[Matt Devo]

Okay, this information is new to me. I was under the impression that by activating the screw and therefore the SPI flash chip write-protect pin you would get a full 100% hardware write protection. Do you perhaps know which flash chip is in use by an Asus Chromebox CN60 so I can check the datasheet? Thanks.

the flash chip is a Winbond W25Q64FV IIRC, but that datasheet won't help much, as the layout of the flash is largely dictated by the firmware itself. You never want 100% write protection with these kinds of systems as there is always some data which needs to be written. Even the stock firmware only write-protects a few small regions of the chip (teh details of which are on the firmware page of my website).

I'll stick with Tianocore image for now, but I've heard people in #coreboot on Freenode mention that there were some patches available for GRUB2 to implement boot verification, however you'd need to use GRUB2 as the coreboot payload to do so. I don't know how well this is supported on a chromebox, but I will try to experiment once I get more into coreboot. *bbl*

it's a perfectly viable option if building your own firmware for personal use, but less so if distributing general purpose firmware for others to use

I'll try it out. By the way, do you know what happens when grub receives an update via the sysupgrade option i.e. by running "apt-get dist-upgrade"? Is there a mechanism that automatically updates the BOOTX64.efi file or do I have to copy and overwrite the file manually each time?

if the OS normally installs grub (or whatever bootloader) to bootx64.efi, then it gets updated normally. If it nromally installs to (eg) /efi/ubuntu/grubx64.efi, then you would need to manually copy that, but IME that file itself isn't updated all that often since it's just a stub