@@ 0,0 1,911 @@
+% Canoeboot v0.1 released!
+% Leah Rowe in Canoe Leah Mode™
+% 27 January 2024
+
+This is a special release. It is *not* based on the recent
+[Libreboot 20240126 release](https://libreboot.org/news/libreboot20240126.md).
+No, it is very special indeed.
+
+I have recently sent GNU Boot some patches for their 0.1 RC3 release, fixing
+it so that it compiles on modern distros. Their release only compiled on really
+old distros like Debian 10 or Trisquel 10. I made it compile on the latest
+Gentoo, Arch and Debian(Sid) as of 14 January 2024. I also added Dell Latitude
+E6400, gru\_bob and gru\_kevin chromebooks. I also added several initialisation
+fixes for keyboards in their GRUB payload, in addition to EFI System Partition
+support in their `grub.cfg` - in other words, I've backported several fixes
+and improvements from Canoeboot and Libreboot, to their project.
+
+I did this, purely for fun, to see if it was technically feasible. And it was.
+I sent these patches and they are now under review by the GNU people.
+
+As you may know from reading this Canoeboot website, Canoeboot is vastly more
+up to date than GNU Boot, using revisions 2 years newer (from 2023), whereas
+GNU Boot uses old 2021 coreboot, GRUB and SeaBIOS revisions. It does not contain
+improvements such as GRUB argon2 support.
+
+Well, purely for fun, I made this special Canoeboot v0.1 release, which re-uses
+the same *old* 2021 revisions as GNU Boot 0.1 RC3, but with my special fixes
+as mentioned above (so, it has E6400/gru\_bob/gru\_kevin, and builds on modern
+distros). However, that release is compiled using Canoeboot's build system,
+which is vastly more efficient than the GNU Boot one (about twice as fast, and
+less error prone, due to optimisations made during the four Libreboot build
+system audits of 2023).
+
+You can find the Canoeboot v0.1 release on the mirrors, alongside regular
+releases. It should boot and work perfectly, albeit it on those very old code
+revisions. It is advised that you still use the November 2023 Canoeboot
+release, for the time being. A proper Canoeboot update, based on
+Libreboot 20240126 (which uses Coreboot revisions from January 2024) will be
+done at a date in the near future.
+
+Anyway, the fixes that I did were sent to the GNU Boot mailing list. Check
+the `gnuboot-patches` mailing list archive from 16 January 2024.
+
+GNU Boot 0.1 RC3 fixes:
+<https://git.disroot.org/vimuser/gnuboot/commits/branch/0.1-fix-build-v3>
+
+Canoeboot v0.1 branch:
+<https://codeberg.org/canoeboot/cbmk/commits/branch/v0.1>
+
+I also did another GNU Boot branch for fun, that updates it to the
+October 2023 revisions used in Libreboot/Canoeboot releases from November 2023:
+<https://git.disroot.org/vimuser/gnuboot/commits/branch/0.1-fix-build-v3> \
+...these patches were also sent, but it seems they still prefer to use my
+Libreboot 20220710 release.
+
+The GNU Boot 0.1 RC3 release is essentially Libreboot 20220710, with a few
+minor changes, and Canoeboot v0.1 is essentially Libreboot 20220710 aswell,
+but with *substantial* build system design changes (but the overall code
+is identical, when analysing the binaries).
+
+PS: I use a new GPG signing key on Libreboot releases now. Check the Libreboot
+download page for it. At the time of writing, the new key is not listed on
+the Canoeboot page but I used that key.
+
+Introduction
+============
+
+*This* new release, Canoeboot 20231026, released today 26 October 2023, is
+based on the [Libreboot 20231021](https://libreboot.org/news/libreboot20231021.html)
+release, porting changes in it on top of
+[nonGeNUine Boot 20230717](nongenuineboot20230717.md) as a base. The previous
+release was nonGeNUine Boot 20230717, released on 17 July 2023; the project
+named *nonGeNUine Boot* has been renamed to Canoeboot, in this release, which
+is the first ever release under the name *Canoeboot*.
+
+Canoeboot provides boot firmware for supported x86/ARM machines, starting a
+bootloader that then loads your operating system. It replaces proprietary
+BIOS/UEFI firmware on x86 machines, and provides an *improved* configuration
+on [ARM-based chromebooks](../docs/install/chromebooks.html) supported
+(U-Boot bootloader, instead of Google's depthcharge bootloader). On x86
+machines, the GRUB and SeaBIOS coreboot
+payloads are officially supported, provided in varying configurations per
+machine. It provides an [automated build system](../docs/maintain/) for the
+[configuration](../docs/build/) and [installation](../docs/install/) of coreboot
+ROM images, making coreboot easier to use for non-technical people. You can find
+the [list of supported hardware](../docs/hardware/) in Canoeboot documentation.
+
+Canoeboot's main benefit is *higher boot speed*,
+[better](../docs/gnulinux/encryption.md)
+[security](../docs/gnulinux/grub_hardening.md) and more
+customisation options compared to most proprietary firmware. As a
+[libre](https://writefreesoftware.org/learn) software project, the code can be
+audited, and coreboot does
+regularly audit code. The other main benefit is [*freedom* to study, adapt and
+share the code](https://writefreesoftware.org/), a freedom denied by most boot
+firmware, but not Canoeboot! Booting Linux/BSD is also [well](../docs/gnulinux/)
+[supported](../docs/bsd/).
+
+Canoeboot is maintained in parallel with Libreboot, and by the same developer,
+Leah Rowe, who maintains both projects; Canoeboot implements the [GNU Free
+System Distribution Guideline](https://www.gnu.org/distros/free-system-distribution-guidelines.en.html)
+as policy, whereas Libreboot implements its own [Binary Blob Reduction
+Policy](https://libreboot.org/news/policy.html).
+
+Work done since last release
+============================
+
+No new mainboards have been added in Canoeboot 20231026, versus nonGeNUine
+Boot 20230717, but a slew of build system enhancements and new features have
+been ported from Libreboot.
+
+However, the *following* mainboards added in Libreboot 20231021 have *been
+excluded* in this Canoeboot release, due to the GNU FSDG policy: HP
+EliteBook 2170p, HP EliteBook 8470p, Dell Precision T1650 and Dell
+Latitude E6430.
+
+GRUB LUKS2 now supported (with argon2 key derivation)
+---------------------------------------------------
+
+*This* new Canoeboot release imports the [PHC argon2
+implementation](https://github.com/P-H-C/phc-winner-argon2) into GRUB,
+courtesy of [Axel](https://axelen.xyz/) who initially ported the code to run
+under GRUB *2.06*, but this Canoeboot release uses GRUB *2.12* (an RC revision
+from git, at present).
