At compilation and under CircleCI, a file named hashes.txt contains the hashes of all individual files that were packed.
Under CircleCI, each board compiled for a commit also prints all the hashes of the files that were contained in the firmware in an individual step, which should stay there forever.
So if you downloaded your ROM from CircleCI, you could go under Heads Options->“System Information” to get your ROM’s commit ID and find relative hashes.txt file for initrd contained files packed in the firmware under CircleCI’s commit ID’s board build’s “Output hashes” step.
Exemple:
- Firmware image: heads-x230-hotp-maximized-v0.2.0-1298-g3184bf7.rom (note 3184bf7 in filename)
- Commit id 3184bf7a8c6404551871e1353a391710cc52f426 or 3184bf7
- Merge pull request #1246 from JonathonHall-Purism/continue_to_main_menu · osresearch/heads@3184bf7 · GitHub or Merge pull request #1246 from JonathonHall-Purism/continue_to_main_menu · osresearch/heads@3184bf7 · GitHub greenmark leads to CircleCI boards builds
- Which leads (for 30 days after build) to artifacts at https://app.circleci.com/pipelines/github/osresearch/heads/471/workflows/e251318e-5c4e-4129-8a7b-76220cd2623f/jobs/5487/artifacts
- Which leads to permanent build steps and logs and steps for x230-hotp-maximized board at https://app.circleci.com/pipelines/github/osresearch/heads/471/workflows/e251318e-5c4e-4129-8a7b-76220cd2623f/jobs/5487/steps
- Which “Output hashes” step from above links to https://circleci.com/api/v1.1/project/github/osresearch/heads/5487/output/104/0?file=true&allocation-id=637e9d06adb8300307273922-0-build%2F27F6F98C (Note again that the hashes.txt file’s first line states the commit ID: 3184bf7a8c6404551871e1353a391710cc52f426)
If you are talking about taking a backup of the firmware, and are willing/searching for ways to unpack its content for inspection against hashes, that will be another subject and a really long one…