Initial RK1 media-center image project

2026-08-17 18:42:29 +00:00
commit 5fe41e79e9
81 changed files with 5725 additions and 0 deletions
@@ -0,0 +1,2 @@
+0.1.0
+
@@ -0,0 +1,72 @@
+# shellcheck shell=bash
+
+# Armbian image identity and target.
+BOARD="turing-rk1"
+BRANCH="vendor"
+RELEASE="trixie"
+BUILD_MINIMAL="yes"
+BUILD_DESKTOP="no"
+KERNEL_CONFIGURE="no"
+UBOOT_CONFIGURE="no"
+INSTALL_HEADERS="no"
+EXPERT="yes" # Turing RK1 is an Armbian community-supported board.
+
+# Image layout and deterministic build choices.
+ROOTFS_TYPE="ext4"
+EXTRA_ROOTFS_MIB_SIZE="1536"
+COMPRESS_OUTPUTIMAGE="sha,xz"
+IMAGE_XZ_COMPRESSION_RATIO="6"
+NETWORKING_STACK="systemd-networkd"
+SHARE_LOGS="no"
+BETA="no"
+USE_CCACHE="no"
+
+# Runtime defaults. The temporary build password is overwritten with an
+# unusable shadow value by customize-image.sh; no password works in the image.
+HOST="rk1-media"
+VENDOR="RK1 Media"
+VENDORURL="https://github.com/armbian/build"
+ROOTPWD="RK1_IMAGE_LOGIN_DISABLED"
+CONSOLE_AUTOLOGIN="no"
+DESKTOP_AUTOLOGIN="no"
+OPENSSHD_REGENERATE_HOST_KEYS="false"
+
+# This file is copied with the rest of userpatches by build-image.sh.
+# shellcheck source=source-lock.env
+source "${BASH_SOURCE%/*}/source-lock.env"
+
+# The board and family definitions intentionally use moving branches. Override
+# them after those definitions have run while retaining Armbian's matching
+# vendor patch directories.
+function post_family_config__999_rk1_media_pin_boot_sources() {
+	[[ "${BOARD}" == "turing-rk1" ]] || exit_with_error "RK1 media config used with the wrong board" "${BOARD}"
+	[[ "${BRANCH}" == "vendor" ]] || exit_with_error "RK1 media config requires BRANCH=vendor" "${BRANCH}"
+
+	declare -g KERNELSOURCE="${RK1_MEDIA_KERNEL_URL}"
+	declare -g KERNELBRANCH="commit:${RK1_MEDIA_KERNEL_COMMIT}"
+	declare -g KERNEL_MAJOR_MINOR="${RK1_MEDIA_KERNEL_SERIES}"
+	declare -g KERNELPATCHDIR="${RK1_MEDIA_KERNEL_PATCHSET}"
+
+	declare -g BOOTSOURCE="${RK1_MEDIA_UBOOT_URL}"
+	declare -g BOOTBRANCH="commit:${RK1_MEDIA_UBOOT_COMMIT}"
+	declare -g BOOTPATCHDIR="${RK1_MEDIA_UBOOT_PATCHSET}"
+}
+
+function user_config__200_rk1_media_base_packages() {
+	[[ "${RELEASE}" == "trixie" ]] || exit_with_error "RK1 media config requires Debian Trixie" "${RELEASE}"
+
+	add_packages_to_image \
+		openssh-server \
+		sudo \
+		avahi-daemon \
+		libnss-mdns \
+		unattended-upgrades \
+		ca-certificates \
+		curl \
+		jq
+
+	# Do not inherit the build host's locale/time zone.
