vendor.sh: Properly verify SHA512SUM on extraction

I currently check the downloaded files e.g. .exe file, but
then I don't check - or even define - sha512sums for the
files extracted from them e.g. me.bin

This patch fixes that. It also caches the hashed files, so
that extraction is faster on a re-run - this makes release
builds go faster, when running ./mk release

If a checksum is not defined, i.e. blank, then a warning is
given, telling you to check a specific directory. This way,
when adding new vendor files, you can add it first without
specifying the checksum, e.g. me.bin checksum. Then you can
manually inspect the files that were extracted, and define it,
then test again.

In a given pkg.cfg for config/vendor, the following variables
are now available for use:

FSPM_bin_hash for fsp m module
FSPS_bin_hash for fsp s module
EC_FW1_hash for KBC1126 EC firmware (1st file)
EC_FW2_hash for KBC1126 EC firmware (2nd file)
ME_bin_hash for me.bin
MRC_bin_hash for mrc.bin (broadwell boards)
REF_bin_hash for refcode (broadwell boards)
SCH5545EC_bin_hash for sch5545 firmware (Dell Precision T1650)
TBFW_bin_hash for Lenovo ThunderBolt firmware (e.g. T480/T480s)
E6400_VGA_bin_hash for Dell E6400 Nvidia VGA ROM

In practise, most people use release archives, and the
inject script, so I knew those were reliable, because the ROM
images were hashed prior to removing files. This patch benefits
people using lbmk.git directly, without using release files,
because now they know they have a valid file e.g. me.bin

Previously, only the download was checked, not the extracted
files, which meant that the only thing preventing a brick was
the code not being buggy. Any number of bugs could pop up in
the future, so this new level of integrity will protect against
such a scenario, and provide early warning prompting bug fixes.

Signed-off-by: Leah Rowe <leah@libreboot.org>

18 files changed, 45 insertions, 0 deletions

diff --git a/config/vendor/3050micro/pkg.cfg b/config/vendor/3050micro/pkg.cfg
index 497a27a6..45ba55d1 100644
--- a/config/vendor/3050micro/pkg.cfg
+++ b/config/vendor/3050micro/pkg.cfg
@@ -3,6 +3,7 @@
 DL_hash="976bbb1e625f64df276d8343757d910c88b8a781f953bc2c41a7dd15184ec70d55f8081de2a0aaa83cddb8e73bdc2df6288fde6e0897e4928c48ca4bb30bea2d"
 DL_url="https://download.asrock.com/BIOS/1151/H110M-DGS(7.30)ROM.zip"
 DL_url_bkup="https://web.archive.org/web/20230822134231/https://download.asrock.com/BIOS/1151/H110M-DGS(7.30)ROM.zip"
+ME_bin_hash="3231ddb79be81f0a631926fc0e533ee7bce2d10032d7d45e56ae8a9894bcf9b4ca0b4f6fd3bc4daa185a464e771e0bf3d1b771a3180739b6896cec911758145b"
 
 # for Fsp.fd, we don't rely on a download. Instead,
 # we copy from coreboot.git. The file is defined
@@ -10,6 +11,8 @@ DL_url_bkup="https://web.archive.org/web/20230822134231/https://download.asrock.
 # and inserted to CBFS with names CONFIG_FSP_S_CBFS and CONFIG_FSP_M_CBFS
 #
 FSPFD_hash="c500166a8553a80ba8db8b8185a896e0ae1562ea3c139e07acd9e7937baf8110ba743cc79b69db09a5f39c076d1d22bc45045223975f46aea2034ba82a6b0360"
+FSPM_bin_hash="b15712a53f4d16f36b384beb6dbb716c0b0924751d6ca1e229cd4b8c03aef9eda025c235af247e53dac94d94b79559623974d0d21c7f97e125d8ecc2c86bf03f"
+FSPS_bin_hash="64ac9f93e43efddc35931e168d6594c2b39fb5a0da863d22f2d000d7eacc0692b07ce89389cbb1c5b95ff9b2bba508c538e37d0e644fcab7b2cada773da65ce6"
 
