Tag: Giving and contributing back

Tamper-evident Boot Update: Making Heads More Usable

We announced not too long ago that we have successfully integrated the tamper-evident boot software Heads into our Librem laptops. Heads secures the boot process so that you can trust that the BIOS and the rest of the boot process hasn’t been tampered with, but with keys that are fully under your control.

Heads is cutting edge software and provides a level of security beyond what you would find in a regular computer. Up to this point though, its main user base are expert-level users who are willing to hardware flash their BIOS. The current user interface is also geared more toward those expert users with command-line scripts that make the assumption that you know a fair amount about how Heads works under the hood.

We want all our customers to benefit from the extra security in Heads so we intend to include it by default in all of our laptops in the future. For that to work though, Heads needs to be accessible for people of all experience levels. Most users don’t want to drop to a recovery shell with an odd error message so they can type some commands if they happen to update their BIOS, and they don’t want to be locked out of their system if they forgot to update their file signatures in /boot after a kernel update.

When we announced that we were partnering with Trammell Hudson to use Heads on our laptops, we didn’t just mean “thanks for the Free Software, see you later!” Instead, we are putting our own internal engineering efforts to the task of not just porting Heads to our hardware, but also improving it–and sharing those improvements upstream.

The Delicious GUI Center

The first of our improvements is focused on making the boot screen more accessible. We started by added whiptail (software that lets you display GUI menus in a console) to Heads so that we can display a boot menu that more closely resembles GRUB. We then duplicated the features of the existing Heads boot menu so that instead of this:

Heads booting on a Librem 13v2
Heads booting on a Librem 13v2

you now see this:

Initial Heads GUI Menu
Initial Heads GUI Menu

If you hit enter, you boot straight into your OS just like with GRUB, only behind the scenes Heads is checking all the files in /boot for tampering. If you hadn’t already configured a default boot option, instead of dumping you back to a main menu with no explanation or existing out to a shell, we decided to provide a GUI so you can decide what to do next:

No Default Boot Set
No Default Boot Set

If you decide to load a menu of boot options from the main menu or from this dialog, we also wrapped a GUI around the Heads boot menu that parses your GRUB config file:

Heads Boot Selection Menu
Heads Boot Selection Menu

In each of the most common workflows, we’ve replaced the console output with an easier-to-use menu that also provides a bit more explanation on what’s happening if something goes wrong. For the most part the average user will just verify the TOTP code and then hit Enter to boot their system so in that way it’s not much different from a standard GRUB boot screen. These extra menus come in only if the user ever needs to deviate from the default and select a different kernel, generate a new TOTP code, or do other maintenance within Heads.

What’s Next

We now have these GUI menus working well in our internal Heads prototypes and we’ve also pushed our changes upstream, where most of them have already been pulled into the Heads project. That said, having a GUI boot menu is only part of what you need to make tamper-evident boot usable. Now that the boot menu is in a good place, our next focus is on making the overall Heads bootstrap and update process, key management, and signature generation easy (if only we had a GPG expert to help us with smart card integration, that would sure make things easier). Keep an eye out for more updates along all these lines soon.


Librem 5 puzzle pieces starting to come together—graphics, adaptive applications, docs and SDK

The Librem 5 is a big project. And like a lot of big projects, as you probably know, it can appear overwhelming, until you can break the parts down into logical steps. Like a large puzzle scattered on a table, our team has been organizing and beginning to assemble all the pieces. This is very exciting to progress through the initial daunting scope, accepting the tasks, start working and then… after some time, solutions emerge and almost magically align.

In our previous blog posts we described what we were starting to work on, and these efforts began to prove themselves out significantly during our week-long hackfest where part of our software phone team gathered last week in Siegen, Germany. Read more

GNOME and KDE in PureOS: diversity across devices

PureOS, a Free Software Foundation endorsed GNU distribution, is what Purism pre-installs on all Librem laptops (in addition to it being freely available for the public to run on their own compatible hardware or virtual machines). It comes with a GNOME desktop environment by default, and of course, since we love free ethical software, users can use KDE that is also available within PureOS. This is the future we will continue to advance across all our devices: a PureOS GNOME-first strategy, with other Desktop Environments (DEs), such as KDE, available and supported by Purism.