+	declare -g DEST_LANG="en_US.UTF-8"
+	declare -g TZDATA="Etc/UTC"
+}
+
@@ -0,0 +1,136 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+
+RELEASE="${1:?missing Armbian release}"
+LINUXFAMILY="${2:?missing Linux family}"
+BOARD="${3:?missing board}"
+BUILD_DESKTOP="${4:?missing desktop flag}"
+ARCH="${5:?missing architecture}"
+
+readonly RELEASE LINUXFAMILY BOARD BUILD_DESKTOP ARCH
+readonly OVERLAY_ROOT="/tmp/overlay/rootfs"
+readonly AUTHORIZED_KEYS_INPUT="/tmp/overlay/build-input/authorized_keys"
+readonly SOURCE_LOCK_INPUT="/tmp/overlay/build-input/source-lock.env"
+
+fail() {
+	echo "rk1-media customize: $*" >&2
+	exit 1
+}
+
+configure_identity() {
+	printf '%s\n' "rk1-media" > /etc/hostname
+	if grep -Eq '^127\.0\.1\.1[[:space:]]' /etc/hosts; then
+		sed -Ei 's/^127\.0\.1\.1[[:space:]].*$/127.0.1.1 rk1-media/' /etc/hosts
+	else
+		printf '%s\n' '127.0.1.1 rk1-media' >> /etc/hosts
+	fi
+}
+
+configure_boot() {
+	local env_file="/boot/armbianEnv.txt"
+	local overlays
+	[[ -f "${env_file}" ]] || fail "Armbian boot environment is missing: ${env_file}"
+
+	if grep -q '^overlays=' "${env_file}"; then
+		overlays="$(sed -n 's/^overlays=//p' "${env_file}" | head -n 1)"
+		case " ${overlays} " in
+			*" panthor-gpu "*) ;;
+			*) sed -i "0,/^overlays=.*/s//overlays=${overlays} panthor-gpu/" "${env_file}" ;;
+		esac
+	else
+		printf '%s\n' 'overlays=panthor-gpu' >> "${env_file}"
+	fi
+}
+
+configure_admin() {
+	if ! getent group rkadmin >/dev/null; then
+		groupadd rkadmin
+	fi
+	if ! id rkadmin >/dev/null 2>&1; then
+		useradd --create-home --gid rkadmin --shell /bin/bash --comment "RK1 administrator" rkadmin
+	else
+		usermod --gid rkadmin rkadmin
+	fi
+
+	local group groups_csv
+	local -a groups=(sudo adm systemd-journal audio video render input)
+	local -a available_groups=()
+	for group in "${groups[@]}"; do
+		getent group "${group}" >/dev/null && available_groups+=("${group}")
+	done
+	groups_csv="$(IFS=,; echo "${available_groups[*]}")"
+	[[ -z "${groups_csv}" ]] || usermod --append --groups "${groups_csv}" rkadmin
+
+	install -d -o rkadmin -g rkadmin -m 0700 /home/rkadmin/.ssh
+	install -o rkadmin -g rkadmin -m 0600 "${AUTHORIZED_KEYS_INPUT}" /home/rkadmin/.ssh/authorized_keys
+	install -m 0440 /dev/null /etc/sudoers.d/90-rkadmin
+	printf '%s\n' 'rkadmin ALL=(ALL:ALL) NOPASSWD: ALL' > /etc/sudoers.d/90-rkadmin
+	visudo --check --file=/etc/sudoers.d/90-rkadmin >/dev/null
+
+	# Replace (rather than merely prefix) the build-time password hashes.
+	usermod --password '!' root
+	usermod --password '!' rkadmin
+	rm -f /root/.not_logged_in_yet
+}
+
+hold_platform_packages() {
+	local package
+	local -a held=()
+	while IFS= read -r package; do
+		case "${package}" in
+			linux-image-*|linux-dtb-*|linux-u-boot-*|armbian-bsp-*)
+				apt-mark hold "${package}" >/dev/null
+				held+=("${package}")
+				;;
+		esac
+	done < <(dpkg-query --show --showformat='${binary:Package}\n')
+	printf '%s\n' "${held[@]}" | LC_ALL=C sort -u > /usr/share/rk1-media/held-packages.txt
+}
+
+configure_services() {
+	install -d -m 0755 /var/lib/rk1-media
+	install -m 0600 /dev/null /var/lib/rk1-media/first-boot.pending
+
+	# Validate the complete SSH configuration, then remove generated host keys so
+	# every flashed module creates a unique set before ssh.service can start.
