted variant, your information is potentially stolen too. (This might be acceptable if the above covers your threat model and you keep absolutely no information actually on the phone e.g. everything is cloud-based or e.g. you just don’t use it to hold or access private information.)

Edit: Adding: If you store private information on the µSD card then in order to protect all your information then you need both the root file system and the file system on the µSD card to use LUKS. The choice that you make during flashing only covers the root file system.

The downside of encrypted is that if you forget the passphrase for the encryption then you have irrevocably lost access to the information - and you would most likely want to choose a passphrase that is at least a little challenging (although that depends on your threat model).

For the threat model that most people face, choosing a medium complexity passphrase (something that you can easily remember and type, but not something trivial) and just writing the passphrase down and storing it somewhere at home is adequate to mitigate this risk.

If your threat model includes nation state adversaries, including your own government, then it’s a no-brainer that you would use LUKS.

I hope that helps with your decision.

By the way, it is quite difficult (let’s say impossible) to change your decision after the fact - other than reflashing and starting again from scratch. So it is important that you decide up front which variant to use. (I would even go as far as saying: just choose LUKS and use a trivial passphrase e.g. 1234 or space if you actually don’t want the hassle of a passphrase. You can always quickly and easily strengthen the passphrase later on.)

5 Likes
32

But any sensitive data that is stored on the µSD card is not encrypted, right?

3 Likes
33

By the way last time I flashed with the script it would be interrupted by too many server time outs. I think it was 10 at which point it stopped the download. I revised the flashing script to 4000 time outs and it successfully completed. Not sure what was going on, I did have a TOR proxy set so I removed that and will have to see if I still have that issue.

2 Likes
34

That’s entirely up to you !

It is true that the encryption status of the file system(s) on the µSD card is independent of the encryption status of the root file system. (So to that extent, you make a good point and my post did not make that point clear. My claim could come across as overly broad. I will update my post.)

So even if you choose the plain variant disk image, you still have all the LUKS functionality available, so you can still choose to encrypt the µSD card using LUKS. (In general, I think this is not a good choice. If encrypting the µSD card is warranted then the root file system should also be encrypted.)

Of course you may also have other encryption options available for the µSD card i.e. over and above LUKS. (The point is that the root file system must be encrypted using technology, the support for which exists in the boot file system. Any other file system has a wider set of encryption choices, based on what is supported by the system as a whole.)

And for any individual file, you may have other encryption options that go beyond file system encryption e.g. LibreOffice documents can be encrypted in isolation using a password or e.g. a Gnome keyring can always be (is always?) encrypted even when LUKS is not in use or e.g. Thunderbird (poorly) encrypts your stored email account passwords if you choose to use a master password even when LUKS is not in use (by contrast Geary stores those passwords in a Gnome keyring).

2 Likes
35

I had the same problem. The problem is exacerbated by having a s..l..o..w.. internet connection. See discussion prior to the following linked post for the workaround I used and, differently, that I proposed.

See Repo.puri.sm & arm01.puri.sm slow - #6 by guido.gunther that may document the correct workaround. As I have not tested that option to see whether it is more reliable (haven’t had to reflash again) I don’t know whether @amarok should include that?

1 Like
36

So, for instance:

If your connection is very slow or unstable you encounter issues while downloading, use:

sudo ./scripts/librem5-flash-image --variant luks --stable

?

2 Likes
37

Yes, but I believe

a) the instability is at Purism’s end (although instability at the customer end won’t help!), and
b) the flag actually influences what disk image you download i.e. latest stable build v. latest dev build.

To be honest, I’m not sure why --stable isn’t the default !

I would like to suggest that your instructions should unconditionally include that flag. My only hesitation is that I have not myself used that flag.

I don’t know whether Purism might, you know, have fixed the problem with internet connection stability at their end between the time that three different customers noted the problem and now. So we might be talking about a download problem that isn’t even a problem any more.

For the record, here’s what the source says about that flag

Whether to grab the latest stable image, otherwise the dev snapshot is fetched

Instructions for newbs might better suggest grabbing the latest stable image. Right?

2 Likes
38

OK, well, now I don’t know what’s best. Lol!
Maybe just leave it as is, unless someone posts an issue; then someone can advise them.

2 Likes
39

You can use either or. If Jenkins is down, use stable.