+
+Axel's code was published to [this AUR repository](https://aur.archlinux.org/cgit/aur.git/tree/?h=grub-improved-luks2-git&id=1c7932d90f1f62d0fd5485c5eb8ad79fa4c2f50d)
+which [Nicholas Johnson](https://nicholasjohnson.ch/) then rebased on top of
+GRUB *2.12*, and I then imported the work into Libreboot, with Johnson's
+blessing; Canoeboot has inherited this work in full.
+
+These libreboot patches added argon2 support, and have been ported to Canoeboot
+in this 20231026 release:
+
+* <https://browse.libreboot.org/lbmk.git/commit/?id=2c0c521e2f15776fd604f8da3bc924dec95e1fd1>
+* <https://browse.libreboot.org/lbmk.git/commit/?id=fd6025321c4ae35e69a75b45d21bfbfb4eb2b3a0>
+* <https://browse.libreboot.org/lbmk.git/commit/?id=438bf2c9b113eab11439c9c65449e269e5b4b095>
+
+This means that you can now boot from encrypted `/boot` partitions. I'm very
+grateful to everyone who made this possible!
+
+Simplified commands (build system)
+-------------------------
+
+Simply put, cbmk (the Canoeboot build system) is now *easier to use* than
+gbmk (the nonGeNUine Boot 20230717 build system) was; there
+are only *9* shell scripts in this release, versus 50 or so in the
+nonGeNU 20230717 release, and the command structure has been simplified.
+
+You can find information about *using* the build system in
+the [Canoeboot build instructions](../docs/build/) and in the [cbmk
+maintenance manual](../docs/maintain/).
+
+The Libreboot 20231021 release has *12* scripts, bacause there are 3 more
+scripts there for handling the downloading of vendor code; since Canoeboot
+intentionally avoids doing that, those scripts are not needed in Canoeboot
+and have therefore been excluded. They are: `script/vendor/download`,
+`script/vendor/inject` and `include/mrc.sh`.
+
+TWO massive audits. 50% code size reduction in lbmk.
+--------------------------------------------
+
+Libreboot's build system, lbmk, is written entirely in shell scripts. It is
+an automatic build system that downloads, patches, configures and compiles
+source trees such as coreboot and various payloads, to build complete ROM
+images that are easier to install. More info about that is available in
+the [lbmk maintenance manual](https://libreboot.org/docs/maintain/) - and you
+can read the [cbmk maintenance manual](../docs/maintain/) for comparison.
+
+The primary focus of Libreboot 20231021 cultiminated in two *audits*, namely
+[Libreboot Build System Audit 2](https://libreboot.org/news/audit2.html) and
+then [Libreboot Build System Audit 3](https://libreboot.org/news/audit3.html).
+
+The changes in those audits have been ported to this *Canoeboot* release.
+
+Changes include things like vastly reduced code complexity (while not
+sacrificing functionality), greater speed (at compiling, and boot speeds are
+higher when you use the GRUB payload), many bug fixes and more.
+
+Serprog firmware building (RP2040 and STM32)
+-----------------------------------
+
+In addition to coreboot firmware, the Canoeboot build system (lbmk) can now
+build *serprog* firmware, specifically `pico-serprog` and `stm32-vserprog`, on
+all devices that these projects support.
+
+The *serprog* protocol is supported by flashrom, to provide SPI flashing. It
+can be used to set up an external SPI flasher, for [flashing Canoeboot
+externally](../docs/install/spi.md). This too has been ported from Libreboot.
+
+Pre-compiled firmware images are available, for many of these devices, under
+the `roms/` directory in this Canoeboot 20231026 release! Riku Viitanen is the
+one who added this capability to Libreboot, which was then ported to Canoeboot.
+
+Updated U-Boot revision (2023.10)
+----------------------------
+
+Alper Nebi Yasak submitted patches that update the U-Boot revision in
+Libreboot, on `gru_bob` and `gru_kevin` chromebooks. Additionally, the `cros`
+coreboot tree has merged there with the `default` tree instead (and the `default`
+tree has been updated to coreboot from 12 October 2023).
+
+Many improvements were made to these boards, which you can learn about by
+reading these diffs:
+
+* <https://browse.libreboot.org/lbmk.git/commit/?id=eb267733fabe6c773720706539ef37f1ce591f81>
+* <https://browse.libreboot.org/lbmk.git/commit/?id=8b411963b7e4941cbd96ac874d0582eaa20ea998>
+* <https://browse.libreboot.org/lbmk.git/commit/?id=b2d84213dae4e199b4e4fa4f70dd6e3fbf5d90c4>
+* <https://browse.libreboot.org/lbmk.git/commit/?id=f459e05ecd40592d80d119d16449d40f0dfbfa78>
+* <https://browse.libreboot.org/lbmk.git/commit/?id=5b4ced3329f5fd8cb1fa166c8ac424e0bb618d67>
+* <https://browse.libreboot.org/lbmk.git/commit/?id=46e01c0e1dade74f5ce777bf8593fe2722318af2>
+* <https://browse.libreboot.org/lbmk.git/commit/?id=7afe2f39189fa196547c3dd9f9f617cfab91d835>
+* <https://browse.libreboot.org/lbmk.git/commit/?id=f7db91c848f1fbf6bea93b62dfa4313ff550eeec>
+* <https://browse.libreboot.org/lbmk.git/commit/?id=f9bad4449aa97aa2eb21f2254c0ad1515119888a>
+* <https://browse.libreboot.org/lbmk.git/commit/?id=fea0cec24a1f2b03cf3c8b928259222f0bcf2357>
+* <https://browse.libreboot.org/lbmk.git/commit/?id=f08102a22731182e8ad2f678ab39b19508fd455a>
+* <https://browse.libreboot.org/lbmk.git/commit/?id=4e7e4761918d2cb04f3bf664c8c0ea8426a0e3bc>
+* <https://browse.libreboot.org/lbmk.git/commit/?id=6e65595da5301b9b8c435a9ab55e6f0d9b01a86d>
+* <https://browse.libreboot.org/lbmk.git/commit/?id=4d9567a7561df6eeb0dd81f2faf522c8526163b0>
+
+All of these patches have been ported to this Canoeboot release.
+
+Coreboot, GRUB, U-Boot and SeaBIOS revisions
+------------------------------------
+
+In Canoeboot 20231026 (*this release*):
+
+* Coreboot (default): commit ID `d862695f5f432b5c78dada5f16c293a4c3f9fce6`, 12 October 2023
+* Coreboot (cros): MERGED WITH `coreboot/default` (see above)
+* Coreboot (fam15h\_udimm): commit ID `1c13f8d85c7306213cd525308ee8973e5663a3f8`, 16 June 2021
+* GRUB: commit ID `e58b870ff926415e23fc386af41ff81b2f588763`, 3 October 2023
+* SeaBIOS: commit ID `1e1da7a963007d03a4e0e9a9e0ff17990bb1608d`, 24 August 2023
+* U-Boot: commit ID `4459ed60cb1e0562bc5b40405e2b4b9bbf766d57`, 2 October 2023
+
+In nonGeNUine Boot 20230717 (*previous release*):
+
+* Coreboot (default): commit ID `e70bc423f9a2e1d13827f2703efe1f9c72549f20`, 17 February 2023
+* Coreboot (cros): commit ID `8da4bfe5b573f395057fbfb5a9d99b376e25c2a4` 2 June 2022
+* Coreboot (fam15h\_udimm): DID NOT EXIST
+* GRUB: commit ID `f7564844f82b57078d601befadc438b5bc1fa01b`, 14 February 2023
+* SeaBIOS: commit ID `ea1b7a0733906b8425d948ae94fba63c32b1d425`, 20 January 2023
+* U-Boot (for coreboot/cros): commit ID `890233ca5569e5787d8407596a12b9fca80952bf`, 9 January 2023
+
+As you can see, all revisions are quite new in this release.
