linuxboot/heads

Health v2 · maintenance only

Adoption not part of the score

1585 stars · 211 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

Heads is an open-source firmware and OS configuration that runs a minimal Linux as a coreboot or LinuxBoot ROM payload, moving the root of trust into write-protected SPI flash. It measures boot steps into the TPM, provides TOTP/HOTP attestation, GPG-signed kernels, and TPM-sealed LUKS disk decryption for laptops, workstations, and servers.

Use cases

• replace proprietary UEFI firmware with an auditable open-source boot path
• verify firmware and boot integrity via TPM measured boot and attestation
• securely unlock LUKS-encrypted disks using TPM-sealed keys
• sign and verify kernels, initrds, and OS ISOs before booting
• build a tamper-resistant boot environment for Qubes OS or other Linux distros
• harden commodity laptops like ThinkPads against physical and evil-maid attacks

When to choose

• you need a hardware-rooted, measured, and attested boot chain on supported hardware
• you want to replace vendor UEFI with coreboot plus a verified Linux payload
• you run Qubes OS or encrypted Linux and want TPM-based disk unlock and signed boot files
• you are comfortable flashing SPI ROMs and doing hardware modifications

When to avoid

• you need a plug-and-play solution without disassembling hardware or using external flash programmers
• your hardware is not on the supported boards list
• you are a non-technical user unwilling to risk bricking your machine
• you need broad UEFI Secure Boot compatibility with vendor firmware

Facets

application · maturity active

security cryptography embedded developer-tools security operating-systems hardware privacy self-hosted embedded cross-platform coreboot firmware tpm verified-boot measured-boot boot-loader linuxboot secure-boot luks attestation linux

Member repositories

For agents

markdown · JSON · MCP: product_card(name="linuxboot/heads")