Merge branch 'master' into 25.06_branch25.06_branch

7 files changed, 157 insertions, 159 deletions

diff --git a/include/get.sh b/include/get.sh
index c6c6b75b..667ab398 100644
--- a/include/get.sh
+++ b/include/get.sh
@@ -15,7 +15,6 @@ fetch_targets()
 	printf "Creating %s tree %s\n" "$project" "$tree"
 	git_prep "$url" "$bkup_url" "$xbmkpwd/$configdir/$tree/patches" \
 	    "src/$project/$tree" with_submodules
-	( fx_ nuke find "$xbmkpwd/config" -type f -name "nuke.list" ) || exit 1
 }
 
 fetch_project()
@@ -31,7 +30,6 @@ fetch_project()
 		x_ ./mk -f $d
 	done
 	clone_project
-	( fx_ nuke find "$xbmkpwd/config" -type f -name "nuke.list" ) || exit 1
 }
 
 clone_project()
@@ -150,27 +148,15 @@ try_git()
 
 bad_checksum()
 {
-	[ ! -f "$2" ] && printf "File '%s' missing (sha512sum '%s')\n" \
-	    "$2" "$1" 1>&2 && return 0
-	fchksum="$(x_ sha512sum "$2" | awk '{print $1}')" || \
-	    err "Can't get sha512sum on '$2' (checking for sha512sum '$1')"
-	[ "$fchksum" != "$1" ] || return 1
-	printf "WARNING: BAD checksum for '%s' - expected '%s', got '%s'\n" \
-	    "$2" "$1" "$fchksum" 1>&2
-	x_ rm -f "$2"
+	[ ! -f "$2" ] && printf "'%s' missing, %s\n" "$2" "$1" 1>&2 && return 0
+	csum="$(x_ sha512sum "$2" | awk '{print $1}')" || err "!sha512 '$2' $1"
+	[ "$csum" != "$1" ] && printf "BAD SHA512, '%s'; need '%s', got %s\n" \
+	    "$2" "$1" "$csum" 1>&2 && x_ rm -f "$2" && return 0; return 1
 }
 
 tmpclone()
 {
-	printf "Creating git clone '%s' from '%s'\n" "$2" "$1"
 	( x_ git clone "$1" "$2" ) || return 1
 	( x_ git -C "$2" reset --hard "$3" ) || return 1
 	( fx_ "eval x_ git -C \"$2\" am" find "$4" -type f ) || return 1; :
 }
-
-nuke()
-{
-	rdir="${1#"$xbmkpwd/config/"}" && [ -d "$xbmkpwd/src/${rdir%/*}" ] && \
-	    x_ cd "$xbmkpwd/src/${rdir%/*}" && \
-	    dx_ "eval [ -L \"\$fx\" ] || x_ rm -Rf" "$1"; :
-}
diff --git a/include/init.sh b/include/init.sh
index 2dd9e88f..ee19c398 100644
--- a/include/init.sh
+++ b/include/init.sh
@@ -12,11 +12,10 @@ projectsite="https://libreboot.org/"
 
 [ -z "${PATH+x}" ] && \
     export PATH="/usr/local/bin:/usr/bin:/bin:/usr/local/games:/usr/games"
-xbmkpath="$PATH"
 
 eval "`setvars "" _nogit board reinstall versiondate aur_notice configdir \
     datadir version xbmkpwd relname xbmkpwd xbmktmp python pyver xbmklocal \
-    xbmklock cvxbmk cvchk`"
+    xbmklock cvxbmk cvchk xbmkpath`"
 
 xbmk_init()
 {
@@ -31,8 +30,7 @@ xbmk_init()
 	id -u 1>/dev/null 2>/dev/null || err "suid check failed (id -u)"
 	[ "$(id -u)" != "0" ] || err "this command as root is not permitted"
 
-	for init_cmd in set_pyver set_version set_env git_init create_tmpdir \
-	    lock create_pathdirs child_exec; do
+	for init_cmd in get_version set_env git_init child_exec; do
 		xbmk_$init_cmd "$@" || break
 	done
 }
@@ -51,6 +49,95 @@ xbmkpkg()
 	    printf "You need AUR packages: %s\n" "$aur_notice" 1>&2; :
 }
 