+
+Build system tweaks
+===================
+
+resources/ now config/
+----------------------
+
+The `resources/scripts/` directory is now `script/`, and what was `resources/`
+now only contains configuration data plus code patches for various projects,
+so it has been renamed to `config/` - I considered splitting patches
+into `patch/`, but the current directory structure for patches is not a problem
+so I left it alone.
+
+Also, the IFD/GbE files have been moved here, under `config/ifd/`. These can
+always be ge-generated if the user wants to, using ich9gen, or using a
+combination of bincfg and ifdtool from coreboot, and nvmutil (to change the
+mac address) from Canoeboot or Libreboot.
+
+Full list of changes (detail)
+--------------------
+
+These changes have been ported from the Libreboot 20231021 release, which are
+mostly the results of the two audits (mentioned above):
+
+* Much stricter, more robust error handling; too many changes to list here, so
+ check the git log. Also, errors that *are not errors* are no longer treated as
+ such; nonGeNUine Boot 20230717's build system was actually too strict, sometimes.
+* Most logic has been unified in single scripts that perform once type of task
+ each, instead of multiple scripts performing the same type of talk; for
+ example, defconfig-based projects now handled with the same scripts, and
+ preparing trees for them is done the same. These unifications have been done
+ carefully and incrementally, with great thought so as to prevent *spaghetti*.
+ The code is clean, and small.
+* GitHub is no longer used on main Git repository links, instead only as backup
+* Backup repositories now defined, for all main repos under `config/git/`
+* Single-tree projects are no longer needlessly re-downloaded when they already
+ have been downloaded.
+* GRUB LUKS2 support now available, with argon2 key derivation; previously, only
+ PBKDF2 worked so most LUKS2 setups were unbootable in Canoeboot. This is fixed.
+* Vastly reduced number of modules in GRUB, keeping only what is required.
+* Use `--mtime` and option options in GNU Tar (if it is actually GNU Tar), when
+ creating Tar archives. This results in partially reproducible source archives,
+ and consistent hashes were seen in testing, but not between distros.
+* Always re-inialitise `.git` within lbmk, for the build system itself, if
+ Git history was removed as in releases. This work around some build systems
+ like coreboot that use Git extensively, and are error-prone without it.
+* More robust makefile handling in source trees; if one doesn't exist, error
+ out but also check other makefile name combinations, and only error out if
+ the command was to actually build.
+* ROMs build script: support the "all" argument, even when getopt options are
+ used e.g. `-k`
+* Disabled the pager in `grub.cfg`, because it causes trouble in some
+ non-interactive setups where the user sees an errant message on the screen
+ and has to press enter. This fixes boot interruptions in some cases, allowing
+ normal use of the machine. The pager was initially enabled many years ago,
+ to make use of cat a bit easier in the GRUB shell, but the user can just
+ enable the pager themselves if they really want to.
+* U-Boot can now be compiled standalone, without using the ROMs build script,
+ because crossgcc handling is provided for U-Boot now in addition to coreboot.
+* All helper scripts are now under `include/`, and main scripts in `script/`,
+ called by the main `build` script
+* Generally purge unused variables in shell scripts
+* Simplified initialisation of variables in shell scripts, using the `setvars`
+ function defined under `include/err.sh`
+* Support patch subdirectories, when applying patches. This is done recursively,
+ making it possible to split up patch files into smaller sets inside sub
+ directories, per each source tree (or target of each source tree, where a
+ project is multi-tree within lbmk)
+* SPDX license headers now used, almost universally, in all parts of cbmk.
+* Files such as those under `config/git` are now
+ concatenated, traversing recursively through the target directory; files first,
+ then directories in order, and for each directory, follow the same pattern
+ until all files are concatenated. This same logic is also used for patches.
+ This now enables use of subdirectories, in some config/patch directories.
+* General code cleanup on `util/nvmutil`
+* Git histories are more thoroughly deleted, in third party source trees during
+ release time.
+* Symlinks in release archives are no longer hard copies; the symlinks are
+ re-created by the release script, because it clones the current lbmk work
+ directory via Git (local git clone), rather than just using `cp` to copy links.
+* Properly output to stderr, on printf commands in scripts where it is either
+ a warning prior to calling `err`, or just something that belongs on the error
+ output (instead of standard output).
+* Don't use the `-B` option in make commands.
+* SECURITY: Use sha512sum (not sha1sum) when verifying certain downloads. This
+ reduces the chance for collisions, during checksum verification.
+* Set GRUB timout to 5s by default, but allow override and set to 10s or 15s
+ on some mainboards.
+* Support both curl and wget, where files are downloaded outside of Git; defer
+ to Wget when Curl fails, and try each program three times before failing. This
+ results in more resilient downloading, on wobbly internet connections.
+* Don't clone Git repositories into `/tmp`, because it might be a tmpfs with
+ little memory available; clone into `tmp/gitclone` instead, within lbmk,
+ and `mv` it to avoid unnecessary additional writes (`mv` is much more efficient
+ than `cp`, for this purpose).
+* Removed unused `target.cfg` handling in vendor scripts, because they use
+ the concatenated config format instead (they always have).
+* Coreboot builds: automatically run make-oldconfig, to mitigate use of raw
+ coreboot config where a revision was updated but the config was untouched.
+ This may still result in a confirmation dialog, and it's still recommended
+ that the configs be updated per revision (or switch them to defconfigs).
+* Vastly simplified directory structure; `resources/scripts/` is now `script/`,
+ and `resources/` was renamed to `config/`; ifd and gbe files were also moved
+ to `config/ifd/`. Commands are now 1-argument instead of 2, for example
+ the `./build boot roms` command is now `./build roms`.
+* memtest86plus: only build it on 64-bit hosts, for now (32-bit building is
+ broken on a lot of distros nowadays, and lbmk doesn't properly handle cross
+ compilation except on coreboot or U-Boot)
+* (courtesy of Riku Viitanen) don't use cat on loops that handle lines of text.
+ Instead, use the `read` command that is built into `sh`, reading each line.
+ This is more efficient, and provides more robust handling on lines with
+ spaces in them.
