Questions

Libreboot is a coreboot distribution. Its own analogy: Libreboot is to coreboot what Debian is to Linux. The same code, packaged so you can build and install it without becoming a firmware developer.

Our machines carry two payloads, the boot menus the firmware hands over to. GRUB opens an encrypted disk directly; SeaBIOS behaves like a conventional BIOS, which some operating systems and plug-in cards expect. You pick at boot.

Close enough that the words are used interchangeably. It is software on a chip on the mainboard, and it runs before anything on your disk: it wakes the processor, sets up the memory, then hands over to a bootloader. “BIOS” is the older name for the job.

It matters because it runs first. Whatever it decides, your operating system inherits. That is the layer Libreboot replaces with code you can read.

The contents of the flash chip. The vendor firmware comes off and Libreboot 26.01 goes on, carrying GRUB and SeaBIOS. We neutralise the Intel Management Engine with me_cleaner, and undo Intel Boot Guard with deguard so the board accepts firmware you built yourself. No hardware is modified and nothing is soldered.

A small separate processor inside the chipset. It runs its own firmware, starts before your operating system, and is not under your control. We neutralise it with me_cleaner: what is not needed is stripped out, and what remains is the minimum to bring the board up. A board with nothing there does not boot.

So it is neutralised, not removed and not fully disabled. Anyone who tells you otherwise about this generation of hardware is selling something.

Boot Guard is a factory lock: the machine will run only boot firmware the manufacturer signed. It is not a setting and not a password. It is fused into the processor, so it survives a disk wipe, a new drive and a flat battery.

deguard is the Libreboot tool that undoes it, and we run it before the machine ships. Afterwards the board boots firmware you built yourself, which is the whole point.

No, and we will not claim it.

The boot firmware is replaced with code you can read. A small amount of vendor code remains — hardware initialisation, processor microcode, a neutralised Intel ME, and the embedded controller. We are not going to pretend otherwise.

That is the complete list. If you need a machine with less vendor code than that, this generation of x86 hardware is not where you will find it.

Yes. The boot firmware sits below your operating system, so your applications never see it. Same distributions, same package managers, same containers, same compilers. A librebooted T480 running Debian is a T480 running Debian.

What changes is the first few seconds: no vendor splash, no logo, no setup menus, and a passphrase prompt from the flash chip if you encrypt the disk.

Linux distributions and the BSDs are the well-travelled paths, and they are what we test with. GRUB boots a Linux kernel directly from the firmware; SeaBIOS covers anything that expects a conventional BIOS.

Not officially supported, and the Libreboot project recommends you avoid it. We will not talk you out of trying, and we cannot help you with it.

If Windows is a requirement rather than a preference, buy the machine with the firmware it came with.

Yes, and it is the practical thing Libreboot buys you. Because GRUB lives in the firmware, it can open a LUKS volume — LUKS is the standard Linux disk-encryption format — before reading anything from the disk. So /boot goes inside the encrypted volume instead of sitting in the open.

LUKS2 and LUKS1 both work. You type one passphrase, at a prompt that came off the flash chip.

From the Libreboot project, which publishes two stable releases a year, in June and December. 26.01 “Magnanimous Max” landed on 30 January 2026; 25.06 came before it. The build system, lbmk, is on Codeberg, so you can build the same image we ship rather than trust ours.

On the OptiPlex 3050 Micro, yes, from the start: short the service jumper and flash internally.

On the T480 and T580 the first flash is the hard one, and we have already done it. Once Libreboot is on, the vendor flash restrictions are gone, so later updates run internally with no clip and no disassembly.

A half-written boot firmware does not boot, and no software on the machine can fix it — the thing that would run the fix is the thing you broke. Recovery means an external programmer and a clip on the flash chip: you rewrite the chip from another computer.

That is why all three machines use a 16 MB SOIC-8 chip you can reach, not something soldered under a heatsink. Read the upstream procedure first, and keep a copy of what was on the chip.

For text, code, mail, a browser with too many tabs and an external display, yes. On sustained multi-core work a T480 lands around 55 to 70 per cent of a current mid-range laptop chip. 4K video plays; 4K editing and encoding is work for another machine.

Each machine page gives the numbers we are willing to defend, and says where they came from.

Because we are not ready to take money. Every machine reads “Available for purchase soon”, and that is the literal state of things: no basket, no checkout, no waiting list.

When that changes, the buttons will change with it.

Intel-graphics units only, on both ThinkPads. Upstream marks the display as non-working on boards fitted with the discrete MX150 except under SeaBIOS, and a laptop whose screen depends on which payload you chose is not something we will sell.

On the OptiPlex, Wi-Fi is an optional card rather than standard equipment, so the listing will say what is fitted.

Nothing is on sale, so there is no warranty to describe yet, and inventing one here would be worse than saying so. The terms will be published at /legal/terms before anything can be bought; that page currently carries structure and placeholders.

What we can say is about the hardware. All three are serviceable, Lenovo and Dell both publish service procedures, and replacing Libreboot — even with the vendor firmware — is a flash, not a permanent change.

Not for us, and not really for Libreboot either. The project keeps an IRC channel and a mailing list at lists.sr.ht/~libreboot/libreboot. There is no forum and no Discord, and any Matrix rooms you find are unofficial.

Those are the project’s community, not a support desk, and not ours. A question about a machine you bought from us belongs here, not on a volunteer mailing list.

Yes, and you should if you want to. Libreboot documents every machine it supports, lbmk is public, and the OptiPlex 3050 Micro is rated Simple: a service jumper and an internal flash, no programmer.

Both ThinkPads are rated Complex and need an external SPI flasher — a clip-on device that writes the chip directly — for the first write. What you buy from us is that step, plus the part selection and the testing, not access to anything secret.