+xbmk_get_version()
+{
+	[ ! -f ".version" ] || read -r version < ".version" || err
+	[ ! -f ".versiondate" ] || read -r versiondate < ".versiondate" || err
+	[ ! -f ".version" ] || chkvars version
+	[ ! -f ".versiondate" ] || chkvars versiondate
+
+	[ ! -e ".git" ] && [ ! -f ".version" ] && version="unknown"
+	[ ! -e ".git" ] && [ ! -f ".versiondate" ] && versiondate="1716415872"
+
+	[ -n "$version" ] && relname="$projectname-$version"; :
+}
+
+xbmk_set_env()
+{
+	is_child="n"
+
+	xbmkpath="$PATH"
+
+	# unify all temporary files/directories in a single TMPDIR
+	[ -z "${TMPDIR+x}" ] || [ "${TMPDIR%_*}" = "/tmp/xbmk" ] || \
+	    unset TMPDIR
+	[ -n "${TMPDIR+x}" ] && export TMPDIR="$TMPDIR" && xbmktmp="$TMPDIR"
+	[ -z "${TMPDIR+x}" ] || is_child="y" # child instance, so return
+
+	if [ "$is_child" = "y" ]; then
+		[ -z "${XBMK_CACHE+x}" ] && err "XBMK_CACHE unset on child"
+		[ -z "${XBMK_THREADS+x}" ] && err "XBMK_THREADS unset on child"
+		e "lock" f missing && err "lock file absent on child"
+		return 1
+	fi
+
+	[ -f "$xbmklock" ] && err "'$xbmklock' exists. Is a build running?"
+	touch "$xbmklock" || err "cannot create '$xbmklock'"; :
+
+	# parent instance of xbmk, so don't return. set up TMPDIR
+	export TMPDIR="/tmp"
+	export TMPDIR="$(mktemp -d -t xbmk_XXXXXXXX)"
+	xbmktmp="$TMPDIR"
+
+	# XBMK_CACHE is a directory, for caching downloads and git repon
+	[ -z "${XBMK_CACHE+x}" ] && export XBMK_CACHE="$xbmkpwd/cache"
+	[ -z "$XBMK_CACHE" ] && export XBMK_CACHE="$xbmkpwd/cache"
+	[ -L "$XBMK_CACHE" ] && [ "$XBMK_CACHE" = "$xbmkpwd/cache" ] && \
+	    err "cachedir '$xbmkpwd/cache' is a symlink"
+	[ -L "$XBMK_CACHE" ] && export XBMK_CACHE="$xbmkpwd/cache"
+	xbmkcache="`findpath "$XBMK_CACHE"`" || \
+	    err "Can't resolve cachedir: '$XBMK_CACHE'"
+	export XBMK_CACHE="$xbmkcache"
+	[ ! -e "$XBMK_CACHE" ] || \
+	    [ -d "$XBMK_CACHE" ] || err "cachedir '$XBMK_CACHE' is a file"; :
+
+	export PATH="$XBMK_CACHE/xbmkpath:$XBMK_CACHE/gnupath:$PATH"
+	xbmkpath="$PATH"
+
+	# if "y": a coreboot target won't be built if target.cfg says release="n"
+	# (this is used to exclude certain build targets from releases)
+	[ -z "${XBMK_RELEASE+x}" ] && export XBMK_RELEASE="n"
+	[ "$XBMK_RELEASE" = "Y" ] && export XBMK_RELEASE="y"
+	[ "$XBMK_RELEASE" = "y" ] || export XBMK_RELEASE="n"
+
+	[ -z "${XBMK_THREADS+x}" ] && export XBMK_THREADS=1
+	expr "X$XBMK_THREADS" : "X-\{0,1\}[0123456789][0123456789]*$" \
+	    1>/dev/null 2>/dev/null || export XBMK_THREADS=1
+
+	xbmk_set_version
+	export LOCALVERSION="-$projectname-${version%%-*}"
+
+	remkdir "$xbmktmp" "$xbmklocal"
+	remkdir "$XBMK_CACHE/gnupath" "$XBMK_CACHE/xbmkpath"
+
+	xbmk_set_pyver
+}
+
+xbmk_set_version()
+{
+	version_="$version"
+	[ ! -e ".git" ] || version="$(git describe --tags HEAD 2>&1)" || \
+	    version="git-$(git rev-parse HEAD 2>&1)" || version="$version_"
+	versiondate_="$versiondate"
+	[ ! -e ".git" ] || versiondate="$(git show --no-patch --no-notes \
+	    --pretty='%ct' HEAD)" || versiondate="$versiondate_"
+
+	chkvars version versiondate
+	update_xbmkver "."
+
+	relname="$projectname-$version"
+}
+
 xbmk_set_pyver()
 {
 	pyv="import sys; print(sys.version_info[:])"
@@ -63,7 +150,14 @@ xbmk_set_pyver()
 	[ -n "$pyver" ] && \
 	    pyver="$("$(pybin "$python")" -c "$pyv" | awk '{print $1}')" && \
 	    pyver="${pyver#(}" && pyver="${pyver%,}"
-	[ "${pyver%%.*}" = "3" ] || err "Bad python version (must by 3.x)"; :
+	[ "${pyver%%.*}" = "3" ] || err "Bad python version (must by 3.x)"
+
+	(
+	# set up python v3.x in PATH, in case it's not set up correctly.
+	# see code above that detected the correct python3 command.
+	x_ cd "$XBMK_CACHE/xbmkpath"
+	x_ ln -s "`pybin "$python"`" python
+	) || err "Can't set up python symlink in $XBMK_CACHE/xbmkpath"; :
 }
 