+* *ALL* projects now have submodules downloaded at build time, not just multi
+ tree projects such as coreboot - and a few projects under `config/git` have
+ had certain `depend` items removed, if a given project already defines it
+ under `.gitmodules` (within its repository).
+* Improved cbutils handling; it's now even less likely to needlessly re-build
+ if it was already built.
+* The release build script no longer archives what was already built, but
+ instead builds from scratch, creating an archive from source downloads
+ first before building the ROM archives. This saves time because it enables
+ a single build test per release, whereas at was previously necessary to test
+ the Git repository and then the release archive. Testing both is still desired,
+ but this behaviour also means that whatever is built at release time is
+ guaranteed to be the same as what the user would build (from archives).
+* Improved handling of `target.cfg` files in multi-tree projects coreboot,
+ SeaBIOS and U-Boot. Unified to all such projects, under one script, and
+ with improved error handling.
+* GRUB payload: all ROM images now contain the same ELF, with all keymaps
+ inserted. This speeds up the build process, and enables easier configuration
+ when changing the keyboard layout because less re-flashing is needed.
+* Simplified IFD handling on ICH9M platforms (e.g. X200/T400 thinkpads); the
+ ich9gen utility wasn't needed anymore so ich9utils has been removed, and now
+ the IFD/GbE files are included pre-assembled (generated by ich9gen). Ich9gen
+ can still be used, or you can re-generate with coreboot's bincfg; the ifdtool
+ util can be used to edit IFD and nvmutil (part of Canoeboot) can change MAC
+ addresses. The ich9utils code was always redundant for the last few years,
+ especially since 2022 when nvmutil was first written.
+* Running as root is now forbidden, for most commands; lbmk will exit with
+ non-zero status if you try. The `./build dependencies x` commands still work
+ as root (they're the only commands available as root).
+* Enabled memtest86plus on more boards, where it wasn't previously enabled.
+* Only enable SeaBIOS as first payload on desktops, but still enable GRUB as
+ second payload where GRUB is known to work (on each given host). The text
+ mode and coreboot framebuffer modes are provided in each case, where feasible.
+* The `list` command has been mostly unified, making it easier to tell (from
+ lbmk) what commands are available, without having to manually poke around
+ under `script/`.
+* The `-T0` flag is now used, universally, on xz commands. This makes `xz` run
+ on multiple threads, greatly speeding up the creation of large tar archives.
+* Universally use `-j` in make commands, for multi-threading, but it relies
+ on `nproc` to get thread count, so this only works if you have `nproc` (you
+ probably don't, if you run BSD; BSD porting is still on TODO for Canoeboot)
+* File names as arguments now universally have quotes wrapped around them, and
+ similar auditing has been done to all variables used as arguments everywhere
+ in lbmk. There were cases where multiple arguments were wrongly quoted then
+ treated as a single argument, and vice versa. This is now fixed.
+* Re-wrote `.gitcheck`; now, a global git name/email config is always required.
+ The only behaviour (setting local config, and unsetting) was quite error-prone
+ under fault conditions, where cleanup may not have been provided, or when
+ execution was interrupted, resulting sometimes in accidentally committing
+ to `lbmk.git` as author named `lbmkplaceholder`.
+* The new BSD-like coding style is now used on *all* shell scripts in lbmk. A
+ few scripts still used the old lbmk coding style, as of audit 2.
+* Scripts no longer directly exit with non-zero status, under fault conditions;
+ instead, `x_` or `err` is used to provide such behaviour. This results in all
+ exits from lbmk being consolidated to `err`, under fault conditions. - zero
+ exits are also consolidated, going only through the main script, which has its
+ own exit function called `lbmk_exit` that provides `TMPDIR` cleanup.
+* BSD-style error handling implemented, with an `err` function (and functions
+ that use it) inside `include/err.sh`; there is also `x_` which can be used
+ to run a command and exit automatically with non-zero status, useful because
+ it provides more verbose output than if you just relied on `set -e`, and it
+ still works when a script *does not* use `set -e` - however, it is not used
+ on all functions, because it works by executing `$@` directly, which can break
+ depending on arguments. Therefore, some scripts just default to `|| err` for
+ providing breakage in scripts.
+* Memtest *6.2* now used (instead of *5.x* releases). This is essentially a
+ re-write, and it works on the coreboot framebuffer, whereas previous revisions
+ only worked on text mode setups.
+* NO MAKEFILE. The Makefile in lbmk has been removed. It was never meaningfully
+ used because all it did was run lbmk commands, without implementing any logic
+ itself. A Makefile may be added again in the future, but with a view to
+ installing *just the build system* onto the host system, to then build ROM
+ images under any number of directories. Lbmk's design is strictly no-Makefile,
+ but it uses Makefiles provided by third party source trees when building them.
+* Safer GRUB configuration file handling between GRUB memdisk and coreboot CBFS;
+ it is no longer possible to boot without a GRUB config, because the one in
+ GRUB memdisk is provided as a failsafe, overridden by *inserting* one in CBFS,
+ but there is no config in CBFS by default anymore.
+* The build system *warns* users about `elf/` vs `bin/`, when it comes to
+ flashing coreboot ROM images; it tells them to use `bin/` because those
+ images do contain payloads, whereas the ones under `elf/` do not.
+* VASTLY more efficient build process; all coreboot ROMs without payload are
+ now cached under `elf/`, as are payloads, then they are joined separately by
+ the usual ROMs build script, and these cached ROMs contain many changes in
+ them that were previously handled by `moverom` in the main ROM build script.
+ Under the new design, repetitive steps are avoided; payloads are inserted into
+ a copy of the cached ROMs under `TMPDIR`, *before* being copied for keymaps
+ and small files; this eliminates delays caused by slow compression (LZMA is
+ always used, when inserting payloads). After crossgcc and the payloads are
+ compiled, the ROM with coreboot builds in under a minute, whereas it would
+ have previously taken several minutes on most Canoeboot-supported hardware.
+* VASTLY reduced GRUB payload size; modules that aren't needed have been removed
+ resulting in much smaller GRUB payloads, that also boot faster.
+* ALL defconfig creation, updating and modification are handled by the same
+ script that *also* handles compiling, as mentioned in the bullet-point below.
+* ALL main source trees are now compiled, downloaded, configured and cleaned
+ using the same script. The *download* (Git) logic is a separate file
+ under `include/` and its functions are called by the main build script, which
+ provides a stub for this.
+* Scripts are no longer executed directly, ever, except the main script. All
+ scripts are otherwise executed from `script/`, inheriting the `TMPDIR`
+ variable set (and exported) by lbmk.
+* Generally improved user feedback in scripts, especially the vendor scripts.
+* Coreboot, U-Boot and SeaBIOS are now downloaded, configured and compiled using
+ the exact same script. Although these codebases differ wildly, their build
+ systems use the same design, and they are compatible from a user-interface
+ perspective.
