Important security fix for recovery shell PCRs. 

Configurable release, with major overhaul of /init 

Reproducible build of the Heads firmware works! A clean checkout of this release should produce the following sha256 hashes for the two currently working boards: a7ca26f3b874c52b8284d3d74294fed3937274b699af0b66d50c512455306a9f qemu.rom 83df0b6845fdd6b335119f7e89e08c47ec3566f515fe93bc528fcd955587a43e x230.rom This includes an update to Linux 4.9.7 and coreboot 4.5, and replaces the system libc with musl-libc to ensure that there are no dependencies on the build system's utilities. It still requires reflashing via a hardware SPi programmer and it is still difficult to install Qubes. Hopefully the UX will improve in the next release.

Builds from a clean checkout, has TPM support in coreboot romstage. Measures all files as they are unpacked from CBFS. Fixes SMM uninitialized memory that was causing bad measurements.

Building from clean checkout works 

Images and warning