 # Use direct path, to prevent a hang if Python is using a virtual environment,
@@ -97,57 +191,6 @@ pybin()
 	command -v "$1" 2>/dev/null || return 1
 }
 
-xbmk_set_version()
-{
-	[ ! -f ".version" ] || read -r version < ".version" || :; :
-	[ ! -f ".versiondate" ] || read -r versiondate < ".versiondate" || :; :
-
-	[ -e ".git" ] || [ -f ".version" ] || printf "unknown\n" > ".version" \
-	    || err "Cannot generate unknown .version file"
-	[ -e ".git" ] || [ -f ".versiondate" ] || printf "1716415872\n" > \
-	    ".versiondate" || err "Can't generate unknown versiondate file"; :
-
-	version_="$version"
-	[ ! -e ".git" ] || version="$(git describe --tags HEAD 2>&1)" || \
-	    version="git-$(git rev-parse HEAD 2>&1)" || version="$version_"
-	versiondate_="$versiondate"
-	[ ! -e ".git" ] || versiondate="$(git show --no-patch --no-notes \
-	    --pretty='%ct' HEAD)" || versiondate="$versiondate_"
-
-	chkvars version versiondate
-	printf "%s\n" "$version" > ".version" || err "can't save version"
-	printf "%s\n" "$versiondate" > ".versiondate" || err "can't save date"
-
-	relname="$projectname-$version"
-}
-
-xbmk_set_env()
-{
-	export LOCALVERSION="-$projectname-${version%%-*}"
-
-	# XBMK_CACHE is a directory, for caching downloads and git repon
-	[ -z "${XBMK_CACHE+x}" ] && export XBMK_CACHE="$xbmkpwd/cache"
-	[ -z "$XBMK_CACHE" ] && export XBMK_CACHE="$xbmkpwd/cache"
-	[ -L "$XBMK_CACHE" ] && [ "$XBMK_CACHE" = "$xbmkpwd/cache" ] && \
-	    err "cachedir '$xbmkpwd/cache' is a symlink"
-	[ -L "$XBMK_CACHE" ] && export XBMK_CACHE="$xbmkpwd/cache"
-	xbmkcache="`findpath "$XBMK_CACHE"`" || \
-	    err "Can't resolve cachedir: '$XBMK_CACHE'"
-	export XBMK_CACHE="$xbmkcache"
-	[ ! -e "$XBMK_CACHE" ] || \
-	    [ -d "$XBMK_CACHE" ] || err "cachedir '$XBMK_CACHE' is a file"; :
-
-	# if "y": a coreboot target won't be built if target.cfg says release="n"
-	# (this is used to exclude certain build targets from releases)
-	[ -z "${XBMK_RELEASE+x}" ] && export XBMK_RELEASE="n"
-	[ "$XBMK_RELEASE" = "Y" ] && export XBMK_RELEASE="y"
-	[ "$XBMK_RELEASE" = "y" ] || export XBMK_RELEASE="n"
-
-	[ -z "${XBMK_THREADS+x}" ] && export XBMK_THREADS=1
-	expr "X$XBMK_THREADS" : "X-\{0,1\}[0123456789][0123456789]*$" \
-	    1>/dev/null 2>/dev/null || export XBMK_THREADS=1; :
-}
-
 xbmk_git_init()
 {
 	for gitarg in "--global user.name" "--global user.email"; do
@@ -167,44 +210,6 @@ xbmk_git_init()
 	    2>/dev/null; :
 }
 
