http://bitcointrezor.com/

1. Install Docker
2. git clone https://github.com/trezor/trezor-mcu.git
3. cd trezor-mcu
4. ./firmware-docker-build.sh TAG (where TAG is v1.3.2 for example, if left blank the script builds latest commit)

This creates file output/trezor-TAG.bin and prints its fingerprint at the last line of the build log.

1. Install Docker
2. git clone https://github.com/trezor/trezor-mcu.git
3. cd trezor-mcu
4. ./bootloader-docker-build.sh

This creates file output/bootloader.bin and prints its fingerprint and size at the last line of the build log.

1. Pick version of firmware binary listed on https://mytrezor.com/data/firmware/releases.json
2. Download it: wget -O trezor.signed.bin.hex https://mytrezor.com/data/firmware/trezor-1.1.0.bin.hex
3. xxd -r -p trezor.signed.bin.hex trezor.signed.bin
4. ./firmware-fingerprint.sh trezor.signed.bin

Step 4 should produce the same sha256 fingerprint like your local build (for the same version tag).

The reasoning for firmware-fingerprint.sh script is that signed firmware has special header holding signatures themselves, which must be avoided while calculating the fingerprint.