Libreboot 26.10 ships UEFI payload — your old ThinkPad just got younger

What happened

Libreboot 26.10, codename *Ominous Olive*, dropped on October 15 and it's the biggest release the project has shipped in a year. The headline change: a working UEFI payload built from tianocore's EDK II, which runs on top of the coreboot core that Libreboot has always been. Until this release, if you flashed Libreboot you got GRUB or SeaBIOS and had to BIOS-mode your way through any modern OS installer. Now you can boot a UEFI-native Windows 11 ISO on a deblobbed ThinkPad X230 and it just works.

The second headline is Chromebook and Chromebox support — a non-trivial chunk of Intel Haswell and Broadwell Google hardware is now a first-class Libreboot target, including the Asus Chromebox CN60 and several Dell/HP/Lenovo Chromebooks with the usual write-protect-screw ritual. These were already coreboot-supported upstream, but Libreboot's contribution is the build pipeline, the deblobbing, and the one-command flashing script. You go from a device Google has effectively abandoned at auto-update expiration to a general-purpose x86 laptop with a free firmware stack.

The release also pulls in a newer coreboot tree (4.23-ish), updated SeaBIOS and GRUB payloads, and — quietly, but importantly — a reworked `lbmk` build system that's reproducible from source. The project also claims full UEFI support on the KGPE-D16 and KCMA-D8 server boards, which matters for the small but loud contingent of people running Libreboot on workstation-class AMD Opteron hardware.

Why it matters

Firmware freedom is one of those causes that engineers nod politely at and then ignore, because the practical cost has always been high. You gave up Secure Boot, you gave up modern OS installers that assume UEFI, and you got a slightly older ThinkPad in return. With a working UEFI payload, that trade collapses — you can run a current OS, keep the signed-boot toolchain, and still have no Intel ME blobs living rent-free in ring -3.

That's the clear take, and it's worth saying plainly: the main technical reason to run proprietary firmware on a supported machine just got weaker. Not gone — Intel ME can be neutered but not fully removed on post-Sandy Bridge hardware, and AMD's PSP is in a similar spot — but weaker. For the Haswell/Broadwell Chromebook crowd, the story is even cleaner, because Google's own firmware was already coreboot-based; Libreboot is mostly stripping the vendor bits and giving you a sane payload menu.

The reproducibility work is the under-the-radar win. `lbmk` now produces byte-identical ROM images from the same source tree, which means you can verify that the binary blob you're about to flash onto a chip you can't easily unflash is actually what the maintainers say it is. Supply-chain attacks on firmware are not hypothetical — see the Lenovo UEFI vulnerabilities disclosed by ESET in 2022, the MSI private-key leak in 2023, and the ongoing LogoFAIL class of bugs — and the fact that a hobbyist project has reproducible builds while most OEMs still ship signed-but-unauditable blobs is, bluntly, embarrassing for the industry.

The comments on the HN thread (264 points, which is a strong signal for a firmware release) split predictably. Half the thread is nostalgia for the X200/T400 era, half is people asking whether their specific ThinkPad is supported, and a thin but informed minority is pointing out the real limitation: the newest officially supported Intel platform is still Haswell/Broadwell, roughly a decade old. If you want deblobbed firmware on a laptop built this decade, Libreboot still can't help you — the ME removal path closes shut after Broadwell, and nobody has reverse-engineered a workable replacement for the post-2015 Intel platforms.

What this means for your stack

If you maintain a fleet of refurbished laptops for a journalism org, a legal nonprofit, or any threat model where firmware-level persistence is a real concern, this release changes the calculus. Haswell-era ThinkPads (T440p, X240, W541) are plentiful on the used market for under $200, and with UEFI payload support you can now image them with a modern Windows or Linux installer without the usual coreboot workarounds. That's a defensible endpoint posture at commodity prices.

For developers running a homelab, the KGPE-D16 / KCMA-D8 UEFI support means your deblobbed Opteron server can now boot modern distros that have quietly dropped BIOS-mode installers (looking at you, recent Fedora Server). The server-grade Libreboot story was starting to feel like legacy maintenance; this release gives it another couple of years of runway.

The Chromebook angle is the most interesting one for actual software people: a $40 end-of-life Chromebox is now a legitimate Libreboot-flashable thin client, which is a cheaper and better-audited base for a hardened kiosk, a BitBox-style air-gapped signer, or a dedicated Yubikey provisioning station than almost anything you can buy new. Buy five, flash four, keep one as a reference build.

Looking ahead

The hard problem Libreboot hasn't solved — and realistically can't, without upstream coreboot catching up — is modern hardware. Until someone cracks the post-Broadwell Intel ME or AMD figures out a PSP-off story, this project will remain a renaissance of a specific hardware generation rather than an answer for new machines. But 26.10 is the strongest argument in a long time that the renaissance is real: UEFI parity closes the biggest usability gap, reproducible builds close the biggest trust gap, and Chromebook support quietly expands the installed base by an order of magnitude. If you've been waiting for a reason to try this stack, the reasons just got shorter.