-xbmk_create_tmpdir()
-{
-	x_ mkdir -p "$xbmklocal"
-
-	# unify all temporary files/directories in a single TMPDIR
-	[ -z "${TMPDIR+x}" ] || [ "${TMPDIR%_*}" = "/tmp/xbmk" ] || \
-	    unset TMPDIR
-	[ -n "${TMPDIR+x}" ] && export TMPDIR="$TMPDIR" && xbmktmp="$TMPDIR"
-	[ -z "${TMPDIR+x}" ] || return 1 # child instance, so return
-
-	# parent instance of xbmk, so don't return. set up TMPDIR
-	export TMPDIR="/tmp"
-	export TMPDIR="$(mktemp -d -t xbmk_XXXXXXXX)"
-	xbmktmp="$TMPDIR"
-
-	# /tmp might be a tmpfs, so for large files we use ./tmp,
-	# not to be confused with xbmktmp (xbmktmp points to /tmp)
-	remkdir "$xbmktmp" "$xbmklocal"
-}
-
-xbmk_lock()
-{
-	[ -f "$xbmklock" ] && err "'$xbmklock' exists. Is a build running?"
-	touch "$xbmklock" || err "cannot create '$xbmklock'"; :
-}
-
-xbmk_create_pathdirs()
-{
-	remkdir "$XBMK_CACHE/gnupath" "$XBMK_CACHE/xbmkpath"
-	export PATH="$XBMK_CACHE/xbmkpath:$XBMK_CACHE/gnupath:$PATH"
-	(
-	# set up python v3.x in PATH, in case it's not set up correctly.
-	# see code above that detected the correct python3 command.
-	x_ cd "$XBMK_CACHE/xbmkpath"
-	x_ ln -s "`pybin "$python"`" python
-	) || err "Can't set up python symlink in $XBMK_CACHE/xbmkpath"; :
-}
-
 xbmk_child_exec()
 {
 	xbmk_rval=0
diff --git a/include/inject.sh b/include/inject.sh
index d4d20568..74f688a1 100644
--- a/include/inject.sh
+++ b/include/inject.sh
@@ -21,7 +21,7 @@ inject()
 
 	set +u +e
 	[ $# -lt 1 ] && err "No options specified"
-	eval "`setvars "" nukemode new_mac xchanged`"
+	eval "`setvars "" nuke new_mac xchanged`"
 
 	archive="$1";
 	new_mac="xx:xx:xx:xx:xx:xx"
@@ -29,7 +29,7 @@ inject()
 	[ $# -gt 1 ] && case "$2" in
 	nuke)
 		new_mac=""
-		nukemode="nuke" ;;
+		nuke="nuke" ;;
 	setmac)
 		[ $# -gt 2 ] && new_mac="$3" && \
 		    [ -z "$new_mac" ] && err "Empty MAC address specified" ;;
@@ -83,7 +83,7 @@ check_target()
 
 patch_release()
 {
-	[ "$nukemode" = "nuke" ] || x_ ./mk download "$board"
+	[ "$nuke" = "nuke" ] || x_ ./mk download "$board"
 
 	has_hashes="n"
 	tmpromdir="$tmpromdel/bin/$board"
diff --git a/include/lib.sh b/include/lib.sh
index 75de7512..6c831795 100644
--- a/include/lib.sh
+++ b/include/lib.sh
@@ -15,13 +15,17 @@ remkdir()
 
 mkrom_tarball()
 {
-	printf "%s\n" "$version" > "$1/.version" || err "$1 !version"
-	printf "%s\n" "$versiondate" > "$1/.versiondate" || err "$1 !vdate"
-
+	update_xbmkver "$1"
 	mktarball "$1" "${1%/*}/${relname}_${1##*/}.tar.xz"
 	x_ rm -Rf "$1"
 }
 