At Purism we want a unified default desktop environment, and considering that we have chosen GNOME to be the default on laptops, we hope to extend GNOME to also be the default on phones. The ability for users to switch is also very powerful, and having a strong, usable, and supported alternative—that is, KDE/Plasma—for the Librem 5 offers the best of the “unified default” world and the “usable user choice” worlds.

Symbiotic GNOME and KDE partnerships

Purism has partnered with both GNOME and KDE for the Librem 5; what this means simply is that users running PureOS on their Librem 5 will get the choice of a GNOME environment or a KDE/Plasma environment, and the user could always switch between the two, like what is already the case on computers running PureOS. Will there be other partnerships in the future? We imagine so, since we will be happy to support any and all ethical OSes, GNU distributions, and want to make sure that the future is bright for a non-Android-non-iOS world.

While the initial GNOME and KDE partnerships mean uplifting diversity at the top level (and greater choice for users), each have a slightly different developmental and support roadmap. The reason for this is pragmatic, since KDE is very far along with their “Plasma” mobile desktop environment, while GNOME is farther behind currently. Investing time and efforts to advance the status of mobile GNOME/GTK+, aligns with our longer-term goals of a unified default desktop environment for PureOS, offering a convenient default for users. Diversity is why we are supporting and developing both GNOME/GTK+ and KDE/Plasma.


  • KDE: Purism is investing in hardware design, development kits, and supporting the KDE/Plasma community, and will be sharing all early documentation, hardware designs, and kernel development progress with the core KDE/Plasma developers and community.
  • GNOME: Purism is investing the same in hardware design, development kits, and supporting the GNOME/GTK+ community as we are with the KDE/Plasma community. In addition, Purism is needing to lead some of the development within the GNOME community, since there is not a large community around an upstream-first GNOME/GTK+ for mobile yet.

Choice is good, redundancy is good, but those are ideal when there is minimal additional investment required to accomplish technological parity. Since Purism uses GNOME as the default desktop environment within PureOS on our laptops, we figured we are going to invest some direct development efforts in GNOME/GTK+ for mobile to stay consistent across our default platforms. Adding KDE as a second desktop environment is directly aligned with our beliefs, and we are very excited to support KDE/Plasma on our Librem 5 phone as well as within PureOS for all our hardware. We will support additional efforts, if they align with our strict beliefs.

Why not just use KDE/Plasma and call it a day?

If we were doing short-term planning it would be easy to “just use Plasma” for the Librem 5, but that would undermine our long-term vision of having a consistent look/feel across all our devices, where GNOME/GTK+ is already the default and what we’ve invested in. Supporting both communities, while advancing GNOME/GTK+ on mobile to allow it to catch up, aligns perfectly with our short-term goals (offering Plasma on our Librem 5 hardware for early adopters who prefer this option), while meeting our long-term vision (offering a unified GNOME stack as our primary technological stack across all our hardware). It is also a good way to give back to a project that needs our help.

Why not just push GNOME and GTK+ and forward?

Because having an amazingly built Plasma offering available early to test and ship to users is a superb plan in many ways—not just for redundancy, but also because KDE/Plasma also aligns so well with our beliefs. The product readiness across these two desktop environments are so different it is not easy to compare side-by-side.

Empowering both communities is possible

Overall, Purism is investing the same amount across hardware, boot loader, kernel, drivers and UI/UX. These are shared resources. The deviation boils down to:

  • GTK+ and the GNOME “shell” development, that Purism is planning to be directly invested in, in close collaboration with upstream
  • Community support: by being involved in both communities, we are effectively doubling our efforts on supporting those communities, but that is a small cost for the greater benefit of users.

Supporting both KDE/Plasma and GNOME means we will continue to build, support, and release software that works well for users across Purism hardware and within PureOS. Purism fully acknowledges that each platform is in different release states, and will be working with each community in the areas required—be that software development, hardware development kits donated, community outreach, conference sponsorship, speaking engagements, and offering product for key personnel.

Announcing our discount program for Debian Developers

We are kicking off a program that will provide Debian Developers a 20% discount on the price of our new laptops base configurations (i.e.: without extras) and 50% off of the price of our refurbished base configurations. This amounts to $280 off of a new Librem 13 and $320 off of a new Librem 15. This discount program is designed as another way which Purism SPC gives back to the Free Software technologies and communities that we rely on for PureOS, the GNU/Linux Distribution we maintain and preload on our Librem line of devices as a convenience to users. Since PureOS is a modified version of Debian, we feel that Debian developers are PureOS developers as well and we want to reward their contributions.