+	ssh-keygen -A
+	/usr/sbin/sshd -t
+	rm -f /etc/ssh/ssh_host_*
+
+	systemctl enable rk1-media-first-boot.service
+	systemctl enable ssh.service
+	systemctl enable avahi-daemon.service
+	systemctl enable apt-daily.timer
+	systemctl enable apt-daily-upgrade.timer
+}
+
+write_build_manifest() {
+	install -d -m 0755 /usr/share/rk1-media
+	install -m 0644 "${SOURCE_LOCK_INPUT}" /usr/share/rk1-media/source-lock.env
+	dpkg-query --show --showformat='${binary:Package}\t${Version}\t${Architecture}\n' \
+		| LC_ALL=C sort > /usr/share/rk1-media/package-manifest.tsv
+}
+
+main() {
+	[[ "${RELEASE}" == "trixie" ]] || fail "unexpected release: ${RELEASE}"
+	[[ "${BOARD}" == "turing-rk1" ]] || fail "unexpected board: ${BOARD}"
+	[[ "${BUILD_DESKTOP}" == "no" ]] || fail "desktop images are not supported by this customization"
+	[[ "${ARCH}" == "arm64" ]] || fail "unexpected architecture: ${ARCH}"
+	[[ -d "${OVERLAY_ROOT}" ]] || fail "rootfs overlay is missing"
+	[[ -s "${AUTHORIZED_KEYS_INPUT}" ]] || fail "authorized_keys build input is missing"
+	[[ -s "${SOURCE_LOCK_INPUT}" ]] || fail "source lock build input is missing"
+
+	cp -a "${OVERLAY_ROOT}/." /
+	configure_identity
+	configure_boot
+	configure_admin
+	write_build_manifest
+	hold_platform_packages
+	configure_services
+
+	# systemd creates a unique machine ID on the first real boot.
+	: > /etc/machine-id
+	rm -f /var/lib/dbus/machine-id
+}
+
+main "$@"
@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+
+# Source-locked replacement for Armbian's rkbin-tools extension. The upstream
+# extension follows branch:master, which makes otherwise pinned builds drift.
+
+function fetch_sources_tools__rkbin_tools() {
+	: "${RK1_MEDIA_RKBIN_URL:?source-lock.env did not set RK1_MEDIA_RKBIN_URL}"
+	: "${RK1_MEDIA_RKBIN_COMMIT:?source-lock.env did not set RK1_MEDIA_RKBIN_COMMIT}"
+	fetch_from_repo "${RK1_MEDIA_RKBIN_URL}" "rkbin-tools" "commit:${RK1_MEDIA_RKBIN_COMMIT}"
+}
+
+function build_host_tools__install_rkbin_tools() {
+	cd "${SRC}/cache/sources/rkbin-tools" || exit
+	if [[ ! -f .commit_id || "$(improved_git rev-parse @ 2>/dev/null)" != "$(< .commit_id)" || ! -f /usr/local/bin/loaderimage ]]; then
+		display_alert "Installing" "source-locked rkbin tools" "info"
+		mkdir -p /usr/local/bin/
+		install -m 0755 tools/loaderimage /usr/local/bin/
+		install -m 0755 tools/trust_merger /usr/local/bin/
+		improved_git rev-parse @ 2>/dev/null > .commit_id
+	fi
+}
+
@@ -0,0 +1,3 @@
+APT::Periodic::Update-Package-Lists "1";
+APT::Periodic::Unattended-Upgrade "1";
+
@@ -0,0 +1,22 @@
+// Security fixes may install automatically. Platform/media packages remain
+// pinned until a rebuilt image passes the RK1 hardware acceptance suite.
