What Heads Is and What the Heads Wiki Covers

Heads is an open-source custom firmware and OS configuration for laptops and servers, built on coreboot with a Linux bootloader in ROM, aimed at improving physical security and protecting data on machines that store data and state. The Heads wiki (osresearch.net) is the documentation site for the project: it explains how Heads works and how to use it. Heads is not a stateless operating system like Tails; it is designed for the case where you need to keep data and state on the computer.

What Heads actually changes

Heads moves the root of trust into the write-protected region of the SPI flash and prevents further software modification of the boot code. On platforms that support it, BootGuard enforces verified boot of the firmware. Because Heads controls the first instruction the CPU executes, it can measure every step of the boot firmware and configuration into the TPM, which makes it possible to attest to the user or a remote system that the machine has not been tampered with.

Two practical consequences follow from that design:

• Disk decryption is tied to a known good state. Once the system is in a known good state, the TPM is used as hardware key storage to decrypt the drive.
• Boot components are user-signed. The hypervisor, kernel, and initrd images are signed by keys the user controls.

Heads does not claim to stop every attack. The project's own framing is that it addresses several classes of attacks against the boot process and physical hardware that traditional installations neglect, raising the difficulty beyond what most attackers are willing to spend. Modern Intel CPUs require binary blobs to boot; those non-free components are included in the measurements and are at least guaranteed to be unchanging.

What the wiki covers

The wiki is the documentation for the Heads firmware project. Its main menu splits guidance by platform type: laptop/workstation on one side, server (BMC/SSH/Console) on the other. It also records project history and threat context — for example, Trammel Hudson's 2016 33C3 talk introducing Heads, which catalogues specific attack classes and mitigations such as Thunderstrike (DMA over Thunderbolt rewriting SPI flash, countered by enabling IOMMU/VT-d and coreboot disabling the relevant exposure).

Who it is for, and the cost caveat

Heads suits people who want verifiable boot integrity on hardware they physically control and who accept that the machine keeps data on it. It is not a fit if you want a leave-no-trace OS, or if your hardware is not among the supported platforms.

The wiki and Heads are free and open source, but the project states that keeping them maintained is ongoing work that is not free. Support is directed to GitHub Sponsors (tlaurion) or Open Collective (Insurgo), with details on the Community page. The site does not present Heads as a paid product; it presents maintenance as something that needs funding.

Getting oriented

Start with the wiki's overview to confirm your hardware is supported, then read the platform-specific section (laptop/workstation or server) before attempting anything. The overview is also where the trust model — SPI flash write protection, TPM measurements, attestation, and user-signed boot images — is explained, and understanding that model first is what makes the platform guides usable.