Insurgo buys it’s refurbished hardware from a trusted third party
The quality of the delivered laptops are guaranteed to be Grade “A”.
The refurbisher’s provided battery is guaranteed to be at least 60% of its original capacity for a period of 14 days.
The refurbisher offers a base warranty of 14 days upon Insurgo‘s shipment confirmed reception by the end user and covers parts.
The refurbisher warranty is on parts and labor.
Hardware return requests will proxy through Insurgo first.
The refurbisher receives second hand hardware.
The refurbisher puts gloves on.
The refurbisher cleans the fan and reapply thermal paste on the CPU and replace broken chassis part and fan if required.
The refurbisher replaces RTC battery.
The refurbisher cleans the keyboard and replaces it if needed.
The refurbisher validates hardware performance for 12 hours run time test through Windows Experience Index while measuring that the CPU’s heat stays cool during testing.
The refurbisher cleans the chassis and screen with Isopropyl alcohol.
The refurbisher prepares the shipment to Insurgo and removes his gloves.
Insurgo puts gloves on and opens received shipment.
Insurgo upgrades the firmwares to latest versions.
Insurgo opens the computer chassis.
Insurgo inspects that the plastic film covering the hardware components, permitting water to drain from the keyboard to under the laptop, has not been physically tampered with.
Insurgo then proceeds to reflash the 2 SPI flash chips. Doing so, it neuters Intel ME and installs Heads x230-flasher firmware.
Insurgo replaces the wifi card with an Atheros AR5BHB116 300Mbps wifi card and closes the case.
Insurgo boots the laptop, wipes present Windows installation from Heads and flashes reproducible rom downloaded from its GitLab’s CI‘s PrivacyBeast_X230_QubesOS_Certified branch
Insurgo Owns the TPM, inserts his Deployment public key inside Heads’ ROM and reboots.
Insurgo types his own Deployment signing key’s passphrase and seals ROM integrity into TPMTOTP/HOTP.
Insurgo boots Librem Key’s Deployment signed Clonezilla iso and clones the latest QubesOS disk image through its dockstation’s SSD drive.
Insurgo validates the working state of the hardware and QubesOS functionality by connecting to Insurgo‘s local network, apply latest QubesOS updates and syncs the system clock to Greenwich Mean Time (GMT+0 timezone). In case of installed updates, the installation is cloned back into Dock station’s SSD drive to serve as a disk image for future deployment once a month.
Insurgo launches the reownership wizard with a new Librem Key connected to USB port, reencrypts LUKS container of both internal and sdcard drive, owns the Librem Key by defining Admin and User PINs, owns the TPM, takes a screenshot of the TPMTOTP and sends related information to end user through user chosen secured communication channel. Note that all OEM provisioned secrets were randomly generated diceware passphrases. A backup of provisioned secrets is saved under provided sdcard encrypted LUKS partition, for which the Disk Recovery Key passphrase will be shared with the customer. This Disk Recovery Key passphrase will be replaced in the first step of the Re-Ownership Wizard.
Insurgo validates TOTP/HOTP codes. Reboots. Validates the codes again.
Insurgo applies a 1cm diameter brand sticker on the power button.
Insurgo applies a 1cm diameter brand sticker to cover the main screw securing the keyboard to the chassis under the laptop and applies nail polish around its edge as a physical tamper evidence proof.
Insurgo cleans the chassis and screen with Isopropyl alcohol.
Insurgo prepares shipment.
Insurgo removes his gloves.
Insurgo guarantees that the hardware left his facility in a working state.
Shipping insurances covering total hardware and labor costs are included in shipping costs, which requires signature from end user upon reception. If you decide to make the shipment signature free, lost of shipment will become your responsibility.
If the laptop arrives in a damaged box, please take precaution prior to accepting the delivered package: open the box and inspect hardware. If the laptop is damaged, it is the shipper responsibility to deal with the caused damage: don’t accept shipment and contact Insurgo immediately. If the laptop doesn’t boot from the acceptation of a damaged box, trouble arises and you will have to take responsibility. Be warned.
Insurgo is responsible for the labor and testing of functional hardware while the refurbisher is responsible for the parts and refurbishing the hardware.
Reflashing the hardware, internally or externally may lead to having a brick and voids QubesOS certification and Insurgo’s warranty.
Software and user support is offered through project communities.
Insurgo is a proud collaborator of both QubesOS and Heads project, which support is offered through GitHub ticketing system. Please search for your issue prior to opening a new ticket. You’re now part of the community 🙂