Initial RK1 media-center image project

2026-08-17 18:42:29 +00:00
commit 5fe41e79e9
81 changed files with 5725 additions and 0 deletions
@@ -0,0 +1,57 @@
+# Armbian base image for Turing RK1
+
+This directory builds the minimal, remotely manageable base for the RK1 media
+appliance. It targets Debian 13 (Trixie), Armbian's Rockchip vendor kernel, and
+the `rk3588-turing-rk1.dtb`. Kodi and the pinned RKMPP/RGA media stack are added
+by the higher-level project layers.
+
+## Build
+
+Use a dedicated administrator public key. Password and root login are disabled
+in the resulting image.
+
+```bash
+./build-image.sh --ssh-public-key /absolute/path/to/id_ed25519.pub
+```
+
+Useful non-building checks:
+
+```bash
+./tests/lint.sh
+./build-image.sh --ssh-public-key /absolute/path/to/id_ed25519.pub --prepare-only
+./build-image.sh --ssh-public-key /absolute/path/to/id_ed25519.pub --config-dump
+```
+
+The framework checkout, source caches, build logs, and images live under
+`.work/armbian-build/`; completed images are in its `output/images/` directory.
+The build command creates an image and checksum but never flashes a device.
+
+## What is locked
+
+`userpatches/source-lock.env` pins the Armbian framework, the 6.1.115 Rockchip
+kernel source, U-Boot, Rockchip's required binary boot components, and Armbian
+firmware by commit hash. The custom `rkbin-tools` extension and framework
+`git_sources.json` override prevent the two stock moving `master` inputs from
+silently changing.
+
+Debian and Armbian archive packages are resolved when the image is built, so
+byte-for-byte reproduction also requires retaining the generated package
+manifest and a snapshot of the package repositories. Every built image records
+the resolved package versions in `/usr/share/rk1-media/package-manifest.tsv`.
+
+## First boot and updates
+
+- `rkadmin` is created with the supplied SSH public key and passwordless sudo.
+- Root and user password hashes are replaced with an unusable value.
+- SSH password, keyboard-interactive, and root authentication are disabled.
+- Image-time SSH host keys are erased and regenerated before SSH starts.
+- Ethernet uses Armbian's systemd-networkd DHCP configuration.
+- Avahi advertises the fixed hostname `rk1-media.local`.
+- `overlays=panthor-gpu` selects Mesa's Panthor DRM path instead of libMali.
+- Armbian's independent filesystem-resize service remains enabled.
+- Debian security updates are automatic; kernel, boot, BSP, and media packages
+  remain held until a rebuilt image passes hardware acceptance tests.
+
+The raw Armbian image is suitable for eMMC, NVMe, or removable-media flashing.
+Always identify the destination by model, size, and serial immediately before a
+write; the build wrapper deliberately contains no flashing operation.