Hello,
I was trying to duplicate a coreboot build back in November and I noticed I couldn't get my ROM file to be identical to the one I found online.
It seems that Coreboot doesn't have reproducible builds yet.
Debian has been looking into this for a while https://wiki.debian.org/ReproducibleBuilds and I think Coreboot should adopt this concept.
It seems like we are halfway there with INCLUDE_CONFIG_FILE but what I've noticed is that even if I extract the CONFIG_ values the build still needs some manual tweaking.
Ideally we should record the tools used (crossgcc version, etc), the coreboot git revision id, the CONFIG_ values and the build info for the payloads (for the auto-downloaded SeaBIOS I think just the git revision id would be enough). If the timestamps and such are cleaned we should get a reproducible ROM.
Is there anyone willing to help me with this (or already working on this)?
--emi