How linuxboot/heads works
Heads is a firmware and boot-security project for commodity laptops and servers. Its intended user outcome is a boot path rooted in free firmware, with firmware and filesystem integrity measured or verified before handing off to an operating system. The repository also includes image-cleaning utilities for Intel Management Engine firmware. The README documents the major boot, trust, TPM, key, and board-configuration capabilities; most runtime implementation files were not sampled, so runtime links are kept sparse rather than inferred from filenames.
Main entry points: initrd Boot environment · coreboot Coreboot firmware · linux Linux payload · bin Boot measurement
Components 18
Boot runtime
- Coreboot firmware
modules/coreboot - Linux payload
modules/linux - Boot environment
initrd - Boot selection
initrd/bin - Boot interface
initrd/bin
Integrity and secrets
- Filesystem checks
initrd/bin - Boot measurement
initrd/bin - TPM operations
initrd/bin - Key handling
initrd/bin - GPG verification
initrd/bin - HOTP and TOTP
initrd/bin
Platform support
- Board definitions
boards - Firmware configs
config - Firmware blobs
blobs - Winterfell init
unmaintained_boards/UNTESTED_winterfell/uinit.go
Firmware utilities
- ME cleaner
blobs/utils/me_cleaner/me_cleaner.py - ME update parser
blobs/xx20/me7_update_parser.py
Other components
- Device operator
Connections 12
- Device operator → Coreboot firmware: boots device
- Coreboot firmware → Linux payload: loads payload
- Linux payload → Boot environment: uses initrd
- Boot environment → Boot selection: selects boot
- Boot environment → Boot interface: offers interface
- Boot environment → Filesystem checks: verifies filesystems
- Boot environment → Boot measurement: measures state
- Boot measurement → TPM operations: uses TPM
- Boot environment → Key handling: handles keys
- Boot environment → GPG verification: checks signatures
- Boot environment → HOTP and TOTP: supports attestation
- Board definitions → Firmware configs: defines variants