 # We will use deguard to disable the Intel Boot Guard:
 ME11bootguard="y"
diff --git a/config/vendor/e6400/pkg.cfg b/config/vendor/e6400/pkg.cfg
index c5962480..21d1e69d 100644
--- a/config/vendor/e6400/pkg.cfg
+++ b/config/vendor/e6400/pkg.cfg
@@ -1,6 +1,7 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 
 E6400_VGA_DL_hash="6217d5fce2291d15bb0649fd2faaeb78e4c48962b07a2bea6af60466bfdc5f233af0d077c2c6e71dd96047bdbb1f612324cef0a5e728ba9a9ec5c69a4022cd8d"
+E6400_VGA_bin_hash="24fb3d934afca13bd2b43ec958aa2f69654e0f8ee2dd6ca910350a738dea22cfd7f69626093e047566b27c0dd9f3595beeacaad7812fc7f6a13970e49e7b60f3"
 E6400_VGA_DL_url="https://dl.dell.com/FOLDER01530530M/1/E6400A34.exe"
 E6400_VGA_DL_url_bkup="https://web.archive.org/web/20230506014903/https://dl.dell.com/FOLDER01530530M/1/E6400A34.exe"
 E6400_VGA_offset="274451"
diff --git a/config/vendor/haswell/pkg.cfg b/config/vendor/haswell/pkg.cfg
index e9722a11..401736b5 100644
--- a/config/vendor/haswell/pkg.cfg
+++ b/config/vendor/haswell/pkg.cfg
@@ -1,5 +1,6 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 
 DL_hash="f3d79aec805c8b0094a4081be76b3a22d329c479ad18210449b7acc3236ccfc4a2103eaa7c5b79a4872bfd699eede047efd46dfb06dc8f47e3216fc254612998"
+ME_bin_hash="8629caded7efd2aa234cc378b7118f0d300402537b8aff6aa3d9b895c6b14590a79cb02d1db7a91de36d36f5612386fc99ddcb57c9d78b1e75b5864e68763de1"
 DL_url="https://download.lenovo.com/pccbbs/mobiles/glrg22ww.exe"
 DL_url_bkup="https://web.archive.org/web/20211120031520/https://download.lenovo.com/pccbbs/mobiles/glrg22ww.exe"
diff --git a/config/vendor/hp2170p/pkg.cfg b/config/vendor/hp2170p/pkg.cfg
index 77cbd08b..192bcf41 100644
--- a/config/vendor/hp2170p/pkg.cfg
+++ b/config/vendor/hp2170p/pkg.cfg
@@ -1,8 +1,11 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 
 DL_hash="4dc908050c91c1227645c900ddee88652937540af4ba222b0239b7f459f260cdf6e5e8113ac14e5543d00cf53abdd6c7bd23e61f690de1ce45a3709a30cbb91c"
+ME_bin_hash="672240d231a723ea7fac112262fdc28884c43a5be9b231dfae838c7a1edc86140da38983079d23ab5ac8e6c74611b65da4872ecbab3ec979c680d3f526eb91ed"
 DL_url="https://download.lenovo.com/pccbbs/mobiles/g1rg24ww.exe"
 DL_url_bkup="https://web.archive.org/web/20210706183911/https://download.lenovo.com/pccbbs/mobiles/g1rg24ww.exe"
 EC_hash="940e533b6a276c13a6e46a93795ca84b19877b05e82c0c1795b7fea9cbea63c28e606ef994352fc77c4fdfb2e0c31c5edeefa98b989e1990364dfc6417b25460"
 EC_url="https://ftp.hp.com/pub/softpaq/sp96001-96500/sp96088.exe"
 EC_url_bkup="https://web.archive.org/web/20230909164345/https://ftp.hp.com/pub/softpaq/sp96001-96500/sp96088.exe"
+EC_FW1_hash="44a27359e8e2ecfae910a754617d5ee947d6bba976f2eb53114a97c71b64813da7ab4223749706c9bbcaf1e752c190834ee3b41c297c191b3cac200814e02938"
+EC_FW2_hash="09c5b8bab6f258a0303ac502b4900cd4277bd6c43bfd2ef0030df6e918ef3300d04d2979373f8b05f77d1eae1c27ebd01856426b8eed6f215e1fcaed68e0977e"
diff --git a/config/vendor/hp2560p/pkg.cfg b/config/vendor/hp2560p/pkg.cfg
index f7c7cd14..52b9394d 100644
--- a/config/vendor/hp2560p/pkg.cfg
+++ b/config/vendor/hp2560p/pkg.cfg
@@ -1,8 +1,11 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 
 DL_hash="81c9917938c4a2a4f128c976250451931efd0f25b51ff34f058ddacb8eec27272691371864a683ec7abcb924fea32592d061584c7b2571a5d3e84eb870281cc3"
+ME_bin_hash="6a7eb169a01581682a2ecf4b284c1689eb7746cc80aa16ea1ce35d1a1c47a92664b5240defd62535e9707c3f3d42abfb62da3254b97e569de178099f7683c858"
 DL_url="https://download.lenovo.com/ibmdl/pub/pc/pccbbs/mobiles/83rf46ww.exe"
 DL_url_bkup="https://web.archive.org/web/20220202201637/https://download.lenovo.com/ibmdl/pub/pc/pccbbs/mobiles/83rf46ww.exe"
 EC_hash="a602cc7627c569bc423a5857cf506fbc3bcd68cb6b43a7c1b99d12a569b4107c412748cf49605ef4d5b930eb14b6815c4d1b1dc20145fe9d707e445fc201cea2"
 EC_url="https://ftp.hp.com/pub/softpaq/sp85501-86000/sp85526.exe"
 EC_url_bkup="https://web.archive.org/web/20230416125725/https://ftp.hp.com/pub/softpaq/sp85501-86000/sp85526.exe"
+EC_FW1_hash="44a27359e8e2ecfae910a754617d5ee947d6bba976f2eb53114a97c71b64813da7ab4223749706c9bbcaf1e752c190834ee3b41c297c191b3cac200814e02938"
+EC_FW2_hash="a05c1eb5433f43e035327d0ae74e9dbd09ecb45f00be656e477ebd5b505ca21bae820e90c29483c4c641591fdd2aebb6b6ea0ecfb879b506bc1a657c01a21bd2"
diff --git a/config/vendor/hp2570p/pkg.cfg b/config/vendor/hp2570p/pkg.cfg
