Given that my Librem laptop was shipped last Tuesday, and Intel’s ME has been completely disabled since October 19, at what point did Purism start applying this update?
Update: I just received an e-mail stating that they’ve started applying the update a couple of days before. I’d guess that’ll mean you won’t have to update your laptop if it shipped on/after October 18 or so.
I’m not sure exactly when it started to be shipped disabled, but I think it was a few days (maybe a week?) before the release of the article, since it takes some time to write and review all that text.
To check, you just need to run : cbmem -c | grep "ME:" (you may need to apt-get install coreboot-utils first). and look at the output, if the first line says “FW Partition Table : BAD”, then the ME is disabled, otherwise it’s not. (this applies to the never skylake based systems only)
For the update to existing customers, as @jaylittle said, download the build_coreboot.sh script and run it and follow instructions. It’s the safest method right now. Eventually, we’ll have an updater script which doesn’t require you to rebiuld coreboot from scratch. Note that the dependency list needed for that script to work is written in the first lines of the script itself, so just apt-get install those dependencies.
It’s all explained here :