+* Vastly improved `/tmp` handling; a universal `TMPDIR` is set (environmental
+ variable) and exported to all child processes running lbmk scripts. On exit,
+ the main tmp directory is purged, cleaning all tmp directories under it.
+* General simplification of coding style on all shell scripts.
+* Fixed some variable initialisations in the coreboot ROM image build script
+* Don't enable u-boot on QEMU x86 images (due to buggy builds, untested)
+* Fixed coreboot-version file inserted into coreboot trees, when compiled
+ on Canoeboot release archives.
+* Very general auditing has been done, finding and fixing bugs.
+* Reduced the number of scripts significantly. There were about 50 scripts in
+ the nonGeNUine Boot 20230717 build system. There are closer to *20* in today's
+ Canoeboot 20231026 revision.
+* Many scripts that were separate are now unified. For example: the scripts
+ handling defconfigs files on SeaBIOS, u-Boot and coreboot have now been
+ merged into a single script, performing the same work *better* in less code.
+* Ditto many other scripts; repeated logic unified, logic generalised. The
+ logic for *downloading* coreboot and u-boot was unified into one script,
+ basing off of the coreboot one, and then expanding to also cover SeaBIOS.
+ Most building (e.g. handling of Makefiles) is now done in a single script.
+* Far superior error handling; in many scripts, the `-e` option in `sh` was
+ heavily relied upon to catch errors, but now errors are handled much more
+ verbosely. *Many* fault conditions previously did not make lbmk *exit* at all,
+ let alone with non-zero status, and zero status was sometimes being returned
+ under some edge cases that were tested. Error handling is more robust now.
+* `util/ich9utils` (containing `ich9gen`) was *removed*, thus eliminating about
+ 3000 source lines (of C code) from lbmk. The `nvmutil` program, also provided
+ by and originating from the Canoeboot project, can already change GbE MAC
+ addresses. Coreboot's bincfg can generate ich9m descriptors, and ifdtool can
+ manipulate them; so the features provided by ich9utils were superfluous, since
+ they are available in other projects that we ship. We now ship pre-built
+ ifd/gbe configs on these machines, which can be modified or re-assembled
+ manually if you want to. This eliminates a moving part from Canoeboot, and
+ speeds up the build a little bit.
+* ROM images (of coreboot) build *much faster*: no-payload coreboot ROMs are
+ cached on disk, as are payloads, where previously only the latter was cached.
+ These cached images have as much inserted into them as possible, to eliminate
+ redundant steps in the build process. The `elf` directory contains these, and
+ the existing `bin` directory still holds the full ROM images (containing
+ payloads) when compiled.
+* GRUB payload: vastly reduced the size of the payload, by eliminating GRUB
+ modules that were not needed. About 100KB of compressed space saved in flash!
+* GRUB payload: [argon2 key derivation supported](argon2.md) - this means LUKS2
+ decryption is now possible in GRUB. This work was performed by Nicholas
+ Johnson, rebasing from Axel's AUR patch for GRUB 2.06 (Canoeboot currently
+ uses GRUB 2.12).
+* The *new* coding style is now used on many more scripts, including
+ the `build/boot/roms_helper` script - the new style is much cleaner,
+ mandating that logic be top-down, with a `main()` function defined; it's
+ basically inspired by the OpenBSD coding style for C programs, adapted to
+ shell scripts.
+* All GRUB keymaps now included; a single `grub.elf` is now used on all ROM
+ images. The `grub.cfg` goes in GRUB memdisk now, but can be overridden by
+ inserting a `grub.cfg` in CBFS; many behaviours are also controlled this way,
+ for example to change keymaps and other behaviours. This results in *much*
+ faster builds, because a different GRUB payload doesn't have to be added to
+ each new ROM image; such takes time, due to time-expensive LZMA compression.
+ This, plus the optimised set of GRUB modules, also makes GRUB itself load
+ much faster. All of the fat has been trimmed, though still quite a lot more
+ than a Crumb.
+* A lot of scripts have been removed entirely, and their logic not replaced;
+ in many cases, Canoeboot's build system contained logic that had gone unused
+ for many years.
+* More reliable configs now used on desktop mainboards: SeaBIOS-only for start,
+ but GRUB still available where feasible (in the SeaBIOS menu). This makes it
+ more fool proof for a user who might use integrated graphics and then switch
+ to a graphics card; the very same images will work.
+* TMPDIR environmental variable now set, and exported from main parent process
+ when running lbmk; child processes inherit it, and a single tmp dir is used.
+ This is then automatically cleaned, upon exit from lbmk; previously, lbmk did
+ not cleanly handle `/tmp` at all, but now it's pretty reliable.
+
+Hardware supported in this release
+==================================
+
+All of the following are believed to *boot*, but if you have any issues,
+please contact the Canoeboot project. They are:
+
+### Servers (AMD, x86)
+
+- [ASUS KFSN4-DRE motherboard](../docs/hardware/kfsn4-dre.md)
+- [ASUS KGPE-D16 motherboard](../docs/hardware/kgpe-d16.md)
+
+Desktops (AMD, Intel, x86)
+-----------------------
+
+- [Gigabyte GA-G41M-ES2L motherboard](../docs/hardware/ga-g41m-es2l.md)
+- [Acer G43T-AM3](../docs/hardware/acer_g43t-am3.md)
+- [Intel D510MO and D410PT motherboards](../docs/hardware/d510mo.md)
+- [Apple iMac 5,2](../docs/hardware/imac52.md)
+- [ASUS KCMA-D8 motherboard](../docs/hardware/kcma-d8.md)
+
+### Laptops (Intel, x86)
+
+- **[Dell Latitude E6400](../docs/hardware/e6400.md) (easy to flash, no disassembly, similar
+ hardware to X200/T400)**
+- ThinkPad X60 / X60S / X60 Tablet
+- ThinkPad T60 (with Intel GPU)
+- [Lenovo ThinkPad X200 / X200S / X200 Tablet](../docs/hardware/x200.md)
+- Lenovo ThinkPad X301
+- [Lenovo ThinkPad R400](../docs/hardware/r400.md)
+- [Lenovo ThinkPad T400 / T400S](../docs/hardware/t400.md)
+- [Lenovo ThinkPad T500](../docs/hardware/t500.md)
+- [Lenovo ThinkPad W500](../docs/hardware/t500.md)
+- [Lenovo ThinkPad R500](../docs/hardware/r500.md)
+- [Apple MacBook1,1 and MacBook2,1](../docs/hardware/macbook21.md)
+
+### Laptops (ARM, with U-Boot payload)
+
+- [ASUS Chromebook Flip C101 (gru-bob)](../docs/install/chromebooks.md)
+- [Samsung Chromebook Plus (v1) (gru-kevin)](../docs/install/chromebooks.md)
+
+Downloads
+=========
+
+You can find this release on the downloads page. At the time of this
+announcement, some of the rsync mirrors may not have it yet, so please check
+another one if your favourite one doesn't have it.