index 9f1a85aa..1df49d73 100644
--- a/config/vendor/hp2570p/pkg.cfg
+++ b/config/vendor/hp2570p/pkg.cfg
@@ -1,8 +1,11 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 
 DL_hash="4dc908050c91c1227645c900ddee88652937540af4ba222b0239b7f459f260cdf6e5e8113ac14e5543d00cf53abdd6c7bd23e61f690de1ce45a3709a30cbb91c"
+ME_bin_hash="672240d231a723ea7fac112262fdc28884c43a5be9b231dfae838c7a1edc86140da38983079d23ab5ac8e6c74611b65da4872ecbab3ec979c680d3f526eb91ed"
 DL_url="https://download.lenovo.com/pccbbs/mobiles/g1rg24ww.exe"
 DL_url_bkup="https://web.archive.org/web/20210706183911/https://download.lenovo.com/pccbbs/mobiles/g1rg24ww.exe"
 EC_hash="61ed284bdf938c5f36ad3267263fb3963a6608339425bc41aaef3ab0cd98f07c998d816b0233735ca35dc6cb771257da3f09a40d5cfc96bb6388b4366348275e"
 EC_url="https://ftp.hp.com/pub/softpaq/sp96001-96500/sp96085.exe"
 EC_url_bkup="https://web.archive.org/web/20230610174558/https://ftp.hp.com/pub/softpaq/sp96001-96500/sp96085.exe"
+EC_FW1_hash="44a27359e8e2ecfae910a754617d5ee947d6bba976f2eb53114a97c71b64813da7ab4223749706c9bbcaf1e752c190834ee3b41c297c191b3cac200814e02938"
+EC_FW2_hash="d4afcad4960253af674f1dcd3a5a044444b7fcfbaa2a993f976997966b579a80d8a1c58b0ed0a47d862312ad81e433834bb1992c79f69d858d8c00e8cd62e1fb"
diff --git a/config/vendor/hp8200sff/pkg.cfg b/config/vendor/hp8200sff/pkg.cfg
index 9d0a34de..dba0b354 100644
--- a/config/vendor/hp8200sff/pkg.cfg
+++ b/config/vendor/hp8200sff/pkg.cfg
@@ -1,5 +1,6 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 
 DL_hash="8fcb691bf84dc1feefc3c84f7cc59eadaabb200477bb3ecba1b050f23f133b0a8c2539015a523f676544c2dff64599bcba7e844e8c31757b90d70bb4485b5664"
+ME_bin_hash="732954bd288a7d7de3b779032476e2bd5a6f64b6971ff3053434d49ab55fd514db9f224e83883215646e50eecf4ecbdb69a65d5957d241e1146424053dd3ba91"
 DL_url="https://ftp.ext.hp.com/pub/softpaq/sp96001-96500/sp96026.exe"
 DL_url_bkup="https://web.archive.org/web/20220708171920/https://ftp.ext.hp.com/pub/softpaq/sp96001-96500/sp96026.exe"
diff --git a/config/vendor/hp820g2/pkg.cfg b/config/vendor/hp820g2/pkg.cfg
index 308148c5..4a2fdbb3 100644
--- a/config/vendor/hp820g2/pkg.cfg
+++ b/config/vendor/hp820g2/pkg.cfg
@@ -1,6 +1,7 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 
 DL_hash="1ac05a3e4f46426eeb77f89c4aca25ed1ad64479d8fcba6a3ab63a944512bacbc5d148cc7b9c4ff4b8c90a1fb1de4776e46f14aca8021900e0df37246aa0b717"
+ME_bin_hash="ca754e2fd09eb48bc14b2d1b19d3fa3ed1df2297cff2b7d9b68e9002812e745a59a8ca921f26834ae84c0076c64d8dfab75ce113b50e4badafbfb8ab6c14ad2b"
 DL_url="https://download.lenovo.com/pccbbs/mobiles/n10rg50w.exe"
 DL_url_bkup="https://download.lenovo.com/pccbbs/mobiles/n10rg50w.exe"
 MRC_url="https://dl.google.com/dl/edgedl/chromeos/recovery/chromeos_13904.77.0_samus_recovery_stable-channel_mp-v3.bin.zip"
@@ -9,3 +10,5 @@ MRC_hash="3ff1599c52539f0707a07a8664a84ce51cd3fed1569df4bb7aa6722fc8dec0af175425
 MRC_board="samus"
 MRC_refcode_cbtree="fam15h"
 MRC_refcode_gbe="131253"
+MRC_bin_hash="cade33e8664fb92ebb6ce0c92b572f587f047b2832babb6bd30eb221dba76b08d578e189ba1f89cdb4c956aecd092ebd7443adbc30cf3800452b906967cedc11"
+REF_bin_hash="7efa3bdc48d548924b4c57bbadc99a7add91ac8c5eb7f8f98874c2f8583ca0e71e99997186aaf2714c8ca56593e12c80c1aa9e727a462ef9d2c36963042e7d56"
diff --git a/config/vendor/hp8460pintel/pkg.cfg b/config/vendor/hp8460pintel/pkg.cfg
index 1e1da34e..1140e5c9 100644
--- a/config/vendor/hp8460pintel/pkg.cfg
+++ b/config/vendor/hp8460pintel/pkg.cfg
@@ -1,8 +1,11 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 
 DL_hash="81c9917938c4a2a4f128c976250451931efd0f25b51ff34f058ddacb8eec27272691371864a683ec7abcb924fea32592d061584c7b2571a5d3e84eb870281cc3"
+ME_bin_hash="6a7eb169a01581682a2ecf4b284c1689eb7746cc80aa16ea1ce35d1a1c47a92664b5240defd62535e9707c3f3d42abfb62da3254b97e569de178099f7683c858"
 DL_url="https://download.lenovo.com/ibmdl/pub/pc/pccbbs/mobiles/83rf46ww.exe"
 DL_url_bkup="https://web.archive.org/web/20220202201637/https://download.lenovo.com/ibmdl/pub/pc/pccbbs/mobiles/83rf46ww.exe"
 EC_hash="9be5511d7ba07a376583cbd0b7fa4d7dff87ebc94b78d489fd62a14cb7f61eac99670e6a10ce374fe8e3c4bdafabbd1edce7774c3a482c15c2d4207b74ea49ed"
 EC_url="https://ftp.hp.com/pub/softpaq/sp85501-86000/sp85528.exe"
