Flashing Coreboot Firmware with TianoCore on a Purism Librem 14 Laptop in order to install NixOS

This tutorial is a guide on flashing (i.e. installing) Coreboot firmware on to a Purism Librem 14 laptop. Coreboot is an open source firmware platform that supports multiple payloads. We will be flashing the TianoCore payload, which is an open source implementation of UEFI.

We will do this by first booting into a 'Live' Linux operating system that is installed on a USB disk. From this environment, we will download the ChromeOS Firmware Utility Script from Mr.Chromebox. Using the firmware utility script, we will flash the laptop with Coreboot and TianoCore.

Why is Flashing Coreboot with TianoCore Necessary?

Modern (circa 2017) Purism devices ship with Pureboot firmware by default. This firmware is based upon Coreboot, and offers additional tamper-evident features such as Heads. However, Pureboot is a BIOS firmware, not UEFI. As a result, it does not support EFI boot.

NixOS 21.05 does comes with instructions for installing on a BIOS using GRUB. However, I was unable to accomplish this successfully. As a result, I decided to use Coreboot with TianoCore as my firmware instead.

Prerequisites

You must have a USB stick with an 'Live' Linux operating system, a stable power supply, as well as an internet connection. I used an USB stick with an installation image of Ubuntu 21.10, but other Debian-based operating systems should also work well.

This tutorial is written for a user that has an intermediate familiarity with Linux operating systems, but who has never flashed their device firmware before. The firmware installation will use a script, hence you do not need any advanced technical knowledge. A familiarity with the Linux command line is beneficial.

Warning 1/3: modifying your laptop's firmware is potentially hazardous. Should the process be interrupted (e.g. due to unexpected power loss), your device may be unable to boot at all. Recovering from such an incident requires the use of a hardware programmer, and may be technically challenging.

Warning 2/3: changing from a BIOS-based firmware to UEFI will render your existing operating system unbootable. A pre-existing installation will expect a BIOS boot process. Changing the underlying firmware will naturally render the bootloader non-functional. This tutorial is meant for a brand-new NixOS installation, and does not contain any information on recovering any pre-existing operating systems.

Warning 3/3: be extremely careful with disk labels when following this tutorial. Devices and partitions may appear under different labels on your system. Commands like dd will cause permanent data loss! Use lsblk in order to check disk labels if at all unsure.

All commands must be run as the root user. This may be done using sudo, or by opening a root shell. In order to open a root shell, simply run:

sudo su root

Preparing Installation Medium

First, download a 'Live' Linux operating system, and image it on to a spare USB stick. Make sure to verify the disk label of your USB stick using lsblk. I used a desktop installation image of Ubuntu 21.10. Once the image is downloaded, you may image it using dd:

dd if=/~Downloads/ubuntu-21.10.iso of=/dev/sdX status=progress

After you have imaged the installation iso on the USB, restart the laptop and boot into the 'Live' operating system on the USB.

Download ChromeOS Firmware Utility Script

Once you have booted into the 'Live' environment of the USB operating system, start a root shell. We will now download the ChromeOS firmware utility script. The ChromeOS firmware utility scripts are by Mr. Chromebox, which offers a convenient method to flash and update the Coreboot-based firmware of ChromeOS-based computers. Mr. Chromebox is a Purism employee and firmware developer, and his firmware utility script is unofficially available for Purism devices as well.

The download page for the firmware utility script is available on his website, with the source files also available at his Github Repository. We will download the script from his Github repository using the commands below.

Change to home directory, and download script:

cd
curl -LO https://raw.githubusercontent.com/MrChromebox/scripts/master/firmware-util.sh

Next, make sure to inspect the downloaded script. Scroll through the file carefully. Press q to exit the reader:

less firmware-util.sh

Running the Firmware Utility Script

Run the script using the bash shell:

bash firmware-util.sh

The script will proceed to download other auxiliary helper scripts. When it is ready, it will present a visual TUI (Text User Interface), with conveniently labeled menu buttons. It will present a menu with a selection of choices.

Select the one labeled Install/Update UEFI (Full ROM) Firmware. Depending on your version of the script, it should be the option #2.

Once you have selected the option, follow the on-screen prompts to confirm. The firmware will then proceed to flash Coreboot with Tianocore on your laptop.

Make sure to not interrupt the process, and that your laptop is connected to power at all times. Once the firmware flashing process is complete, you may restart your computer by pressing r on the prompt.

Verifying that the new TianoCore UEFI firmware is complete.

Restart your laptop in order to boot into the new firmware. Press Esc while the laptop is booting, in order to enter the UEFI interface. Please note that it may take up to 5 minutes for your laptop to reboot for the first time, as the firmware has to complete some initialisation and hardware auto-detection routines. This is perfectly normal, and you do not need to worry. Subsequent boots will take only a few seconds.

You should be now in the new TianoCore UEFI firmware menu! You have successfully completed this tutorial.

Next Steps: Installing NixOS, or any other OS.

Now your Purism Librem 14 laptop is successfully flashed with a high quality, open source UEFI implementation. You can proceed to install any other operating system on top of it.

This guide was specifically written to install NixOS on the Purism Librem 14 laptop. The subsequent guide is available here.