+update_xbmkver()
+{
+	printf "%s\n" "$version" > "$1/.version" || err "$1 !version"; :
+	printf "%s\n" "$versiondate" > "$1/.versiondate" || err "$1 !vdate"; :
+}
+
 mktarball()
 {
 	printf "Creating tar archive '%s' from directory '%s'\n" "$2" "$1"
diff --git a/include/mrc.sh b/include/mrc.sh
index a132f574..775831f8 100644
--- a/include/mrc.sh
+++ b/include/mrc.sh
@@ -6,16 +6,9 @@
 
 eval "`setvars "" MRC_url MRC_url_bkup MRC_hash MRC_board SHELLBALL`"
 
-extract_mrc()
-{
-	extract_shellball
-	x_ "$cbfstool" "$appdir/"bios.bin extract -n mrc.bin \
-	    -f "$_pre_dest" -r RO_SECTION
-}
-
 extract_refcode()
 {
-	extract_shellball
+	extract_mrc
 
 	# cbfstool after coreboot 4.13 changed the stage file attribute scheme,
 	# and refcode is extracted from an image using the old scheme. we use
@@ -33,7 +26,7 @@ extract_refcode()
 	x_ mv "$appdir/ref" "$_pre_dest"
 }
 
-extract_shellball()
+extract_mrc()
 {
 	chkvars "MRC_board" "CONFIG_MRC_FILE"
 	SHELLBALL="chromeos-firmwareupdate-$MRC_board"
@@ -42,7 +35,10 @@ extract_shellball()
 	x_ cd "$appdir"
 	extract_partition "${MRC_url##*/}"
 	extract_archive "$SHELLBALL" .
-	) || err "mrc download/extract failure"; :
+	) || err "mrc download/extract failure"
+
+	x_ "$cbfstool" "$appdir/"bios.bin extract -n mrc.bin \
+	    -f "${_pre_dest%/*}/mrc.bin" -r RO_SECTION
 }
 
 extract_partition()
diff --git a/include/release.sh b/include/release.sh
index f0799f17..5d6da466 100644
--- a/include/release.sh
+++ b/include/release.sh
@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 # Copyright (c) 2023-2025 Leah Rowe <leah@libreboot.org>
 
-eval "`setvars "" reldir reldest vdir relsrcdir relmode`"
+eval "`setvars "" reldir reldest vdir rsrc relmode`"
 
 release()
 {
@@ -23,15 +23,15 @@ release()
 	    err "already exists: \"$reldest\""
 
 	vdir="$XBMK_CACHE/relpwd/${xbmktmp##*/}/$version"
-	relsrcdir="$vdir/${relname}_src"
+	rsrc="$vdir/${relname}_src"
 
 	remkdir "$vdir"
-	x_ git clone . "$relsrcdir"
+	x_ git clone . "$rsrc"
 
 	prep_release src
 	prep_release tarball
-	prep_release bin
-	x_ rm -Rf "$relsrcdir"
+	[ "$relmode" = "src" ] || prep_release bin
+	x_ rm -Rf "$rsrc"
 
 	x_ mkdir -p "$reldir"
 	x_ mv "$vdir" "$reldir"
@@ -42,9 +42,9 @@ release()
 
 prep_release()
 {
-	x_ touch "$relsrcdir/lock"
+	x_ touch "$rsrc/lock"
 	(
-	[ "$1" = "tarball" ] || x_ cd "$relsrcdir"
+	[ "$1" = "tarball" ] || x_ cd "$rsrc"
 	prep_release_$1
 	) || err "can't prep release $1"
 }
@@ -54,24 +54,30 @@ prep_release_src()
 	x_ ./mk -f
 	fx_ "x_ rm -Rf" x_ find . -name ".git"
 	fx_ "x_ rm -Rf" x_ find . -name ".gitmodules"
-	x_ mv src/docs docs
+	( fx_ nuke x_ find config -type f -name "nuke.list" ) || err; :
+}
+
+nuke()
+{
+	r="$rsrc/src/${1#config/}"
+	[ -d "${r%/*}" ] && x_ cd "${r%/*}" && \
+	    dx_ "eval [ -L \"\$fx\" ] || x_ rm -Rf" "$rsrc/$1"; :
 }
 