 EC_url_bkup="https://web.archive.org/web/20211231004901/https://ftp.ext.hp.com/pub/softpaq/sp85501-86000/sp85528.exe"
+EC_FW1_hash="44a27359e8e2ecfae910a754617d5ee947d6bba976f2eb53114a97c71b64813da7ab4223749706c9bbcaf1e752c190834ee3b41c297c191b3cac200814e02938"
+EC_FW2_hash="8eba6e0087e42a2f552de3367639b376501d31e8ae1629846496c3eb46ed7d2f9b46531dc245cc2ce5f4a91047fe84a37b350864cdc37530148f456818c0133e"
diff --git a/config/vendor/hp8470pintel/pkg.cfg b/config/vendor/hp8470pintel/pkg.cfg
index 1170f56b..db0b6e69 100644
--- a/config/vendor/hp8470pintel/pkg.cfg
+++ b/config/vendor/hp8470pintel/pkg.cfg
@@ -1,8 +1,11 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 
 DL_hash="4dc908050c91c1227645c900ddee88652937540af4ba222b0239b7f459f260cdf6e5e8113ac14e5543d00cf53abdd6c7bd23e61f690de1ce45a3709a30cbb91c"
+ME_bin_hash="672240d231a723ea7fac112262fdc28884c43a5be9b231dfae838c7a1edc86140da38983079d23ab5ac8e6c74611b65da4872ecbab3ec979c680d3f526eb91ed"
 DL_url="https://download.lenovo.com/pccbbs/mobiles/g1rg24ww.exe"
 DL_url_bkup="https://web.archive.org/web/20210706183911/https://download.lenovo.com/pccbbs/mobiles/g1rg24ww.exe"
 EC_hash="b95c9cf909ed537fb448e2be69eddcb57459efbaf0a979a73cd2bce90a7014b110f4dbbeecfd596c072636396b8f20c229c59ffe34e45500ce9edb000c6ccaf9"
 EC_url="https://ftp.hp.com/pub/softpaq/sp77501-78000/sp77818.exe"
 EC_url_bkup="https://web.archive.org/web/20230909173821/https://ftp.hp.com/pub/softpaq/sp77501-78000/sp77818.exe"
+EC_FW1_hash="44a27359e8e2ecfae910a754617d5ee947d6bba976f2eb53114a97c71b64813da7ab4223749706c9bbcaf1e752c190834ee3b41c297c191b3cac200814e02938"
+EC_FW2_hash="d7a44b682b1dae7f3cbcc34646b3dd80895a7e2132ab0292b3d42ccf54a9fa447773f7e8e914b0c427adaaad8aa54224e7e146dc72280cf04093956727f41a03"
diff --git a/config/vendor/hp8560w/pkg.cfg b/config/vendor/hp8560w/pkg.cfg
index 629d96d1..224b448c 100644
--- a/config/vendor/hp8560w/pkg.cfg
+++ b/config/vendor/hp8560w/pkg.cfg
@@ -1,8 +1,11 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 
 DL_hash="81c9917938c4a2a4f128c976250451931efd0f25b51ff34f058ddacb8eec27272691371864a683ec7abcb924fea32592d061584c7b2571a5d3e84eb870281cc3"
+ME_bin_hash="6a7eb169a01581682a2ecf4b284c1689eb7746cc80aa16ea1ce35d1a1c47a92664b5240defd62535e9707c3f3d42abfb62da3254b97e569de178099f7683c858"
 DL_url="https://download.lenovo.com/ibmdl/pub/pc/pccbbs/mobiles/83rf46ww.exe"
 DL_url_bkup="https://web.archive.org/web/20220202201637/https://download.lenovo.com/ibmdl/pub/pc/pccbbs/mobiles/83rf46ww.exe"
 EC_hash="8e2bc5dca1a1cf0cfc1ac9df74eb6fda333f8ae560019f8182a49d3a716d72938f6cde4aa5ee56942def08207d3ef95706653bd238768fd029da43e9a4fbcc67"
 EC_url="https://ftp.hp.com/pub/softpaq/sp78001-78500/sp78085.exe"
 EC_url_bkup="https://web.archive.org/web/20230402085323/https://ftp.hp.com/pub/softpaq/sp78001-78500/sp78085.exe"
+EC_FW1_hash="44a27359e8e2ecfae910a754617d5ee947d6bba976f2eb53114a97c71b64813da7ab4223749706c9bbcaf1e752c190834ee3b41c297c191b3cac200814e02938"
+EC_FW2_hash="82882406167e7df8ff90d2ea8d93adee59c3e8eb034b6dfcd0ff70cadf8ab3e5acee7262dd344560e118d00b010ed13c18539b042dae0b4b4e6a2c09402aadc4"
diff --git a/config/vendor/hp9470m/pkg.cfg b/config/vendor/hp9470m/pkg.cfg
index 9cdb8143..46f1349b 100644
--- a/config/vendor/hp9470m/pkg.cfg
+++ b/config/vendor/hp9470m/pkg.cfg
@@ -1,8 +1,11 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 
 DL_hash="4dc908050c91c1227645c900ddee88652937540af4ba222b0239b7f459f260cdf6e5e8113ac14e5543d00cf53abdd6c7bd23e61f690de1ce45a3709a30cbb91c"
+ME_bin_hash="672240d231a723ea7fac112262fdc28884c43a5be9b231dfae838c7a1edc86140da38983079d23ab5ac8e6c74611b65da4872ecbab3ec979c680d3f526eb91ed"
 DL_url="https://download.lenovo.com/pccbbs/mobiles/g1rg24ww.exe"
 DL_url_bkup="https://web.archive.org/web/20210706183911/https://download.lenovo.com/pccbbs/mobiles/g1rg24ww.exe"
 EC_hash="563422bf5420da18b89439f28a38ea28a175f0ad3588f0f5ea39b08dfdd14c8d513cbf11c2125ec3869fc3b7222c7dc3d111415185ea9b73f41410b1b57f13bd"
 EC_url="https://ftp.hp.com/pub/softpaq/sp96001-96500/sp96090.exe"
 EC_url_bkup="http://web.archive.org/web/20220504072602/https://ftp.ext.hp.com/pub/softpaq/sp96001-96500/sp96090.exe"
+EC_FW1_hash="44a27359e8e2ecfae910a754617d5ee947d6bba976f2eb53114a97c71b64813da7ab4223749706c9bbcaf1e752c190834ee3b41c297c191b3cac200814e02938"
