I think I have an answer to this - actually one of the maintainers of the GitHub repo for Raspberry Pi firmware has answered your question. The Q&A is here.

The answer is not as detailed as I would have liked, but to my reading, it seems there is one repo to house the compiled/binary firmware for Raspberry Pi, and another repo to house the source code. The compiled/binary Raspberry Pi firmware is housed on the GitHub repo linked above. The repo containing the source code for the Raspberry Pi firmware is "unpublished/closed-source". The Wiki page for the Raspberry Pi (compiled) firmware repo tells the same story.

And so the answer seems to be this:

• The 160-bit hash reported by vcgencmd is the hash of the firmware's source code - source code that is housed in an unpublished/closed-source repo.

• The 160-bit hash in the release notes is the hash of the compiled/binary firmware repo hosted on GitHub.

• Consequently, the release/commit date is all you have to rely upon. The dates are at least close - I assume there may be a time lag between committing the source files, and committing the binaries since they occur on different repos.

I think I have an answer to this - actually one of the maintainers of the GitHub repo for Raspberry Pi firmware has answered your question. The Q&A is #1407 under the GitHub Issues tab.

The answer is not as detailed as I would have liked, but to my reading, it seems there is one repo to house the compiled/binary firmware for Raspberry Pi, and another repo to house the source code. The compiled/binary Raspberry Pi firmware is housed on the GitHub repo linked above. The repo containing the source code for the Raspberry Pi firmware is "unpublished/closed-source". The Wiki page for the Raspberry Pi (compiled) firmware repo tells the same story.

And so the answer seems to be this:

• The 160-bit hash reported by vcgencmd is the hash of the firmware's source code - source code that is housed in an unpublished/closed-source repo.

• The 160-bit hash in the release notes is the hash of the compiled/binary firmware repo hosted on GitHub.

• Consequently, the release/commit date is all you have to rely upon. The dates are at least close - I assume there may be a time lag between committing the source files, and committing the binaries since they occur on different repos.

Finally, there's a related Q&A here... this question has been around for a while.

I think I have an answer to this - actually one of the maintainers of the GitHub repo for Raspberry Pi firmware has answered your question. The Q&A is here.

The answer is not as detailed as I would have liked, but to my reading, it seems there is one repo to house the compiled/binary firmware for Raspberry Pi, and another repo to house the source code. The compiled/binary Raspberry Pi firmware is housed on the GitHub repo linked above. The repo containing the source code for the Raspberry Pi firmware is "unpublished/closed-source". The Wiki page for the Raspberry Pi (compiled) firmware repo tells the same story.

And so the answer seems to be this:

• The 160-bit hash reported by vcgencmd is the hash of the firmware's source code - source code that is housed in an unpublished/closed-source repo.

• The 160-bit hash in the release notes is the hash of the compiled/binary firmware repo hosted on GitHub.

I think I have an answer to this - actually one of the maintainers of the GitHub repo for Raspberry Pi firmware has answered your question. The Q&A is here.

The answer is not as detailed as I would have liked, but to my reading, it seems there is one repo to house the compiled/binary firmware for Raspberry Pi, and another repo to house the source code. The compiled/binary Raspberry Pi firmware is housed on the GitHub repo linked above. The repo containing the source code for the Raspberry Pi firmware is "unpublished/closed-source". The Wiki page for the Raspberry Pi (compiled) firmware repo tells the same story.

And so the answer seems to be this:

• The 160-bit hash reported by vcgencmd is the hash of the firmware's source code - source code that is housed in an unpublished/closed-source repo.

• The 160-bit hash in the release notes is the hash of the compiled/binary firmware repo hosted on GitHub.

• Consequently, the release/commit date is all you have to rely upon. The dates are at least close - I assume there may be a time lag between committing the source files, and committing the binaries since they occur on different repos.