Not generic enough. I still think a netlist is better.
Maybe so, but I think what you're suggesting will be too difficult to accomplish and work with. Besides, the board name alone will tell everything there is to know about the cartridge minus some specifics like chip sizes and revisions and other things depending on context. That's speaking from an emulation standpoint however, but I think that's just the right balance. The cart has been identified and if someone wants to learn more about the NES-TKROM board used for Shadowgate he/she can look it up.
How will you handle games that have multiple PRG roms?
That's easy. Using the unlicensed Action 52 cart as an example:
<hardware ... >
<prg type="rom" size="512k" crc="64E40C10" />
<prg type="rom" size="512k" crc="69FDC534" />
<prg type="rom" size="512k" crc="7E43E9E1" />
<chr type="rom" size="512k" crc="596442EC" />
crc32 was hacked years ago
why not add some sha1
While I don't think it's worth worrying too much about CRC vandals, a more safe hash function could indeed be desired.
<game ... crc="baaaaaad" sha1="91a009e610b5e2b9776ac540dcdcada6f8cfc507">
Any other hash function to be considered, or will the two do for now?