2026-09-24 –, GPN-T Main Room
LinuxBoot replaces most vendor firmware with a Linux kernel and an initramfs, and is explicitly agnostic about which runtime it uses: u‑root provides a generic Go‑based userland and boot policy toolkit, while Heads is a secure runtime that can be used as the initramfs for LinuxBoot. Heads, in turn, is a firmware distribution that replaces proprietary BIOS/UEFI with coreboot, a Linux kernel and a security‑focused initramfs to bring measured boot and TPM‑based protection to laptops, desktops and servers.
This talk looks at boot chain security in that configuration: Heads as one LinuxBoot implementation, not the reference, and how we can better merge the two worlds instead of keeping them as parallel efforts.
I will first summarize how Heads today piggybacks on coreboot’s static root of trust for measurement and uses TPM‑sealed secrets for local disk unlock, together with “remote attestation” that is in practice human‑mediated: TPMTOTP against a smartphone authenticator and HOTP against USB security tokens such as Librem Key or Nitrokey. I then contrast this with what a true remote attestation design looks like, using VaultBoot, a Heads‑based firmware payload, as an example: TPM 2.0 policies, parameter‑encrypted TPM sessions, and an attestation server that verifies quotes and only then releases key material used for full‑disk encryption unlock. This shows a clear path to evolve Heads from local human checks to policy‑driven, server‑authoritative disk unlock for enterprise/server use cases.
The core of the talk is how those TPM2 policy and key‑release concepts could be reintegrated upstream and exposed as a common LinuxBoot runtime capability that both Heads‑style and u‑root‑style initramfs environments can consume.
Finally, I outline what this would mean in practice: moving beyond hyperscaler deployments toward an owner‑controlled replacement for UEFI DXE on commodity hardware, with LinuxBoot handling DXE/BDS, Heads as one of several runtimes, and kexec‑based hand‑off plus TPM2 attestation forming the backbone for on‑prem clouds, local AI boxes and smaller VPS providers.
Heads maintainer, Accessible Security evangelist, full time Open Source Firmware R&D, linux plumber by need.