55 lines
2.1 KiB
Bash
55 lines
2.1 KiB
Bash
|
#!/usr/bin/env bash
|
||
|
|
set -Eeuo pipefail
|
||
|
|
|
||
|
|
readonly ARMBIAN_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." && pwd -P)"
|
||
|
|
|
||
|
|
bash -n \
|
||
|
|
"${ARMBIAN_DIR}/build-image.sh" \
|
||
|
|
"${ARMBIAN_DIR}/userpatches/config-rk1-media.conf" \
|
||
|
|
"${ARMBIAN_DIR}/userpatches/customize-image.sh" \
|
||
|
|
"${ARMBIAN_DIR}/userpatches/extensions/rkbin-tools.sh" \
|
||
|
|
"${ARMBIAN_DIR}/userpatches/overlay/rootfs/usr/local/sbin/rk1-media-first-boot"
|
||
|
|
|
||
|
|
# shellcheck source=../userpatches/source-lock.env
|
||
|
|
source "${ARMBIAN_DIR}/userpatches/source-lock.env"
|
||
|
|
for revision in \
|
||
|
|
"${RK1_MEDIA_ARMBIAN_BUILD_COMMIT}" \
|
||
|
|
"${RK1_MEDIA_KERNEL_COMMIT}" \
|
||
|
|
"${RK1_MEDIA_UBOOT_COMMIT}" \
|
||
|
|
"${RK1_MEDIA_RKBIN_COMMIT}" \
|
||
|
|
"${RK1_MEDIA_FIRMWARE_COMMIT}"; do
|
||
|
|
[[ "${revision}" =~ ^[0-9a-f]{40}$ ]] || { echo "Invalid pinned revision: ${revision}" >&2; exit 1; }
|
||
|
|
done
|
||
|
|
|
||
|
|
jq -e --arg revision "${RK1_MEDIA_FIRMWARE_COMMIT}" \
|
||
|
|
'. == [{"source":"https://github.com/armbian/firmware","branch":"master","sha1":$revision}]' \
|
||
|
|
"${ARMBIAN_DIR}/framework-overrides/config/sources/git_sources.json" >/dev/null
|
||
|
|
|
||
|
|
[[ ! -e "${ARMBIAN_DIR}/userpatches/overlay/build-input/authorized_keys" ]] || {
|
||
|
|
echo "A staged administrator key must not be committed to userpatches/overlay/build-input" >&2
|
||
|
|
exit 1
|
||
|
|
}
|
||
|
|
|
||
|
|
if command -v apt-config >/dev/null; then
|
||
|
|
apt_dump="$(apt-config -c "${ARMBIAN_DIR}/userpatches/overlay/rootfs/etc/apt/apt.conf.d/52rk1-media-unattended-upgrades" dump)"
|
||
|
|
[[ "$(grep -c '^Unattended-Upgrade::Origins-Pattern:: ' <<< "${apt_dump}")" == "1" ]] || {
|
||
|
|
echo "Unattended upgrades must contain exactly one allowed origin" >&2
|
||
|
|
exit 1
|
||
|
|
}
|
||
|
|
grep -q 'codename=${distro_codename}-security' <<< "${apt_dump}" || {
|
||
|
|
echo "Debian security origin is missing from unattended-upgrades policy" >&2
|
||
|
|
exit 1
|
||
|
|
}
|
||
|
|
fi
|
||
|
|
|
||
|
|
if command -v shellcheck >/dev/null; then
|
||
|
|
shellcheck --exclude=SC1091,SC2154 \
|
||
|
|
"${ARMBIAN_DIR}/build-image.sh" \
|
||
|
|
"${ARMBIAN_DIR}/userpatches/config-rk1-media.conf" \
|
||
|
|
"${ARMBIAN_DIR}/userpatches/customize-image.sh" \
|
||
|
|
"${ARMBIAN_DIR}/userpatches/extensions/rkbin-tools.sh" \
|
||
|
|
"${ARMBIAN_DIR}/userpatches/overlay/rootfs/usr/local/sbin/rk1-media-first-boot"
|
||
|
|
fi
|
||
|
|
|
||
|
|
echo "Armbian scaffolding checks passed."
|