blobs/m900: address review comments for flashing URL and blob hash verification

- Remove pending URL with TODO marker from README; reword as future guide

- Add make stamp target (.hashes-verified) that verifies IFD/GBE blob sha256 against hashes.txt at build time

- Track .hashes-verified stamp in .gitignore

Signed-off-by: Thierry Laurion <insurgo@riseup.net>

Author: tlaurion

blobs/m900/.gitignore

@@ -1,3 +1,4 @@
 m900_me.bin
 me_cleaned.bin
+.hashes-verified
 

blobs/m900/README.md

@@ -47,7 +47,7 @@ Sha256sums: `blobs/m900/hashes.txt`
 
 # Documentation
 
-A guide on how to flash this board can be found at https://osresearch.net/m900_tower-maximized-flashing/ (pending: the page needs to be created).
+A guide on how to flash this board (once written) will be linked from https://osresearch.net/ .
 
 The upstream port for the board can be found here: https://review.coreboot.org/c/coreboot/+/74187
 

targets/m900_me_blobs.mk

@@ -10,9 +10,28 @@
 # The IFD (m900_tower_ifd.bin) and GBE (m900_tower_gbe.bin) blobs are
 # taken from a donor board and committed to the repo directly.
 
+# Verify hashes of committed blobs (IFD and GBE) before building the board.
+# A stamp file tracks completion; it is regenerated whenever hashes.txt changes.
+$(pwd)/blobs/m900/.hashes-verified: $(pwd)/blobs/m900/hashes.txt \
+    $(pwd)/blobs/m900/m900_tower_ifd.bin $(pwd)/blobs/m900/m900_tower_gbe.bin
+	@while read -r hash filename; do \
+		case "$$filename" in \
+			m900_tower_ifd.bin|m900_tower_gbe.bin) \
+				path="$(pwd)/blobs/m900/$$filename"; \
+				if ! echo "$$hash  $$path" | sha256sum --check >/dev/null 2>&1; then \
+					echo "ERROR: $$filename hash mismatch"; \
+					exit 1; \
+				fi; \
+				;; \
+		esac; \
+	done < $(pwd)/blobs/m900/hashes.txt
+	@echo "IFD/GBE blob hashes verified"
+	@touch "$@"
+
 # Make the Coreboot build depend on the following 3rd party blobs:
 $(build)/coreboot-$(CONFIG_COREBOOT_VERSION)/$(BOARD)/.build: \
-    $(pwd)/blobs/m900/m900_me.bin
+    $(pwd)/blobs/m900/m900_me.bin \
+    $(pwd)/blobs/m900/.hashes-verified
 
 
 $(pwd)/blobs/m900/m900_me.bin: