heads-wiki

heads-wiki copied to clipboard

> > > @tlaurion @daringer > > > NS70 (which is the same board as the ns50) tests : > > > ✔️ heads upgrade to [this](https://app.circleci.com/pipelines/github/tlaurion/heads/2432/workflows/adb69e45-e460-4118-8570-ec3b8dd9f4c6/jobs/43892/artifacts) zip > >...

tlaurion

Expand sections dm-verity and hardening

1

The following need expanding; "qubes read-only filesystem" "dm-verity" "Soldering jumpers on WP# pins, setting BP bits"

ThePlexus

Better explain Heads functionnings and limitation

9

Edit: best unbiased, user written doc at https://tech.michaelaltfield.net/2023/02/16/evil-maid-heads-pureboot/ --- The following should go into a wiki page. Actual Heads security mechanisms are: 1. Measured /boot, requiring a USB Security dongle...

tlaurion

Add in place programmer's flashing "best practices" and refer to ch341a rev 1.6+ / Tigard

24

There is a lot of information out there on ch341a programmer giving too much voltage (5v vs 3.3v). Users reports of having bricked their laptops (SPI chip to motherboards resistors)....

tlaurion

added coreboot & nitrokey matrix rooms

2

boredsquirrel

added links to forums in the meantime

4

I wrote the two last posts. I am in the process of installing it myself, already accomplished some steps. When ready, I will create the wiki entry completely, instead of...

boredsquirrel

I leave my comments, from my first exposure to the manual: [Prerequisites for Heads](https://osresearch.net/Prerequisites): - The mention of what TOTP/HOTP is at the end in the [Current Maximized boards ](https://osresearch.net/Prerequisites#current-maximized-boards)section....

Psotas

Notes on how to audit a maximized flashed firmware image

8

This is raw notes. This will get edited multiple times prior of having a base to create a wiki page. The quick way, no-brainer, is to reflash the same downloaded/compiled...

tlaurion

https://github.com/linuxboot/heads/pull/1570 does it automatically, while CircleCI keeps doing it manually to minimize the number of times Lenovo and other websites are used to download firmware images containing the blobs to...

tlaurion

Distinction between TPM measurements and sealing/unsealing TPM operations

9

That question was answered on slack/matrix here: https://matrix.to/#/!pAlHOfxQNPXOgFGTmo:matrix.org/$SDLnmO-F3ALUZKvlnW0TR8SY8nZlbFaR_8C7Hgygoxw?via=matrix.org&via=nitro.chat&via=talk.puri.sm : > in coreboot with measured boot activated, the TPM is used to measure coreboot different stages before they are loaded and...

tlaurion