+EC_FW2_hash="0d7b446fda5e5cde9570b6df15e4c0ad6b9fad6b425f498669d91bccb4a4bb9a8d22d20f4adb9f116e38df6db3519aae14a6d8fd8cb3075c93ce7c5ae0d8eacb"
diff --git a/config/vendor/ivybridge/pkg.cfg b/config/vendor/ivybridge/pkg.cfg
index d9b2200b..3b3d1091 100644
--- a/config/vendor/ivybridge/pkg.cfg
+++ b/config/vendor/ivybridge/pkg.cfg
@@ -1,5 +1,6 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 
 DL_hash="4dc908050c91c1227645c900ddee88652937540af4ba222b0239b7f459f260cdf6e5e8113ac14e5543d00cf53abdd6c7bd23e61f690de1ce45a3709a30cbb91c"
+ME_bin_hash="672240d231a723ea7fac112262fdc28884c43a5be9b231dfae838c7a1edc86140da38983079d23ab5ac8e6c74611b65da4872ecbab3ec979c680d3f526eb91ed"
 DL_url="https://download.lenovo.com/pccbbs/mobiles/g1rg24ww.exe"
 DL_url_bkup="https://web.archive.org/web/20210706183911/https://download.lenovo.com/pccbbs/mobiles/g1rg24ww.exe"
diff --git a/config/vendor/sandybridge/pkg.cfg b/config/vendor/sandybridge/pkg.cfg
index bb022043..c243413f 100644
--- a/config/vendor/sandybridge/pkg.cfg
+++ b/config/vendor/sandybridge/pkg.cfg
@@ -1,5 +1,6 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 
 DL_hash="81c9917938c4a2a4f128c976250451931efd0f25b51ff34f058ddacb8eec27272691371864a683ec7abcb924fea32592d061584c7b2571a5d3e84eb870281cc3"
+ME_bin_hash="6a7eb169a01581682a2ecf4b284c1689eb7746cc80aa16ea1ce35d1a1c47a92664b5240defd62535e9707c3f3d42abfb62da3254b97e569de178099f7683c858"
 DL_url="https://download.lenovo.com/ibmdl/pub/pc/pccbbs/mobiles/83rf46ww.exe"
 DL_url_bkup="https://web.archive.org/web/20220202201637/https://download.lenovo.com/ibmdl/pub/pc/pccbbs/mobiles/83rf46ww.exe"
diff --git a/config/vendor/t1650/pkg.cfg b/config/vendor/t1650/pkg.cfg
index f994b942..47303884 100644
--- a/config/vendor/t1650/pkg.cfg
+++ b/config/vendor/t1650/pkg.cfg
@@ -1,8 +1,10 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 
 DL_hash="4dc908050c91c1227645c900ddee88652937540af4ba222b0239b7f459f260cdf6e5e8113ac14e5543d00cf53abdd6c7bd23e61f690de1ce45a3709a30cbb91c"
+ME_bin_hash="672240d231a723ea7fac112262fdc28884c43a5be9b231dfae838c7a1edc86140da38983079d23ab5ac8e6c74611b65da4872ecbab3ec979c680d3f526eb91ed"
 DL_url="https://download.lenovo.com/pccbbs/mobiles/g1rg24ww.exe"
 DL_url_bkup="https://web.archive.org/web/20210706183911/https://download.lenovo.com/pccbbs/mobiles/g1rg24ww.exe"
 SCH5545EC_DL_url="https://dl.dell.com/FOLDER05065992M/1/T1650A28.exe"
 SCH5545EC_DL_url_bkup="https://web.archive.org/web/20230811151654/https://dl.dell.com/FOLDER05065992M/1/T1650A28.exe"
 SCH5545EC_DL_hash="18261d0f7f27e9de3b0b5a25019b9a934ef1a61cd3f0140e34f38553695e91e671e227a8fa962774edceab5c7804d13ed9fe1c518c5643c7c8f15632f903a6c4"
+SCH5545EC_bin_hash="51d9540f73c60ba5e245a8a98c2215d477d3bad9759f1dae94a4fe63652421d8552406817c2482dd6ee3bb55d942bbc0315eab54095544d7956e73112e2d8483"
diff --git a/config/vendor/t1700/pkg.cfg b/config/vendor/t1700/pkg.cfg
index cc100683..979dd7bf 100644
--- a/config/vendor/t1700/pkg.cfg
+++ b/config/vendor/t1700/pkg.cfg
@@ -1,9 +1,11 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 
 DL_hash="f3d79aec805c8b0094a4081be76b3a22d329c479ad18210449b7acc3236ccfc4a2103eaa7c5b79a4872bfd699eede047efd46dfb06dc8f47e3216fc254612998"
+ME_bin_hash="8629caded7efd2aa234cc378b7118f0d300402537b8aff6aa3d9b895c6b14590a79cb02d1db7a91de36d36f5612386fc99ddcb57c9d78b1e75b5864e68763de1"
 DL_url="https://download.lenovo.com/pccbbs/mobiles/glrg22ww.exe"
 DL_url_bkup="https://web.archive.org/web/20211120031520/https://download.lenovo.com/pccbbs/mobiles/glrg22ww.exe"
 MRC_url="https://dl.google.com/dl/edgedl/chromeos/recovery/chromeos_13904.77.0_samus_recovery_stable-channel_mp-v3.bin.zip"
 MRC_url_bkup="https://web.archive.org/web/20220310155922/https://dl.google.com/dl/edgedl/chromeos/recovery/chromeos_13904.77.0_samus_recovery_stable-channel_mp-v3.bin.zip"
 MRC_hash="3ff1599c52539f0707a07a8664a84ce51cd3fed1569df4bb7aa6722fc8dec0af1754250333b6ca1a9794d970a4de7b29a5cf2499f5b61e4c3eab64d1314aaea9"
+MRC_bin_hash="cade33e8664fb92ebb6ce0c92b572f587f047b2832babb6bd30eb221dba76b08d578e189ba1f89cdb4c956aecd092ebd7443adbc30cf3800452b906967cedc11"
 MRC_board="samus"
diff --git a/config/vendor/t480/pkg.cfg b/config/vendor/t480/pkg.cfg
index 3071f83d..90c31b75 100644
--- a/config/vendor/t480/pkg.cfg
+++ b/config/vendor/t480/pkg.cfg
@@ -2,6 +2,7 @@
 
