# System76 Open Firmware ## Identification Prebuilt VM images reduce installation time but introduce provenance and integrity risk. [[Parrot OS|Parrot OS]] is designed for security/privacy work; [[System76 Open Firmware|System76 Open Firmware]] uses Coreboot with EDK2 and firmware applications on supported systems ([System76 Open Firmware](https://system76.com/support/articles/open-firmware-systems)). [[Pop!_OS|Pop!_OS]] supplies the host OS side of that vendor stack. ## Notebook evidence - [[Scanned_20260730-1719#PDF page 31 — Live security distributions, System76 firmware, and Linux VM images|PDF page 31: Live security distributions, System76 firmware, and Linux VM images]] — This is a practical sourcing list: which systems can be booted live, downloaded as VMs, or obtained with open firmware. “Not allowed” may be a hardware policy, blocked download, failed boot, or licensing observation. - [[Scanned_20260730-1719#PDF page 75 — Coreboot/Libreboot summary and supported operating systems|PDF page 75: Coreboot/Libreboot summary and supported operating systems]] — This is the notebook’s capstone. Everything previously collected—serial access, IOMMU, USB, SPI, iPXE, alternate OSes, encryption, Tor/Tails, open drivers, and vendor-independent recovery—is gathered beneath open firmware. “The Federation” is the proposed architecture: a common pre-OS substrate that can host multiple independently governed operating environments. ## Relationships and overlays The source places this note in a shared evidence cluster with [[Libreboot|Libreboot]] · [[Parrot OS|Parrot OS]] · [[Pop!_OS|Pop!_OS]] · [[Scanned_20260730-1706|Scanned_20260730-1706]]. Within the larger collection, this evidence extends [[Vendor-Agnostic Recovery|vendor-agnostic recovery]] and [[Continuity Architecture|continuity architecture]] by showing how software, hardware, identity, and pre-OS control depend on recoverable interfaces. ## Evidentiary status and open leads Verify image hashes and publishers. Resolve “Rabbit,” which may be a board, payload, codename, or misreading. ## Source - [[Scanned_20260730-1719|Scanned_20260730-1719]]