The first software your computer runs, rewritten so you can read every line.

Before your operating system exists, something wakes the processor, sets up the memory and finds a disk. That is the boot firmware — the first code a computer runs. On almost every machine sold it is a binary you cannot read or replace, and it decides what runs next. Libreboot replaces it with code you can read, build and flash yourself. Everything above it stays the same: the same Linux, the same tools, the same disks. What changes is that the first thing to run is no longer a secret.

Press the power button and you are at a login prompt seconds later. No splash screen, no logo, no progress bar, no key to catch. The firmware brings up the hardware and hands over. Most of what a factory BIOS does is absent: a graphical setup screen, a network stack, option ROMs — firmware for cards this machine does not have. You get a line of text, then your bootloader. The first time, most people assume something went wrong.

On these machines the manufacturer locked the firmware to code it signed itself. The lock is not a setting or a password. It is fused into the processor, so it survives a wipe, a new disk and a flat battery. Left alone, your computer accepts only firmware somebody else approved. Libreboot undoes that with deguard, a tool that removes the lock. We do it before the machine ships, and afterwards you can build and flash your own firmware without asking anyone. That is the difference between owning a computer and holding one.

On most computers the part that starts the machine cannot be locked. The bootloader and kernel sit on an unencrypted partition, because factory firmware cannot read anything else, so /boot is left open to anyone with a screwdriver. Libreboot carries GRUB — a boot menu that can open an encrypted disk — inside the firmware itself. So the whole disk is encrypted, /boot included, and the passphrase prompt comes from a chip on the board. LUKS2 and LUKS1 both work.