Firmware, boot & trust

What runs before the kernel, and how you prove what ran.

Organisation	Repos	Site	Docs	What it holds
`go-tpm2`	8	site	docs	TPM 2.0 end to end: transports, the command layer, EFI_TCG2, measured boot, event-log replay and remote attestation.
`go-coff`	4	site	docs	PE/COFF for UEFI — an object-to-EFI linker, a signing and conversion CLI, and a self-extracting EFI packer.
`go-bootloaders`	2	site	docs	GRUB and systemd-boot tooling, composed on the storage, UEFI and TPM stacks rather than reimplementing them.
`cloud-boot`	11	site	docs	Booting the machine: a TamaGo UEFI payload, a pure-UEFI loader that finds the distro kernel at runtime, a unified kernel image, an init, kernels, ISOs, a virtio-net driver, SEV-SNP attestation, and Windows boot-manager test infrastructure. Two of its repositories are neither bootloader nor kernel but the TinyGo runtime files without which GOARCH=riscv64 and GOARCH=loong64 cannot produce a baremetal UEFI binary at all — the prerequisite, kept where it is needed rather than waited on upstream.
`nano-container-linux`	7	site	docs	A minimal container host — OCI initrd and PXE boot, a DNS daemon, an OpenPubKey agent.

Counts are public repositories that hold code; brand, docs and landing repositories are excluded.