APT Repository for Linux-libre

I've been maintaining this APT repository for the kernel called Linux-libre since September 2011, graciously hosted by the Free Software Foundation Latin America.

Linux as distributed by kernel.org contains proprietary software, and it induces you to install additional proprietary software that it doesn't contain.

Linux-libre is a modified version of Linux with all of the binary blobs, obfuscated code and portions of code under proprietary licenses removed.

The resulting combination of the GNU Operating System and the kernel named Linux is the GNU/Linux operating system, although many (incorrectly) refer to it as "Linux."

This repository contains .debs of Linux-libre compiled for general purpose use on 64-bit ARM, 32-bit ARMv7 with hardware FPU, 32- and 64-bit x86 and IBM POWER CPUs (requires POWER8 or above). It should work with most any GNU/Linux distribution that uses APT. It's known to be compatible with Trisquel, gNewSense, Debian, Ubuntu, Devuan and their respective derivatives. Please contact me if you need support for additional CPU architectures or other GNU/Linux distributions.

If you need a realtime kernel see the libeRTy APT repository at https://www.fsfla.org/ikiwiki/selibre/linux-libre/liberty.en.html.

I hope that this repository will make software freedom easier for more people, either by allowing you to replace the kernel in your existing GNU/Linux distribution with one that is entirely freedom-respecting, or for people already using fully-free GNU/Linux distributions to more easily get a newer kernel version if you need it for some reason.

To use this repository first check for a compatible architecture:

dpkg --print-architecture

You should see one of the following:


Only if you see i386, determine if your i386 CPU supports PAE (which is good to know for the chart below) run this command. If your architecture is not listed as i386 then skip this step:

grep --color=always -i PAE /proc/cpuinfo

If pae is highlighted in the output then your system supports PAE. Otherwise it does not.

If you have a compatible architecture add this repository to your system. Run this command:

sudo apt edit-sources

Add the line:

deb mirror://linux-libre.fsfla.org/pub/linux-libre/freesh/mirrors.txt freesh main

Your package manager will select an appropriate mirror. You can also access the mirrors.txt file and instead put the the address of a specific mirror in place of mirror:// but please use the automatic method shown above if possible.

Newer versions of APT have disabled FTP access by default, which is used by some of the mirrors. Re-enable it:

apt-config -o Dir::Bin::Methods::ftp=ftp shell

Once your sources.list is updated you should also fetch and install the GPG key with which the repository is signed:

wget -O - https://jxself.org/gpg.asc | sudo apt-key add -

Confirm that it's the right key:

apt-key finger

Make sure that you see the fingerprint:

F611 A908 FFA1 65C6 9958 4ED4 9D0D B31B 545A 3198

While on the topic of keys, the kernels for the amd64 and i386 architectures (see the earlier note about identifying your architecture) support UEFI Secure Boot. If your computer doesn't support this or if you don't want to use it you can skip this section.

If you do want to use use these kernels with UEFI Secure Boot enabled you should fetch and install the key with which the kernels are signed:
wget https://jxself.org/linux-libre-mok.cer

Confirm that it's the right one. The fingerprint is provided as both SHA-1 and SHA-256 because SHA-256 is more secure but the mokutil program and MOK Manager will show the SHA-1 hash. Providing both here allows for easy comparison.

openssl x509 -noout -fingerprint -sha1 -inform der -in linux-libre-mok.cer
openssl x509 -noout -fingerprint -sha256 -inform der -in linux-libre-mok.cer

As long as it matches, enroll the key. Note that enrolling a key is a multistep process. mokutil is used to start the process but the change can only be confirmed at boot time. First:

sudo mokutil --import linux-libre-mok.cer

You will be asked for a temporary password for this enrollment request. Remember this password; MOK Manager will ask you for it later.