 # ME firmware (deguard will be used)
 DL_hash="df735a24242792bf4150f30bf0bd4fdbdc0fb6bf0f897ea533df32567be8e084006d692fb6351677f8cc976878c5018667901dbd407b0a77805754f7c101497c"
+ME_bin_hash="fad8bcd2ea2ae9d1a2a1e223f499f15ada0787feb600eab3201669f82b7ade0741194fa86448eff57d7f68c8ebbfc1bf266b4d68aca509ee48db258902a805e7"
 DL_url="https://dl.dell.com/FOLDER04573471M/1/Inspiron_5468_1.3.0.exe"
 DL_url_bkup="https://web.archive.org/web/20241110222323/https://dl.dell.com/FOLDER04573471M/1/Inspiron_5468_1.3.0.exe"
 
@@ -11,6 +12,8 @@ DL_url_bkup="https://web.archive.org/web/20241110222323/https://dl.dell.com/FOLD
 # and inserted to CBFS with names CONFIG_FSP_S_CBFS and CONFIG_FSP_M_CBFS
 #
 FSPFD_hash="c500166a8553a80ba8db8b8185a896e0ae1562ea3c139e07acd9e7937baf8110ba743cc79b69db09a5f39c076d1d22bc45045223975f46aea2034ba82a6b0360"
+FSPM_bin_hash="b15712a53f4d16f36b384beb6dbb716c0b0924751d6ca1e229cd4b8c03aef9eda025c235af247e53dac94d94b79559623974d0d21c7f97e125d8ecc2c86bf03f"
+FSPS_bin_hash="64ac9f93e43efddc35931e168d6594c2b39fb5a0da863d22f2d000d7eacc0692b07ce89389cbb1c5b95ff9b2bba508c538e37d0e644fcab7b2cada773da65ce6"
 