 prep_release_tarball()
 {
 	git log --graph --pretty=format:'%Cred%h%Creset %s %Creset' \
-	    --abbrev-commit > "$relsrcdir/CHANGELOG" || err "!log $relsrcdir"
-	x_ rm -f "$relsrcdir/lock"
-	x_ rm -Rf "$relsrcdir/cache" "$relsrcdir/tmp"
+	    --abbrev-commit > "$rsrc/CHANGELOG" || err "!log $rsrc"
+	x_ rm -f "$rsrc/lock"
+	x_ rm -Rf "$rsrc/cache" "$rsrc/tmp"
 	(
-	x_ cd "${relsrcdir%/*}"
-	x_ mktarball "${relsrcdir##*/}" "${relsrcdir##*/}.tar.xz"
+	x_ cd "${rsrc%/*}"
+	x_ mktarball "${rsrc##*/}" "${rsrc##*/}.tar.xz"
 	) || err "can't create src tarball"; :
 }
 
 prep_release_bin()
 {
-	[ "$relmode" = "src" ] && return 0
 	x_ ./mk -d coreboot
 	fx_ "x_ ./mk -b" printf \
 	    "coreboot\npico-serprog\nstm32-vserprog\npcsx-redux\n"
diff --git a/include/vendor.sh b/include/vendor.sh
index 5d7ea82b..2732eade 100644
--- a/include/vendor.sh
+++ b/include/vendor.sh
@@ -38,7 +38,7 @@ eval "`setvars "" has_hashes EC_hash DL_hash DL_url_bkup MRC_refcode_gbe vcfg \
     E6400_VGA_DL_hash E6400_VGA_DL_url E6400_VGA_DL_url_bkup E6400_VGA_offset \
     E6400_VGA_romname SCH5545EC_DL_url_bkup SCH5545EC_DL_hash _dest mecleaner \
     kbc1126_ec_dump MRC_refcode_cbtree _dl SCH5545EC_DL_url EC_url rom DL_url \
-    nukemode cbfstoolref FSPFD_hash _7ztest ME11bootguard ME11delta xromsize \
+    nuke cbfstoolref FSPFD_hash _7ztest ME11bootguard ME11delta xromsize \
     ME11version ME11sku ME11pch _me _metmp mfs TBFW_url_bkup TBFW_url cbdir \
     TBFW_hash TBFW_size hashfile EC_url_bkup FSPM_bin_hash FSPS_bin_hash \
     EC_FW1_hash EC_FW2_hash ME_bin_hash MRC_bin_hash REF_bin_hash _dl_bin \
@@ -136,8 +136,11 @@ fetch()
 	    printf "'%s', '%s': checksum undefined. Check files in '%s'\n" \
 	    "$board" "$_dest" "${_pre_dest%/*}" 1>&2
 	e "$_dest" f not && err "missing file '$_dest', !extract_$dl_type"; :
-	e "$_dest" f && printf "WARNING: '%s' exists but has bad checksum" \
-	    "$_dest"
+	e "$_dest" f && printf "WARNING: '%s' made with bad hash (will rm)\n" \
+	    "$_dest" 1>&2
+	[ -L "$_dest" ] && printf "WARNING: '%s' is a link. Please delete!\n" \
+	    "$_dest" 1>&2
+	[ -L "$_dest" ] || x_ rm -f "$_dest"
 	err "Could not safely extract '$_dest', for board '$board'"
 }
 
@@ -294,13 +297,13 @@ prep()
 	_xrom="$1"
 	_xromname="${1##*/}"
 	_xromnew="${_xrom%/*}/${_xromname#"$vfix"}"
-	[ "$nukemode" = "nuke" ] && _xromnew="${_xrom%/*}/$vfix${_xrom##*/}"
+	[ "$nuke" = "nuke" ] && _xromnew="${_xrom%/*}/$vfix${_xrom##*/}"
 
 	e "$_xrom" f missing && return 0
 	[ -z "${_xromname#"$vfix"}" ] && err "$_xromname / $vfix: name match"
 
