See design doc: go/verify-ro-firmware (option 1)

Device to test (aka DUT) is plugged into a second one (aka host) via USB-C debug cable.

Open a crosh shell on the host.

Type 'verify-other-chromebook' or something like that.

This uses the Cr50 serial console provided by the DUT to enter debug commands which hash the RO firmware.

Script needs to get the BoardID from the DUT so it knows what to check, and a table of BoardID to offset/length/hash for the right answer.  May be multiple possible right answers for a board, if we shipped multiple RO firmware over time.

Script prints:

DEVICE NOT FOUND (didn't find a device attached via debug cable)

PASS (device found in list and all hashed sections valid).

FAIL (device found in list and not all hashed sections valid).

UNKNOWN DEVICE (not found in list)

We could get fancier with a Chrome extension, but let's start with crosh because it'll take less time to develop.