barebox bootloader

RE: @brauner@mastodon.social

It's critical for the kernel to lay the groundwork, so the ecosystem can standardize on a common interface.

At the bootloader side, we are also doing our part by mapping government-mandated age brackets to barebox security policies.

The initial support already leverages it to restrict various child endangering functionality like crypto accelerators and we are looking forward to more IS_OF_AGE() checks across the code base and tighter integration with Linux.

https://lore.barebox.org/barebox/20260401151227.2097733-2-a.fatoum@barebox.org

v2026.04.0 is out and will be relevant for quite a while: In alignment with the Yocto Wrynose LTS release, we will support it for at least a year.

Besides mostly bug fixes, one big feature made it in:
Earlier this year at @fosdem@fosstodon.org's #kernel devroom, @a3f@fosstodon.org presented a new workflow for easily replacing any boot image with a network-hosted substitute to simplify kerneldev: https://fosdem.org/2026/schedule/event/7XHGHX-netboot_without_throwing_a_fit/

As of v2026.04.0, this is now upstream: https://www.barebox.org/doc/latest/user/devboot.html

Release notes: https://github.com/barebox/barebox/releases/tag/v2026.04.0

barebox v2026.03.0 and .1 were released last month fixing a critical FIT signature verification vulnerability: https://github.com/barebox/barebox/security/advisories/GHSA-3fvj-q26p-j6h4

All users employing signed FIT should upgrade to either v2026.03.1, v2025.09.3 or newer.

But we hope this doesn't overshadow the nice features this release brings:

🪨 Rockchip RK3562 support
🔒 Much improved i.MX8M OP-TEE integration
🚀 General support for Android Fastboot *boot* (as opposed to flashing)
📐 UAPI spec compilant bootloader spec sorting

barebox v2026.02.0 has been out for a few weeks!

Highlights are:

🪨 RK3588 secure boot is now ready. QNAP TS-433 4-bay NAS joins the collection of supported RK3568 boards with EFI USB installer support.

🧩 External module support was de-bitrotted and hopefully stays that way, now that it is tested in CI.

🔍 Especially EFI has seen a major hardening pass with 50+ fixes for memory leaks, NULL derefs and OOB, many found via fuzzing.

Release notes: https://github.com/barebox/barebox/releases/tag/v2026.02.0

2026's first barebox release is out! 🎉

With 280 commits since v2025.12.0, it's one of our bigger releases and much more than what we can cover in 500 characters, but here's two highlights:

- barebox can now act as EFI firmware and load EFI applications. Most testing has been done against GRUB and Debian, but expect the feature to stabilize more over the coming months!

- Support added for four Amazon Kindle 6th and 7th generation e-book readers

Release notes are here: https://lore.barebox.org/barebox/aW42tXvmSurUGNg-@pengutronix.de/

🗓️🚀 v2025.11.0 is out and the barebox EFI payload for ARM is now ready for prime time:
Retrofit existing EFI firmware to support bootloader spec, FIT, watchdog-supervised redundant boot and all your usual barebox features.

This builds on existing x86 EFI support, but x86 also benefits in return: The new boot method provides a long needed alternative to GRUB's deprecated handover boot.

Board-support-wise, we welcome i.MX93 FRDM and Enclustra Mercury+ SA2.

➡️ Release mail: https://lore.barebox.org/barebox/aRRDnV7rhE1VUgez@pengutronix.de/

16 years (minus 2 days) after the first #barebox release (v2009.12.0), we're happy to announce barebox v2025.12.0!

On top of a healthy amount of cleanup and bug fixes, 2 new features stand out:

📺 On Rockchip #RK3566 / #RK3568, MIPI-#DSI displays are now supported (pictured here running #bareDOOM).

🏭 For the barebox TLV factory data format, signatures can now be generated & verified. (See the upcoming FOSDEM talk: https://fosdem.org/2026/schedule/event/97DP7F-tamper-resistant_factory_data_from_the_bootloader/ for more info).

Release notes: https://github.com/barebox/barebox/releases/tag/v2025.12.0

@fun@witches.live EFI-wise:

< v2026.01.0: EFI support was restricted to consuming services by e.g. Tianocore or U-Boot's EFI loader

≥ v2026.01.0: barebox can provide EFI as well

A funny implementation aspect is that it's now possible to enable all of BOARD_GENERIC_DT, EFI_LOADER and EFI_PAYLOAD at once, so a single barebox image can be:

• booted like a kernel by executing its first instruction
• provide EFI services
• loaded as EFI app via its PE header

With the last step being repeatable till OOM :)