 # We will use deguard to disable the Intel Boot Guard:
 ME11bootguard="y"
@@ -27,3 +30,4 @@ TBFW_url="https://download.lenovo.com/pccbbs/mobiles/n24th13w.exe"
 TBFW_url_bkup="https://web.archive.org/web/20241004165955/https://download.lenovo.com/pccbbs/mobiles/n24th13w.exe"
 TBFW_hash="906d916e8ae77e6d146c67c3113cd904e735a7f28cb2fc37e2284758ead5cda8dd4025c1c741fac9162b1eb01cff08fc39a0d4e79c5cec0515f1d3e6447d1323"
 TBFW_size=1048576 # size in bytes, when padding, matching TBFW's flash IC
+TBFW_bin_hash="15aea269e79d92fe651fe613e30febee5459786169f647e5f321b7382892cf2b8fc61aa1afb8a04d0369b71579de54763272ba144673fbfadfefeb384d45c293"
diff --git a/config/vendor/t480s/pkg.cfg b/config/vendor/t480s/pkg.cfg
index a9e3e48b..4c1eeaf1 100644
--- a/config/vendor/t480s/pkg.cfg
+++ b/config/vendor/t480s/pkg.cfg
@@ -1,6 +1,8 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 
+# ME firmware (deguard will be used)
 DL_hash="df735a24242792bf4150f30bf0bd4fdbdc0fb6bf0f897ea533df32567be8e084006d692fb6351677f8cc976878c5018667901dbd407b0a77805754f7c101497c"
+ME_bin_hash="1c77371187ef64e719debc75f606c78fc063b8a84f2704f3fa45e9e4d8a9bccec50420d262bbfbc0dd1695e038698b10113a1bc532a33b943321cd0811e40786"
 DL_url="https://dl.dell.com/FOLDER04573471M/1/Inspiron_5468_1.3.0.exe"
 DL_url_bkup="https://web.archive.org/web/20241110222323/https://dl.dell.com/FOLDER04573471M/1/Inspiron_5468_1.3.0.exe"
 
