Heads is an open-source firmware configuration for laptops and servers designed to enhance the security of commodity hardware. It aims to replace proprietary vendor BIOS/UEFI with a minimal, auditable, and measured boot environment.
Heads establishes a Hardware Root of Trust by moving the trust anchor into the SPI flash ROM. It leverages Measured Boot via a Trusted Platform Module (TPM) to ensure that every stage of the firmware and the OS boot process is measured and verified before execution README.md5-11
[!WARNING] Heads is a technical project. Installation typically requires hardware disassembly, external SPI flash programmers, and carries a risk of bricking the device README.md15-19
Heads follows a three-layer firmware stack architecture, all contained within the SPI flash chip.
kexec utilities for OS handoff doc/architecture.md60-65The following diagram illustrates how the primary subsystems relate from reset to OS handoff, mapping architectural concepts to specific script entities.
Heads Boot Logic and Code Entities
For more details on the component stack and configuration layers, see Architecture Overview.
Heads uses a cross-validated boot chain. The TPM stores measurements of the firmware stages in PCRs. Users can verify the integrity of their firmware via TOTP/HOTP attestation (e.g., using a Nitrokey or Librem Key) before entering disk passphrases doc/security-model.md14-59
The handoff to the Operating System is secured by GPG signatures. The /boot partition of the OS is signed with a user's GPG key, and Heads verifies these signatures before using kexec to boot the kernel doc/security-model.md99-102
For details on the trust hierarchy and sealing policies, see Security Model.
Heads supports a variety of hardware architectures, primarily x86-64 and PowerPC64LE doc/architecture.md122-129 Supported devices include:
Hardware is categorized into maintenance tiers. Boards using older Intel CPUs (1st-7th Gen) that no longer receive microcode updates are marked with EOL_ prefixes to hint at their vulnerability status BOARDS_AND_TESTERS.md9-12
Hardware Tier to Code Association
For a full catalog of boards and configuration structures, see Supported Boards and Hardware Tiers.
Heads uses a meta-build system based on a top-level Makefile that orchestrates the compilation of various modules (e.g., musl-cross-make, busybox, linux) README.md104-117
To ensure Reproducible Builds, Heads provides a Nix-pinned Docker environment via flake.nix and flake.lock. Users are encouraged to use the provided Docker wrapper scripts, such as ./docker_repro.sh, to build ROM images that match official releases bit-for-bit flake.nix1-12 doc/docker.md1-25
For details on the build pipeline and module system, see Build System.