+
+Special changes
+===============
+
+Besides deblobbing, there are two critical differences in how Canoeboot's
+build system works in this release, versus the Libreboot 20231021 build system:
+
+* Single-tree git submodules are not downloaded in Canoeboot; none of them are
+ used in the Libreboot release, but using them simplified `config/git/` because
+ many of those entries were defined as submodules by each given project; in
+ some serprog-related repositories, proprietary drivers get downloaded that are
+ never actually compiled or executed in any way. Rather than deblob these in
+ Canoeboot, the Canoeboot build system simply skips downloading those
+ repositories altogether.
+* Thus, several entries in under `config/git/` for Canoeboot 20231026, that do
+ not exist under Libreboot 20231021.
+
+This quirk is only a minor difference. Severals scripts that handled
+dependencies for building non-FSDG-compliant boards (such as blob download
+scripts) have been *excluded* in this Canoeboot release, because they are
+not needed.
+
+As a result, the Canoeboot build system is about 1250 sloc when counting shell
+scripts of the build system; the Libreboot build system is about 1750. This
+comparison is between Canoeboot 20231026 and Libreboot 20231021 - by contrast,
+Libreboot 20230625 was 3388 sloc, and GNU Boot 0.1 RC is 2111 sloc (counting
+shell scripts, because it uses the same design as lbmk and cbmk).
+
+That ~1250 sloc in Canoeboot is *with* all the extra features such as serprog
+integration and U-Boot support (on actual mainboards, that you can flash it
+with). The build system in Canoeboot 20231026 is *[extremely
+efficient](../docs/maintain/)*.
+
+Backports
+=========
+
+In addition to the Libreboot 20231021 changes, the following Libreboot patches
+were backported into this Canoeboot release, from Libreboot revisions pushed
+after the Libreboot 20231021 release came out:
+
+* <https://browse.libreboot.org/lbmk.git/commit/?id=3b92ac97b6ed2216b5f0a17ff9c015f0d8936514>
+* <https://browse.libreboot.org/lbmk.git/commit/?id=280bccebb5dfbbb7fd3eceab85165bac73523f7c>
+* <https://browse.libreboot.org/lbmk.git/commit/?id=444f2899e69e9b84fd5428625aa04b00c1341804>
+* <https://browse.libreboot.org/lbmk.git/commit/?id=03c830b2e9dd8f0847045700349c69ab40458ad8>
+* <https://browse.libreboot.org/lbmk.git/commit/?id=b353b0c7134d155feb53b3ab17fdf6ad959ba668>
+* <https://browse.libreboot.org/lbmk.git/commit/?id=f1785c3f43734108443fed9c6b91ffcb835ae097>
+* <https://browse.libreboot.org/lbmk.git/commit/?id=85bc915684cbeb562d8c6fbf81f9e35064ac04f1>
+* <https://browse.libreboot.org/lbmk.git/commit/?id=df031d422a1c0b76edbea1cdee98796ad3d1392f>
+* <https://browse.libreboot.org/lbmk.git/commit/?id=5f6ba01d414e2d98d7db049347b8c5c5d125ba61>
+
+Changes NOT included in this release
+====================================
+
+These entries are from the Libreboot 20231021 change log, but these changes
+are *not* present in the Canoeboot 20231026 release:
+
+* Better integrity checking when downloading vendor files
+* Scrubbing of vendor files *now* handled by the inject script, rather than
+ the release script. This enables more robust handling of configs pertaining
+ to vendor files, that tell lbmk where the files are and how to insert them; it
+ therefore follows that this same script should be used to delete them.
+* Unified handling of git/vendor config files, containing URLs, revisions,
+ checksums and so on. This is handled by a single function
+ under `include/option.sh`
+* Intel ME extraction is now provided in one function, instead of two, when
+ downloading vendor files per mainboard, before running it
+ through `me_cleaner`
+* Unified checking of the destination file, when downloading vendor updates.
+ This results in more reliable checking of whether a vendor file has already
+ been downloaded or not, where it is only handled if missing.
+* Vendor scripts: archive extraction is now unified, the same method used for
+ each archive. This enables more robust checking of hashes and so on.
+* More deeply integrated the Intel MRC download script (from coreboot) into
+ Canoeboot's vendor scripts, removing its download logic and re-using that
+ from Canoeboot's scripts instead; now, the MRC script only contains extraction
+ logic, and it is an *include* file, rather than a standalone script.
+* Where no-microcode ROM images are provided, ensure that the ROM hashes still
+ match when running the vendor inject script. This is only useful on the
+ Dell Latitude E6400, which is otherwise FSDG-compatible but (in Canoeboot)
+ comes with or without microcode updates, and with or without the Nvidia VGA
+ ROM (handled by vendor inject/download scripts) for dGPU variants. Verification
+ previously failed, under certain conditions, when inserting that VGA ROM.
+* Vendor scripts: don't use `/tmp` for ROM images when inserting vendor files.
+ In case `/tmp` is a tmpfs and not much RAM is available, it is paramount that
+ the user's file system is used instead, where there is likely greater capacity;
+ it is done under `tmp/` in lbmk (not to be confused with `/tmp`).
+* move `me7_updater_parser.py` to `util/` (not under `script/`)
+* The directory containing vendor files no longer exists in lbmk, because it
+ is instead created when needed; the ifd/gbe files were moved to `config/ifd`
+ so the vendorfile directory became redundant.
+* Don't support removal of microcode (during release time) on untested targets.
+ Set `microcode_required="y"` on most boards, but leave it set to `"n"` on
+ platfroms such as GM45 (ThinkPad X200/T400, Dell E6400, etc); anything FSDG
+ compatible, in other words.
+* Improved Dell Latitude E6400 support; the same image now provides iGPU and
+ dGPU support, since it's SeaBIOS-only anyway, so a VGA ROM is inserted into
+ the same ROM that also enables libgfxinit, enabling the Intel or Nvidia GPU
+ to be used (if the VGA ROM is missing, only the Intel GPU will work)
+* Only remove microcode (where that behaviour is enabled per board) in release
+ ROMs, but not during build time. This results in reduced disk usage during
+ development, but release archives still contain the no-microcode option if
+ you want to use that; manual removal is also still possible, during development.
+* *Copy* `dl_path`, don't move it, when downloading and extracting a vendor
+ file. This reduces the change of it being missing later when lbmk is run again.
+* Improved handling of vendor file hashes; previously, the backup would only
+ be tried if the first one failed to download, but if the first file succeeded
+ and yet had a bad hash, the backup would not be tried. Now the backup is tried
+ when either the first download fails OR it has a bad hash, making downloads
+ of vendor files more resilient to network failure.
+* When extracting ME files from vendors, more types of archives are supported
+ for decompression at build time.
+* Fixed bug where vendor files were always being downloaded from backup URLs
+ at build time.