Confirm that it's prepared to be enrolled:

sudo mokutil --list-new

Then restart:

sudo reboot

The MOK Manager screen should appear after your UEFI boot screen but before your GNU/Linux distro boots to confirm that the key should be added. Follow the on-screen instructions to finish enrolling the key.

Once completed you can confirm that it was enrolled:

sudo mokutil --list-enrolled

Now you will now be able to update your package manager and install Linux-libre:

sudo apt update

The exact command to run next depends on how you want things to work. Please review all of the information that follows on this page.

Short-term or long-term support?

  • Short-term support (STS) versions provides all of the latest changes and features but are only supported for about 2-3 months so you're upgrading to new a new stable version more often.
  • Long-term support (LTS) versions are suported for at least 2 years but won't necessarily have the latest stuff. If you want to use Linux-libre and prefer a kernel that isn't changing as much, the long-term versions are probably what you want.

Current and upcoming kernel versions to know about:

Version Status Released Supported Until
5.4 Future version, expected in November. Will be a long-term support (LTS) version.
5.3 Latest released version. September 2019 November 2019
4.19 Current long-term support (LTS) version. October 2018 December 2020
4.14 Previous long-term support (LTS) version, but still supported. November 2017 January 2020

Please keep in mind that a new long-term support version is selected once each year. The next one will be 5.4, expected in November.

Please continue reading to find the use case that most closely describes what you want.

Use Case Command
"I always want the latest version of Linux-libre. No matter what." sudo apt install linux-libre
Same as above, but I either have an older computer that doesn't support PAE (see the earlier note about PAE.) sudo apt install linux-libre-nonpae
"I want the latest version of Linux-libre, but when 5.4 comes out as the next major new release I want to wait a bit before upgrading so that any problems can get sorted out. I'll decide when I'm ready to upgrade to 5.4, but I still want to get updates for 5.3 while I'm waiting." sudo apt install linux-libre-5.3
Same as above, but I either have an older computer that doesn't support PAE (see the earlier note about PAE.) sudo apt install linux-libre-5.3-nonpae
"I always want to be using the current long-term support (LTS) version of Linux-libre. No matter what." sudo apt install linux-libre-lts
Same as above, but I either have an older computer that doesn't support PAE (see the earlier note about PAE.) sudo apt install linux-libre-lts-nonpae
"I want to use the current long-term support (LTS) version of Linux-libre but when the next one comes out I don't want to upgrade to it. I want to stay with the current LTS (4.19) until I decide otherwise." sudo apt install linux-libre-4.19
Same as above, but I either have an older computer that doesn't support PAE (see the earlier note about PAE.) sudo apt install linux-libre-4.19-nonpae
"I know that 4.19 is the current long-term support (LTS) version but I want to continue using the previous LTS version (4.14) until I decide otherwise." sudo apt install linux-libre-4.14
Same as above, but I either have an older computer that doesn't support PAE (see the earlier note about PAE.) sudo apt install linux-libre-4.14-nonpae

If you use libreboot make sure to do this. If you do not use libreboot, skip this step.

cd /boot/grub
sudo ln -s grub.cfg libreboot_grub.cfg

Mailing List

I also recommend that you subscribe to the linux-libre-announce mailing list to be aware of important changes. The mailing list is very low volume.

Have questions? Need help? Please visit #linux-libre on irc.freenode.net or contact me.

Linux-libre is free software, licensed under the terms of the GNU General Public License version 2, as published by the Free Software Foundation. You should read the license so that you know your rights to run, study, and modify the software, as well as your obligations should you redistribute the software to others.

To ensure that I'm in full compliance with the license you may download the tarball containing the complete and corresponding source code, kernel configuration files, and the instructions to compile and install the kernel from http://linux-libre.fsfla.org/pub/linux-libre/freesh/.




How To


RSS Feed

About Me

Contact Me

This project enforces the 

If you appreciate any of the things I am doing you can make a donation.

Copyright © 2011 - 2019 Jason Self. See license.shtml for license conditions. Please copy and share.