+#clear Unattended-Upgrade::Allowed-Origins;
+#clear Unattended-Upgrade::Origins-Pattern;
+
+Unattended-Upgrade::Origins-Pattern {
+        "origin=Debian,codename=${distro_codename}-security,label=Debian-Security";
+};
+
+Unattended-Upgrade::Package-Blacklist {
+		"^linux-image-.*$";
+		"^linux-dtb-.*$";
+		"^linux-u-boot-.*$";
+		"^armbian-bsp-.*$";
+		"^mesa-.*$";
+		"^kodi.*$";
+		"^rknn.*$";
+		"^rockchip.*$";
+};
+
+Unattended-Upgrade::Automatic-Reboot "false";
+Unattended-Upgrade::Remove-Unused-Kernel-Packages "false";
@@ -0,0 +1,8 @@
+# Generated by rk1-media-image. Administrative access is SSH-key-only.
+PermitRootLogin no
+PasswordAuthentication no
+KbdInteractiveAuthentication no
+PubkeyAuthentication yes
+AuthenticationMethods publickey
+PermitEmptyPasswords no
+
@@ -0,0 +1,14 @@
+[Unit]
+Description=RK1 media image first-boot identity setup
+After=local-fs.target
+Before=ssh.service sshd.service
+ConditionPathExists=/var/lib/rk1-media/first-boot.pending
+
+[Service]
+Type=oneshot
+ExecStart=/usr/local/sbin/rk1-media-first-boot
+RemainAfterExit=yes
+
+[Install]
+WantedBy=multi-user.target
+
@@ -0,0 +1,4 @@
+[Unit]
+Requires=rk1-media-first-boot.service
+After=rk1-media-first-boot.service
+
@@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+umask 077
+
+readonly MARKER="/var/lib/rk1-media/first-boot.pending"
+[[ -e "${MARKER}" ]] || exit 0
+
+rm -f /etc/ssh/ssh_host_*
+ssh-keygen -A
+
+found_key="no"
+for private_key in /etc/ssh/ssh_host_*_key; do
+	if [[ -s "${private_key}" ]]; then
+		found_key="yes"
+		break
+	fi
+done
+[[ "${found_key}" == "yes" ]] || { echo "No SSH host key was generated" >&2; exit 1; }
+
+/usr/sbin/sshd -t
+rm -f "${MARKER}"
+sync
+
@@ -0,0 +1,23 @@
+# Source revisions resolved on 2026-08-16.
+#
+# This file is sourced by both build-image.sh and Armbian's user configuration.
+# Keep values shell-safe (no command substitutions or unquoted whitespace).
+
+RK1_MEDIA_ARMBIAN_BUILD_URL="https://github.com/armbian/build.git"
+RK1_MEDIA_ARMBIAN_BUILD_COMMIT="ea18947bed789c829a260df129e815c353c14908"
+
+RK1_MEDIA_KERNEL_URL="https://github.com/armbian/linux-rockchip.git"
+RK1_MEDIA_KERNEL_COMMIT="5280f9b4336199c4025c8eed894d2b4e2268dcc6"
+RK1_MEDIA_KERNEL_VERSION="6.1.115"
+RK1_MEDIA_KERNEL_SERIES="6.1"
+RK1_MEDIA_KERNEL_PATCHSET="rk35xx-vendor-6.1"
+
+RK1_MEDIA_UBOOT_URL="https://github.com/u-boot/u-boot.git"
+RK1_MEDIA_UBOOT_COMMIT="ece349ade2973e220f524ce59e59711cc919263f"
+RK1_MEDIA_UBOOT_PATCHSET="v2026.07"
+
+RK1_MEDIA_RKBIN_URL="https://github.com/armbian/rkbin.git"
+RK1_MEDIA_RKBIN_COMMIT="452f49a987097d7ca675811e51a873b42ebd101f"
+
+RK1_MEDIA_FIRMWARE_URL="https://github.com/armbian/firmware"
+RK1_MEDIA_FIRMWARE_COMMIT="d9846710f54da5e4383e2d67311819659ac2cf5c"