+* Spoof the user agent string mimicking that of Tor Browser, when downloading
+ vendor files at build time. This circumvents restrictions based on user agent
+ string, when lbmk interacts with certain HTTP servers.
+* Abort (with non-zero exit) if KBC1126 EC firmware fails to download at build
+ time.
+* Haswell (libre MRC) coreboot tree: fixed acpica downloads, which no longer
+ work on the upstream URL. Old acpica binaries now hosted on Canoeboot rsync.
+* Blobutil: generally more reliable now at downloading vendor files, especially
+ under fault conditions; for example, if a download failed before, it'd try
+ a backup link, but now it also tries the backup link if main download succeeds
+ but checksum verification didn't; and SHA512 checksums are now used, for
+ greater security, whereas nonGeNUine Boot 20230717 used sha1sum (now we use
+ sha512sum). A user agent is specified in wegt, matching that used by Tor
+ Browser (which in turn mimics Firefox running on Windows). This is needed
+ for some vendors, which seem to dislike wget's default user agent.
+
+Excluded mainboards
+===================
+
+The following boards are *missing* in Canoeboot 20231026, but are supported in
+the Libreboot 20231021 release; this is because they do not comply with FSDG
+policy:
+
+* Dell Latitude E6430
+* Dell Precision T1650
+* HP EliteBook 2170p
+* HP EliteBook 2560p
+* HP EliteBook 2570p
+* HP EliteBook 8470p
+* HP 8200 SFF
+* HP 8300 USDT
+* HP EliteBook 9470m
+* Lenovo ThinkPad T420
+* Lenovo ThinkPad T420S
+* Lenovo ThinkPad T430
+* Lenovo ThinkPad T440p
+* Lenovo ThinkPad T520
+* Lenovo ThinkPad T530
+* Lenovo ThinkPad W530
+* Lenovo ThinkPad W541
+* Lenovo ThinkPad X220/X220T
+* Lenovo ThinkPad X230/X230T
+
+Removed/modified code, in the build system
+-------------------------------------------
+
+Again, certain features cannot be merged from Libreboot and into Canoeboot,
+because of the restrictions set by Canoeboot policy (adhering to GNU FSDG). Here
+is an overview of the code present in Libreboot 20231021 that is *missing* in
+Canoeboot 20231026:
+
+* **coreboot and u-boot download scripts:** Binary blobs are now removed during
+ download. A list of blobs is programmed into the build system, based on
+ scanning of each tree with the linux-libre `deblob-check` script. (yes, it
+ works on other code bases, besides Linux). **This means that most mainboards
+ no longer compile, in coreboot, and many u-boot targets no longer compile.**
+* **`build/roms`:** These scripts build ROM images. For **zero-blob boards**,
+ in other words boards that do not require binary blobs, *regular* Libreboot
+ inserts **CPU microcode** by default, but copies each ROM to produce a
+ corresponding, parallel zero-blobs version **without** CPU microcode. **This**
+ censored version of Libreboot modifies the script in the following way: since
+ the coreboot and uboot download scripts **remove blobs** anyway, including CPU
+ microcode, the default compiled ROMs exclude microcode. Therefore, *this*
+ version simply removes that logic, because it's not needed.
+* **`blobutil`:** Anything pertaining to the downloading of vendor blobs
+ has been removed. This includes `me_cleaner`, `ME7 Update Parser` and the like.
+ It is not needed, in this version of Libreboot. Directories such
+ as `resources/blobs/` (containing code and config data) has been removed.
+ In regular Libreboot, there are certain required binary blobs that we cannot
+ legally distribute on certain mainboards, so `blobutil` auto-downloads them
+ from the vendor while compiling ROM images, then it processes them (if needed)
+ and inserts them; the scripts that produce release archives will *delete*
+ these blobs, for the release, and those same scripts can be re-run on release
+ ROMs, to re-insert binary blobs. It is *completely automated*, removing any
+ need for manual intervention by the user, thus saving hours of time in some
+ cases. Blobutil snaps them up like *that* and everything *Just Works*.
+ It does this for *many* different types of blobs, including: Intel ME, Intel
+ MRC, HP KBC1126 EC firmware, VGA ROMs - you just run 1 command on 1 ROM (or
+ an entire collection of ROMs) and it does it, automatically detecting what
+ is needed for the given ROM image, per mainboard definition. Very easy to use.
+ This *highly innovative* technology does not exist in Censored Libreboot.
+* Blobs: Removed Intel Flash Descriptors and GbE configuration files. These are
+ non-copyrightable, non-software blobs, just binary-encoded config. They are
+ not needed, in this Libreboot version. NOTE: ICH9M ones remain, because they
+ are needed (but they are not software).
+* Blobs: Anything downloaded and inserted by `blobutil`, during the build
+ process or post-release in the Libreboot build system. This includes:
+ Intel ME firmware, Intel MRC firmware, HP KBC1126 EC firmware and VGA option
+ ROM for Nvidia GPU variant of Dell Latitude E6400.
+* `lbmk`: Code that executes blob-related scripts has been removed.
+* Patches: Any custom coreboot patches, for mainboards that require binary
+ blobs, have been removed. They are not needed in this Libreboot version.
+* `update/release`: correspondingly deleted files
+ are no longer copied by these scripts (they are the scripts that generate
+ tar archives for Libreboot releases, after everything is compiled). The build
+ logic no longer bothers to scrub non-redistributable inserted binary blobs
+ from certain ROM images, because 1) those corresponding mainboards are no
+ longer supported anyway and 2) the logic for downloading/inserting those
+ blobs no longer exists. So there's nothing to do.
+
+It's not actually a lot of code that was removed. The actual diff that did this
+is very large, because it also removed the coreboot configs for the removed
+boards, and those configs are very large.
+
+Libreboot is superior to Canoeboot, in every way. You should use Libreboot.
+Use of Canoeboot is even *dangerous*, because lack of microcode updates in
+Canoeboot could potentially lead to data loss due to memory corruption.
+
+Read more about the [Binary Blob Reduction
+Policy](https://libreboot.org/news/policy.html) of the Libreboot project. The
+Canoeboot project is provided as a proof of concept, to demonstrate just how
+awful Libreboot used to be, before it implement the new policy in November 2022.
+
+Canoeboot is a worthless project, but engineered to a high standard. It's
+necessary to do this, because there are some people who won't adequately see
+the problem unless it actually exists; Canoeboot is not a problem, because it's
+not the only choice, but there was a time when osboot didn't even exist, let
+alone the new Libreboot, and the other more pragmatic coreboot distros do not
+support as much hardware as Libreboot does today.
+
+You should use Libreboot, even if your hardware is compatible with Canoeboot.