40

If the docu is done, I’m about ready. I can only assume using process of elimination that I might have a evergreen and would be doing easy coreboot because I don’t have a Librem Key, using updated PureOS desktop with all flash files as listed by docu on the Desktop.
Either way, I’ll let ya’all know how it goes.

41

None of Coreboot / Pureboot / Librem Key is relevant to the Librem 5.

You almost certainly have an Evergreen phone but I can’t verify that.

To reflash the Librem 5 you need any half-decent / half-recent Linux desktop / laptop. (It is even alleged that you can reflash one phone from another, if you happened to have two phones.)

Then you carefully follow the instructions in post 16 above.

42

One easy way to tell is to measure it.

The Librem 5 (Evergreen) including its battery weighs (9.1 ounces) or (9.2 ounces), depending on the scale.

The dimensions of Librem 5 (Evergreen) are [153 x 75 x 15.5 mm] (6.0 x 3.0 x 0.61 inches).

The development versions were about 3mm shorter in length.

EDIT: Also - I think - the lshw command (“list hardware”) should return: product: Purism Librem 5r4

Someone correct me if I’m wrong about the “r4” (revision 4?).

(If “command not found,” then sudo apt install lshw and rerun the command.)

But in the Frequently Asked Questions that I linked above, @amosbatto says the revision number is not always accurate:

However, this is not a very reliable method since a new operating system could have been installed.

Section 6.3 of the FAQ describes other methods for identifying Evergreen.

1 Like
43

Duh. Sorry about that. It was in the L5 arena

Had to do the “sudo apt get lshw”
It didn’t give any errors. Waited 10 minutes, cancelled and Rebooted, tried again with same result. No compute. Short of it is, I tired rebooting, refreshing modem, WiFi, cabled it, it just hangs. Only way out was pull the battery because nothing else would respond.

Just a FYI:
With battery removed, which is every day now, in the battery seat, is the following:

Back of battery has:

  • BPP-L503

In battery cradle:

  • L5v1-05

Back of battery:

  • Model Librem 5
    1lCP10/57/53
    Rated voltage: 3.8V
    Rated Capacity 4500mAh 17.1Wh
    Limited Charge Voltage 4.35V
    Zhongshan Tianmao Battery Co. Ltd.
    Beside QR code: 2021/04/16

I will press ahead assuming it might be a Evergreen

I read the discussion around it here (response #16 and on) and appreciate @amarok Amarok was putting the edits and changes in a step x step for myself. amaroks response #16 bookmarked. Just continuing backing up texts and attachments.
It’s worse than going alone on a blind date :worried: Well, here goes. Hope it fixes the battery issue too.
~s

1 Like
44

It should be sudo apt install lshw.
You forgot “install.”
(You could also use the “legacy” command: sudo apt-get install lshw.)

1 Like
45

I didn’t forget. What I put here was the second thing I tried after “sudo apt install lshw”
FYI -

  • ‘sudo apt install lshw’ worked this time. I disconnect the L5 from the dock, that failed so I pulled out the battery and startyed again. Tried the cmd again and it went through a bit with a warning that results might be incomplete and to use "superuser. My searches here, without trying both FAQs only result in ‘blah blah http://susperuser…’

So after a day of still don’t know if it’s Evergreen or not but am moving ahead anyway.
Thanks amorok
~

2 Likes
46

Based on the FAQ that I linked earlier, if your battery shows 4500 mAh, you have an Evergreen. Earlier dev versions had smaller batteries.

If you took over someone’s L5 order directly from Purism, then Purism would have shipped you the Evergreen, of course.

Also, that unnecessarily scary warning about the lshw means simply that you’ll get more info by running it as sudo lshw. No biggie.
sudo means superuser do or “run this as superuser, i.e. admin.”

1 Like
47

Thanks. Been there, read them, moved on.

1 Like
48

I’ve been following the edits the guru’s have talked about here but unsure if the edits and if there’s a revised version of Post #16 here and think I should wait until the edits are sorted out, or is Post 16 step guide fait au complet?
~s

49

@sharon, you can follow post #16 as is now. It’s the same procedure @david.hamner followed in his video.

We were speculating that there might be a new, abbreviated procedure coming, but there’s nothing definite on that yet. Meanwhile, the established procedure should work fine.

But FIRST, do launch the Backups app on your Librem 5 and make a backup of the system. Then proceed with reflashing. Shouldn’t take long.

EDIT: In the Backups app, in its Preferences, choose the external microSD card as location to save it (if it’s not already selected).

2 Likes