To qualify for this discount program, you need to be a verifiable Debian Developer. Please email us at ops@puri.sm from your Debian email account, signed with your Debian public key. In the email body, request access to this discount program and we will email a voucher code to you. Then you can simply go the Purism product page, choose the model you want, and once it has been added to your “cart” input the voucher code in the “coupon” line of the Cart and benefit from those beautiful savings.

A big thank you to all of those who give their time and knowledge to the advancement of Free Software!

Make your own Librem 5 concept art.

A few days ago, a very talented Librem 5 enthusiast asked me for some HD material to create his own Librem 5 concept art, so I have put together a couple of blank renders of the handset, along with the logos in SVG format.

All this design is currently a work in progress and I believe in collaborative efforts. I believe in the people’s power. I believe in the fact that we don’t own Creativity. We just own the pleasure of expressing it. I see Creativity as a global positive energy that vibrates and grows through all of us. We should never restrict its freedom of movement. Freely collaborating and sharing with the world is the essence of the Free Software movement and is what Purism is made of.

In that regard I thought I would make those files public for anyone to freely join the fun.
So, if you feel like expressing your artistic skills and your vision of what could be a smartphone that is made for user’s respect and software freedom, feel free to do so!

Download the Librem 5 Concept Pack

Enjoy! 🙂

Meet the development team at the 2017 Debian Conference

We are proud to announce that we will be sponsoring and attending the 2017 Debian conference from August 1st to August 12 in Montréal, Canada. As PureOS is a derivative of Debian and various members of the team come from the Debian community, it is with great pleasure that we will support this event.

Many Purism team members will be present, including Zlatan Todorić (our CTO and an official Debian developer) with Matthias “Ximion” Klumpp, Jonas Smedegaard (Debian Developer) and Chris Lamb (current Debian Project Leader) for the full duration of the event, including the workshops (“Debcamp”) and core conference days.

Purism CEO Todd Weaver will also be attending from August 4th to August 8th.

On the “Open Day” on Saturday August 5th, we will be showcasing a couple of our newest Librem production models and prototypes.

Participation in the Debian conference and “open day” is free and no registration is required. Come and say hi! See the important dates for more information.

Jeff will also be available in the days before and after the event, to handle any logistics needs, or to answer any business or press inquiries. Should you want to meet before or after the event, please get in touch with us at pr@puri.sm.

Celebrate GNOME’s 20th anniversary with us at GUADEC 2017

We are proud to announce that we will be attending the GNOME flagship conference, GUADEC, from July 28th to 30th, and co-sponsoring GNOME’s 20th anniversary celebration event at the Manchester Museum of Science and Industry on Saturday the 29th.

The local GUADEC organizers make a beautiful parallel between the local heritage of Manchester and the bleeding edge technology we are all developing:

“We’ll be planning the future of computing in the same city where some early breakthroughs in computing were made. The world’s first stored-program computer was developed at the University of Manchester in the late 1940s and the Museum has a working replica in the Revolution Hall where we’ll be holding the event, along with other amazing exhibits from the city’s industrial legacy.” — GUADEC 2017 organizers

We’re happy to be contributing to the party event on Saturday—where there will be food, lively discussions, and much rejoicing!

You will also be able to see a couple of our newest Librem production models and prototypes on display there—not that they “belong in a museum”,  but we do think they are interesting enough to be exhibited in a venue that honors science and industry.

During the rest of the conference’s core days, we (Jeff, Matthias, François, Todd) will be roaming around the Manchester Metropolitan University’s “Brooks” building to discuss topics of interest with fellow contributors and old friends. We’re particularly interested in:

  • Mobile and touch graphical user interfaces and input handling (including multitouch, gestures, etc.)
  • Power optimization (for laptops, tablets and phones)
  • Sandboxing, privacy and security in general
  • OEM desktop environment, applications and contents customizability
  • Extensions robustness
  • Graphics performance
  • Apps and Package robustness and user experience
  • Firmware updates management

Purism advisory board member Matthew Garrett will also be attending.

Come and say hi! We’ll be happy to meet GNOME enthusiasts—whether veterans or newcomers—and to answer any questions attendees may have for us.

A shipping update for Qubes-related orders

In light of our shipping-from-inventory fulfillment model having recently begun and in order to answer questions we have been getting related to pre-loaded versions of Qubes OS, we would like to announce that we will be fulfilling Qubes-related pending orders made until now by offering the Qubes install as a complimentary USB key included at no additional charge in those shipments.