 	# Remove the prefix and 1-byte pad
-	if [ "$nukemode" != "nuke" ] && \
+	if [ "$nuke" != "nuke" ] && \
 	    [ "${_xromname#"$vfix"}" != "$_xromname" ]; then
 		xromsize="$(expr $(stat -c '%s' "$_xrom") - 1)" || err "!int"
 		[ $xromsize -lt 524288 ] && err "too small, $xromsize: $_xrom"
@@ -311,32 +314,30 @@ prep()
 		_xrom="$_xromnew"
 	fi
 
-	[ "$nukemode" = "nuke" ] && mksha512sum "$_xrom" "vendorhashes"
+	[ "$nuke" != "nuke" ] || ( mksha512 "$_xrom" "vendorhashes" ) || err
 
 	add_vfiles "$_xrom" || return 1 # if break return, can still change MAC
-	[ "$nukemode" != "nuke" ] && return 0
+	[ "$nuke" != "nuke" ] && return 0
 
 	# Rename the file, prefixing a warning saying not to flash
 	cat "$_xrom" config/data/coreboot/0 > "$_xromnew" || err "!pad $_xrom"
 	x_ rm -f "$_xrom"
 }
 
-mksha512sum()
+mksha512()
 {
-	(
 	[ "${1%/*}" != "$1" ] && x_ cd "${1%/*}"
 	sha512sum ./"${1##*/}" >> "$2" || err "!sha512sum \"$1\" > \"$2\""
-	) || err "failed to create tarball checksum"
 }
 
 add_vfiles()
 {
 	rom="$1"
 
-	if [ "$has_hashes" != "y" ] && [ "$nukemode" != "nuke" ]; then
+	if [ "$has_hashes" != "y" ] && [ "$nuke" != "nuke" ]; then
 		printf "'%s' has no hash file. Skipping.\n" "$archive" 1>&2
 		return 1
-	elif [ "$has_hashes" = "y" ] && [ "$nukemode" = "nuke" ]; then
+	elif [ "$has_hashes" = "y" ] && [ "$nuke" = "nuke" ]; then
 		printf "'%s' has a hash file. Skipping nuke.\n" "$archive" 1>&2
 		return 1
 	fi
@@ -382,14 +383,14 @@ vfile()
 		err "vfile $*, $rom: offset given but empty (undefined)"
 	fi
 
-	[ "$nukemode" = "nuke" ] || x_ e "$_dest" f
+	[ "$nuke" = "nuke" ] || x_ e "$_dest" f
 
 	if [ "$cbfsname" = "IFD" ]; then
-		[ "$nukemode" = "nuke" ] || x_ "$ifdtool" $ifdprefix -i \
+		[ "$nuke" = "nuke" ] || x_ "$ifdtool" $ifdprefix -i \
 		    $_t:$_dest "$rom" -O "$rom"
-		[ "$nukemode" != "nuke" ] || x_ "$ifdtool" $ifdprefix --nuke \
+		[ "$nuke" != "nuke" ] || x_ "$ifdtool" $ifdprefix --nuke \
 		    $_t "$rom" -O "$rom"
-	elif [ "$nukemode" = "nuke" ]; then
+	elif [ "$nuke" = "nuke" ]; then
 		x_ "$cbfstool" "$rom" remove -n "$cbfsname"
 	elif [ "$_t" = "stage" ]; then # the only stage we handle is refcode
 		x_ rm -f "$xbmklocal/refcode"
@@ -406,7 +407,7 @@ vfile()
 check_vendor_hashes()
 {
 	x_ cd "$tmpromdir"
-	[ "$has_hashes" = "n" ] || [ "$nukemode" = "nuke" ] || sha512sum \
+	[ "$has_hashes" = "n" ] || [ "$nuke" = "nuke" ] || sha512sum \
 	    --status -c "$hashfile" || x_ sha1sum --status -c "$hashfile"
 	x_ rm -f "$hashfile"
 }