58 lines
2.5 KiB
Markdown
58 lines
2.5 KiB
Markdown
|
# Armbian base image for Turing RK1
|
||
|
|
|
||
|
|
This directory builds the minimal, remotely manageable base for the RK1 media
|
||
|
|
appliance. It targets Debian 13 (Trixie), Armbian's Rockchip vendor kernel, and
|
||
|
|
the `rk3588-turing-rk1.dtb`. Kodi and the pinned RKMPP/RGA media stack are added
|
||
|
|
by the higher-level project layers.
|
||
|
|
|
||
|
|
## Build
|
||
|
|
|
||
|
|
Use a dedicated administrator public key. Password and root login are disabled
|
||
|
|
in the resulting image.
|
||
|
|
|
||
|
|
```bash
|
||
|
|
./build-image.sh --ssh-public-key /absolute/path/to/id_ed25519.pub
|
||
|
|
```
|
||
|
|
|
||
|
|
Useful non-building checks:
|
||
|
|
|
||
|
|
```bash
|
||
|
|
./tests/lint.sh
|
||
|
|
./build-image.sh --ssh-public-key /absolute/path/to/id_ed25519.pub --prepare-only
|
||
|
|
./build-image.sh --ssh-public-key /absolute/path/to/id_ed25519.pub --config-dump
|
||
|
|
```
|
||
|
|
|
||
|
|
The framework checkout, source caches, build logs, and images live under
|
||
|
|
`.work/armbian-build/`; completed images are in its `output/images/` directory.
|
||
|
|
The build command creates an image and checksum but never flashes a device.
|
||
|
|
|
||
|
|
## What is locked
|
||
|
|
|
||
|
|
`userpatches/source-lock.env` pins the Armbian framework, the 6.1.115 Rockchip
|
||
|
|
kernel source, U-Boot, Rockchip's required binary boot components, and Armbian
|
||
|
|
firmware by commit hash. The custom `rkbin-tools` extension and framework
|
||
|
|
`git_sources.json` override prevent the two stock moving `master` inputs from
|
||
|
|
silently changing.
|
||
|
|
|
||
|
|
Debian and Armbian archive packages are resolved when the image is built, so
|
||
|
|
byte-for-byte reproduction also requires retaining the generated package
|
||
|
|
manifest and a snapshot of the package repositories. Every built image records
|
||
|
|
the resolved package versions in `/usr/share/rk1-media/package-manifest.tsv`.
|
||
|
|
|
||
|
|
## First boot and updates
|
||
|
|
|
||
|
|
- `rkadmin` is created with the supplied SSH public key and passwordless sudo.
|
||
|
|
- Root and user password hashes are replaced with an unusable value.
|
||
|
|
- SSH password, keyboard-interactive, and root authentication are disabled.
|
||
|
|
- Image-time SSH host keys are erased and regenerated before SSH starts.
|
||
|
|
- Ethernet uses Armbian's systemd-networkd DHCP configuration.
|
||
|
|
- Avahi advertises the fixed hostname `rk1-media.local`.
|
||
|
|
- `overlays=panthor-gpu` selects Mesa's Panthor DRM path instead of libMali.
|
||
|
|
- Armbian's independent filesystem-resize service remains enabled.
|
||
|
|
- Debian security updates are automatic; kernel, boot, BSP, and media packages
|
||
|
|
remain held until a rebuilt image passes hardware acceptance tests.
|
||
|
|
|
||
|
|
The raw Armbian image is suitable for eMMC, NVMe, or removable-media flashing.
|
||
|
|
Always identify the destination by model, size, and serial immediately before a
|
||
|
|
write; the build wrapper deliberately contains no flashing operation.
|