I have recently updated firmware to the beta 6 version of Heads with Librem Key. I enjoy the process of learning about and installing firmware/BIOS but as a programming novice I wanted to share some issues I had in order to help others and to potentially help advance the firmware towards a stable release.
First I downloaded the image from https://source.puri.sm/coreboot/releases/tree/master/librem_13v4 through the browser interface. I noticed ‘commit SHA’ on this page but the value did not match the output of SHA1 or SHA256 of either the .gz file or the extracted .rom file. It made me a little nervous to flash the BIOS without knowing for sure it was downloaded correctly. Is there a better way of downloading and verifying the rom prior to flashing?
I flashed the beta 6 Heads via USB via the Heads GUI. So far so good. The key was no longer synchronized with TPM as expected. First I tried to refresh the TOTP/HOTP but this did not help. I wondered if my public GPG key was erased during flash, I did not get a prompt that it needed a GPG key but I thought maybe this is the problem. I reflashed the BIOS from within Heads adding the GPG key from USB. At this point I attempted to refresh TOTP/HOTP again without success. I then reset the TPM and the key is now green. I was not able to boot the OS however.
This is the part I want to point out for debugging purposes. The code flashed on the screen pretty quickly but it seemed to be failing because of an error where a string cannot be longer than 32 characters. Maybe trying to refresh TOTP/HOTP prior to initializing the TPM that the PCRs might be getting over-filled? I reset the TPM again. Once I verified the /boot partition I was able to boot. It may be worth checking out how Heads behaves when you refresh TOTP/HOTP prior to initializing TPM, this seemed to be the source of my problem. It was easy to fix but a little confusing for a while. Also I am curious if I actually needed to reflash Heads with my GPG key or if that was an unnecessary step.
I have had the Librem 13 v4 for a couple of months and really am enjoying it so far. Hopefully this is helpful to someone else trying to install Heads/PureBoot and the dev team as well.
Have a good weekend,