@@ -10,6 +12,8 @@ DL_url_bkup="https://web.archive.org/web/20241110222323/https://dl.dell.com/FOLD
 # and inserted to CBFS with names CONFIG_FSP_S_CBFS and CONFIG_FSP_M_CBFS
 #
 FSPFD_hash="c500166a8553a80ba8db8b8185a896e0ae1562ea3c139e07acd9e7937baf8110ba743cc79b69db09a5f39c076d1d22bc45045223975f46aea2034ba82a6b0360"
+FSPM_bin_hash="b15712a53f4d16f36b384beb6dbb716c0b0924751d6ca1e229cd4b8c03aef9eda025c235af247e53dac94d94b79559623974d0d21c7f97e125d8ecc2c86bf03f"
+FSPS_bin_hash="64ac9f93e43efddc35931e168d6594c2b39fb5a0da863d22f2d000d7eacc0692b07ce89389cbb1c5b95ff9b2bba508c538e37d0e644fcab7b2cada773da65ce6"
 
 # We will use deguard to disable the Intel Boot Guard:
 ME11bootguard="y"
@@ -26,3 +30,4 @@ TBFW_url="https://download.lenovo.com/pccbbs/mobiles/n22th11w.exe"
 TBFW_url_bkup="https://web.archive.org/web/20230319003752/https://download.lenovo.com/pccbbs/mobiles/n22th11w.exe"
 TBFW_hash="ef8ec0a41d7faaa0ce514cfb6f8e7e10669c878eff69fbe1b821443b6218f5b31e1b910c8abceecf38d4b11a6e552d90f277c96c7a9c512d605c8b8aea9c1c0c"
 TBFW_size=1048576 # size in bytes, when padding, matching TBFW's flash IC
+TBFW_bin_hash="41672f3ccdbf7a39ffd7d94c5cfb16efd2911be7b980feaa88b0f33777bd679eafdb97019a9c7b1d32cf76297ba0cb81d5b36072f6be96cec2834011249984db"