  • Orders made with Qubes OS as the chosen operating system are expected to be fulfilled using the USB key accessory within approximately two weeks. Although the technical method of delivery is different, the $100 licensing fee Purism pays to Qubes will still be honored, for all Qubes-related orders made until August 2nd, 2017.
  • Should you prefer to forego the USB key accessory (containing the latest publicly available Qubes OS installer), please contact ops@puri.sm to adjust your order, which will then begin shipment procedures immediately alongside PureOS-related orders.
  • We apologize for not being able to pre-load Qubes OS onto your machine’s main solid state storage drive, as we have been unable to obtain an automated OEM image (suitable for secure and efficient mass-preloading in our fulfillment center) through our existing agreement with the Qubes Project/Invisible Things Lab s.c.

The current “free Qubes installer USB key” offer will also remain valid for orders placed between today (July 4th) and August 2nd, 2017, at which point our agreement with Qubes shall no longer be in effect. After this date, we may, at our discretion and as a convenience option for customers, offer a USB key accessory containing either a customer-requested free operating system (subject to availability), or a blank USB key, for a minor fee covering the cost of materials and labor.

Some customers have asked us about the recent removal of the Librem 13 “v1” from the certified hardware page on Qubes website. While we were not notified in advance of this change to the contents of the Qubes website, we understand this de-listing to be due to the fact that the Librem 13 v1 is no longer being manufactured, as it has now been succeeded by the Librem 13 version 2 in 2017. The “version 2” has not been sent through the certification process.

Moreover, while our current and previous hardware has been found to work with Qubes OS, we currently no longer have plans to undergo the official certification process for the Librem 13 v2 nor Librem 15 v3. The costs involved, requiring a supplementary technical consulting contract with Qubes/ITL (as per their new Commercial Hardware Goals proposal document), are not financially justifiable for us.

We have no doubts that Qubes users will be able to independently report their successes with Qubes OS on the Librem laptops within the next few weeks.

We wish Qubes and Invisible Things Lab s.c. the best of luck in establishing commercial partnerships that match their new expectations.

Coreboot on the Librem 13 v2, part 1

Hello everyone! I am very happy to announce that the coreboot port to the Librem 13 v2 as well as the Librem 15 v3 is done! Wow, what an adventure! The entire thing took about 2 weeks of hard work, and an additional week of testing, fixing small issues that kept popping up, and cleaning up the code/commits.

It was truly an adventure, and I would have liked to stop and take the time to write 10 blog posts during that time, one for every major bump in the road or milestone, but I was under a strict deadline because we needed to finish the port before we started shipping the new Librem 13 v2 hardware (from now on referred to as ‘the v2’), so it could be shipping with coreboot pre-installed from day one. Now that the port is finished, I can finally start writing the first chapter in the story.

TL;DR: in the process of porting the Skylake-based Librem 13 v2 to coreboot, I have implemented a new debugging method (“flashconsole”) and added it to coreboot. It has been reviewed and merged upstream. Read more

Website and forums: Easier, Better, Faster, Stronger.

We are happy to announce that we have recently deployed our new forums, running Discourse! The provide a modern, pleasant-to-use dedicated discussion tool. We have tested them out with early adopters over the past few weeks, and they are a real joy to use. You can now participate too, at forums.puri.sm.

What’s special about Discourse? Besides the official list of features, you may want to read this seminal blog post where Jeff Atwood highlights the kind of thinking that went into its functional (and aesthetic) design, making it quite different compared to traditional forum software.

Our migration to a self-hosted Discourse instance brings many benefits:

  • Improving security by isolating the forums from the rest of our infrastructure;
  • Much better usability and user experience. The previous forums were cumbersome and frustrating to use, littered with bugs and limitations, and they just looked awful visually. The new ones are much more readable, and full of modern community-enhancing features. Using a forum should be fun, not boring or cumbersome, and I know that Discourse’s design actively encourages a sense of community and self-moderation, so I’m looking forward to seeing the results over time. We hope you’ll love the new discussion tools!
  • More flexible community management tools;
  • Better email notifications, and less noise (Discourse will not spam you with mail notifications if you’ve been recently active on the forums website);
  • Simplifying our main website’s daily management (previously, the forums actually interfered with the rest of the administration UI);
  • Better performance and resources usage.

Read more