Heads is an open-source firmware configuration for laptops and servers designed to enhance the security of commodity hardware. It aims to replace proprietary vendor BIOS/UEFI with a minimal, auditable, and measured boot environment.
Heads establishes a Hardware Root of Trust by moving the trust anchor into the SPI flash ROM. It leverages Measured Boot via a Trusted Platform Module (TPM) to ensure that every stage of the firmware and the OS boot process is measured and verified before execution README.md5-11
[!WARNING] Heads is a technical project. Installation typically requires hardware disassembly, external SPI flash programmers, and carries a risk of bricking the device README.md15-19
Heads follows a three-layer firmware stack architecture, all contained within the SPI flash chip.
kexec utilities for OS handoff doc/architecture.md60-64The following diagram illustrates how the primary subsystems relate from reset to OS handoff, mapping architectural concepts to specific code entities.
Heads Boot Logic and Code Entities
For more details on the component stack and configuration layers, see Architecture Overview.
Heads uses a cross-validated boot chain. The TPM stores measurements of the firmware stages in PCRs. Users can verify the integrity of their firmware via TOTP/HOTP attestation (e.g., using a Nitrokey or Librem Key) before entering disk passphrases doc/security-model.md14-16
The handoff to the Operating System is secured by GPG signatures. The /boot partition of the OS is signed with a user's GPG key, and Heads verifies these signatures before using kexec to boot the kernel doc/security-model.md98-101
For details on the trust hierarchy and sealing policies, see Security Model.
Heads supports a variety of hardware architectures, primarily x86-64 and PowerPC64LE doc/architecture.md122-128 Supported devices include:
Hardware is categorized into maintenance tiers. Boards using older Intel CPUs (1st-7th Gen) that no longer receive microcode updates are marked with EOL_ prefixes to warn users of inherent vulnerabilities like Spectre BOARDS_AND_TESTERS.md9-12
Hardware Tier and Configuration Association
For a full catalog of boards and configuration structures, see Supported Boards and Hardware Tiers.
Heads uses a meta-build system based on a top-level Makefile that orchestrates the compilation of various modules (e.g., musl-cross-make, busybox, linux, cryptsetup) README.md104-117
To ensure Reproducible Builds, Heads provides a Nix-pinned Docker environment via flake.nix. Users are encouraged to use the provided Docker wrapper scripts (like docker_repro.sh) to build ROM images that match official releases bit-for-bit doc/docker.md1-5 flake.nix1-12
For details on the build pipeline and module system, see Build System.