+I make these Canoeboot releases, specifically so that I have something to crap
+all over. I could criticise GNU Boot more heavily, but GNU Boot is even more
+inferior; I make Canoeboot as good as it can feasibly be at any point in time,
+and criticise *that* result. My arguments are stronger when an *example* exists,
+especially a strong example such as Canoeboot. If the best possible solution is
+still inferior, then that will further invalidate the even lesser solutions,
+and that is the entire purpose of Canoeboot; I do Canoeboot releases, specifically
+so that I can crap all over them. I'm allowed to do that if it's mine.
+
+I say again. Canoeboot is inferior.
+
+[Download Libreboot 20231021 instead](https://libreboot.org/news/libreboot20231021.html).
+
+Censored Libreboot 20230710 release
+===================================
+
+On this day, the websites of Censored Libreboot and nonGeNUine Boot are being
+redirected (HTTP 301 return) to the Canoeboot website.
+
+An archive of nonGeNU 20230717's announcement is contained on this website,
+but not Censored Libreboot 20230717; it was virtually identical to
+nonGeNUine Boot 20230717, the latter of which was just a re-brand of
+Censored Libreboot.
+
+If you do want to see either nonGeNU or C-Libreboot, go to these links:
+
+* <https://browse.libreboot.org/lbmk.git/log/?h=fsdg20230625>
+* <https://codeberg.org/libreboot/lbwww/commits/branch/c20230710>
+* <https://libreboot.org/news/censored-libreboot20230710.html>
+
+And for nonGeNUine Boot, though the code (website and code) is included in
+the Canoeboot repositories, here are the original repositories:
+
+* <https://codeberg.org/vimuser/gbmk>
+* <https://codeberg.org/vimuser/gbwww>
+* <https://codeberg.org/vimuser/gbwww-img>
+
+You can find the actual software release archives for nonGeNUine Boot 20230717
+and Censored Libreboot 20230710 under Libreboot rsync mirrors,
+in the `canoeboot` directory. They have been moved there, from where they
+were previously hosted.
+
+Post-release errata
+===================
+
+The following binary blobs were overlooked, and are still present in the
+release archive for Canoeboot 20231101 and 20231026; this mistake was
+corrected, in the [Canoeboot 20231103 release](canoeboot20231103.md), so you
+should use that if you don't want these files. They are, thus:
+
+* `src/coreboot/default/3rdparty/stm/Test/FrmPkg/Core/Init/Dmar.h`
+* `src/coreboot/fam15h_rdimm/src/vendorcode/intel/fsp1_0/baytrail/absf/minnowmax_1gb.absf`
+* `src/coreboot/fam15h_rdimm/src/vendorcode/intel/fsp1_0/baytrail/absf/minnowmax_2gb.absf`
+* `src/coreboot/fam15h_udimm/src/vendorcode/intel/fsp1_0/baytrail/absf/minnowmax_1gb.absf`
+* `src/coreboot/fam15h_udimm/src/vendorcode/intel/fsp1_0/baytrail/absf/minnowmax_2gb.absf`
+* `src/pico-sdk/lib/tinyusb/hw/mcu/nordic/nrf5x/s140_nrf52_6.1.1_API/include/ble.h`
+* `src/pico-sdk/lib/tinyusb/hw/mcu/nordic/nrf5x/s140_nrf52_6.1.1_API/include/ble_err.h`
+* `src/pico-sdk/lib/tinyusb/hw/mcu/nordic/nrf5x/s140_nrf52_6.1.1_API/include/ble_gap.h`
+* `src/pico-sdk/lib/tinyusb/hw/mcu/nordic/nrf5x/s140_nrf52_6.1.1_API/include/ble_gatt.h`
+* `src/pico-sdk/lib/tinyusb/hw/mcu/nordic/nrf5x/s140_nrf52_6.1.1_API/include/ble_gattc.h`
+* `src/pico-sdk/lib/tinyusb/hw/mcu/nordic/nrf5x/s140_nrf52_6.1.1_API/include/ble_gatts.h`
+* `src/pico-sdk/lib/tinyusb/hw/mcu/nordic/nrf5x/s140_nrf52_6.1.1_API/include/ble_hci.h`
+* `src/pico-sdk/lib/tinyusb/hw/mcu/nordic/nrf5x/s140_nrf52_6.1.1_API/include/ble_l2cap.h`
+* `src/pico-sdk/lib/tinyusb/hw/mcu/nordic/nrf5x/s140_nrf52_6.1.1_API/include/ble_ranges.h`
+* `src/pico-sdk/lib/tinyusb/hw/mcu/nordic/nrf5x/s140_nrf52_6.1.1_API/include/ble_types.h`
+* `src/pico-sdk/lib/tinyusb/hw/mcu/nordic/nrf5x/s140_nrf52_6.1.1_API/include/nrf_error.h`
+* `src/pico-sdk/lib/tinyusb/hw/mcu/nordic/nrf5x/s140_nrf52_6.1.1_API/include/nrf_error_sdm.h`
+* `src/pico-sdk/lib/tinyusb/hw/mcu/nordic/nrf5x/s140_nrf52_6.1.1_API/include/nrf_error_soc.h`
+* `src/pico-sdk/lib/tinyusb/hw/mcu/nordic/nrf5x/s140_nrf52_6.1.1_API/include/nrf_nvic.h`
+* `src/pico-sdk/lib/tinyusb/hw/mcu/nordic/nrf5x/s140_nrf52_6.1.1_API/include/nrf_sdm.h`
+* `src/pico-sdk/lib/tinyusb/hw/mcu/nordic/nrf5x/s140_nrf52_6.1.1_API/include/nrf_soc.h`
+* `src/pico-sdk/lib/tinyusb/hw/mcu/nordic/nrf5x/s140_nrf52_6.1.1_API/include/nrf_svc.h`
+* `src/pico-sdk/lib/tinyusb/hw/mcu/nordic/nrf5x/s140_nrf52_6.1.1_API/include/nrf52/nrf_mbr.h`
+
+Thanks go to Craig Topham, who is the Copyright and Licensing Associate at the
+Free Software Foundation; you can find his entry on the [FSF staff
+page](https://www.fsf.org/about/staff-and-board). Craig is the one who reported
+these.
+
+The Canoeboot 20231026 and 20231101 release tarballs will not be altered, but
+errata has now been added to the announcement pages for those releases, to let
+people know of the above issue.
+
+You are advised, therefore, to use the [Canoeboot 20231103
+release](canoeboot20231103.md).
+
+Update on 12 November 2023:
+---------------------------
+
+This file was also overlooked, and is still present in the release tarball:
+
+* `src/vendorcode/amd/agesa/f12/Proc/GNB/Nb/Family/LN/F12NbSmuFirmware.h`
+
+This has now been removed, in the Canoeboot git repository (`cbmk.git`), and
+this file will absent, in the next release after Canoeboot 20231107. Thanks go
+to Denis Carikli who reported this. The patch to fix it is here:
+
+<https://codeberg.org/canoeboot/cbmk/commit/70d0dbec733c5552f8cd6fb711809935c8f3d2f3>