Initial RK1 media-center image project

2026-08-17 18:42:29 +00:00
commit 5fe41e79e9
81 changed files with 5725 additions and 0 deletions
@@ -0,0 +1,136 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+
+RELEASE="${1:?missing Armbian release}"
+LINUXFAMILY="${2:?missing Linux family}"
+BOARD="${3:?missing board}"
+BUILD_DESKTOP="${4:?missing desktop flag}"
+ARCH="${5:?missing architecture}"
+
+readonly RELEASE LINUXFAMILY BOARD BUILD_DESKTOP ARCH
+readonly OVERLAY_ROOT="/tmp/overlay/rootfs"
+readonly AUTHORIZED_KEYS_INPUT="/tmp/overlay/build-input/authorized_keys"
+readonly SOURCE_LOCK_INPUT="/tmp/overlay/build-input/source-lock.env"
+
+fail() {
+	echo "rk1-media customize: $*" >&2
+	exit 1
+}
+
+configure_identity() {
+	printf '%s\n' "rk1-media" > /etc/hostname
+	if grep -Eq '^127\.0\.1\.1[[:space:]]' /etc/hosts; then
+		sed -Ei 's/^127\.0\.1\.1[[:space:]].*$/127.0.1.1 rk1-media/' /etc/hosts
+	else
+		printf '%s\n' '127.0.1.1 rk1-media' >> /etc/hosts
+	fi
+}
+
+configure_boot() {
+	local env_file="/boot/armbianEnv.txt"
+	local overlays
+	[[ -f "${env_file}" ]] || fail "Armbian boot environment is missing: ${env_file}"
+
+	if grep -q '^overlays=' "${env_file}"; then
+		overlays="$(sed -n 's/^overlays=//p' "${env_file}" | head -n 1)"
+		case " ${overlays} " in
+			*" panthor-gpu "*) ;;
+			*) sed -i "0,/^overlays=.*/s//overlays=${overlays} panthor-gpu/" "${env_file}" ;;
+		esac
+	else
+		printf '%s\n' 'overlays=panthor-gpu' >> "${env_file}"
+	fi
+}
+
+configure_admin() {
+	if ! getent group rkadmin >/dev/null; then
+		groupadd rkadmin
+	fi
+	if ! id rkadmin >/dev/null 2>&1; then
+		useradd --create-home --gid rkadmin --shell /bin/bash --comment "RK1 administrator" rkadmin
+	else
+		usermod --gid rkadmin rkadmin
+	fi
+
+	local group groups_csv
+	local -a groups=(sudo adm systemd-journal audio video render input)
+	local -a available_groups=()
+	for group in "${groups[@]}"; do
+		getent group "${group}" >/dev/null && available_groups+=("${group}")
+	done
+	groups_csv="$(IFS=,; echo "${available_groups[*]}")"
+	[[ -z "${groups_csv}" ]] || usermod --append --groups "${groups_csv}" rkadmin
+
+	install -d -o rkadmin -g rkadmin -m 0700 /home/rkadmin/.ssh
+	install -o rkadmin -g rkadmin -m 0600 "${AUTHORIZED_KEYS_INPUT}" /home/rkadmin/.ssh/authorized_keys
+	install -m 0440 /dev/null /etc/sudoers.d/90-rkadmin
+	printf '%s\n' 'rkadmin ALL=(ALL:ALL) NOPASSWD: ALL' > /etc/sudoers.d/90-rkadmin
+	visudo --check --file=/etc/sudoers.d/90-rkadmin >/dev/null
+
+	# Replace (rather than merely prefix) the build-time password hashes.
+	usermod --password '!' root
+	usermod --password '!' rkadmin
+	rm -f /root/.not_logged_in_yet
+}
+
+hold_platform_packages() {
+	local package
+	local -a held=()
+	while IFS= read -r package; do
+		case "${package}" in
+			linux-image-*|linux-dtb-*|linux-u-boot-*|armbian-bsp-*)
+				apt-mark hold "${package}" >/dev/null
+				held+=("${package}")
+				;;
+		esac
+	done < <(dpkg-query --show --showformat='${binary:Package}\n')
+	printf '%s\n' "${held[@]}" | LC_ALL=C sort -u > /usr/share/rk1-media/held-packages.txt
+}
+
+configure_services() {
+	install -d -m 0755 /var/lib/rk1-media
+	install -m 0600 /dev/null /var/lib/rk1-media/first-boot.pending
+
+	# Validate the complete SSH configuration, then remove generated host keys so
+	# every flashed module creates a unique set before ssh.service can start.
+	ssh-keygen -A
+	/usr/sbin/sshd -t
+	rm -f /etc/ssh/ssh_host_*
+
+	systemctl enable rk1-media-first-boot.service
+	systemctl enable ssh.service
+	systemctl enable avahi-daemon.service
+	systemctl enable apt-daily.timer
+	systemctl enable apt-daily-upgrade.timer
+}
+
+write_build_manifest() {
+	install -d -m 0755 /usr/share/rk1-media
+	install -m 0644 "${SOURCE_LOCK_INPUT}" /usr/share/rk1-media/source-lock.env
+	dpkg-query --show --showformat='${binary:Package}\t${Version}\t${Architecture}\n' \
+		| LC_ALL=C sort > /usr/share/rk1-media/package-manifest.tsv
+}
+
+main() {
+	[[ "${RELEASE}" == "trixie" ]] || fail "unexpected release: ${RELEASE}"
+	[[ "${BOARD}" == "turing-rk1" ]] || fail "unexpected board: ${BOARD}"
+	[[ "${BUILD_DESKTOP}" == "no" ]] || fail "desktop images are not supported by this customization"
+	[[ "${ARCH}" == "arm64" ]] || fail "unexpected architecture: ${ARCH}"
+	[[ -d "${OVERLAY_ROOT}" ]] || fail "rootfs overlay is missing"
+	[[ -s "${AUTHORIZED_KEYS_INPUT}" ]] || fail "authorized_keys build input is missing"
+	[[ -s "${SOURCE_LOCK_INPUT}" ]] || fail "source lock build input is missing"
+
+	cp -a "${OVERLAY_ROOT}/." /
+	configure_identity
+	configure_boot
+	configure_admin
+	write_build_manifest
+	hold_platform_packages
+	configure_services
+
+	# systemd creates a unique machine ID on the first real boot.
+	: > /etc/machine-id
+	rm -f /var/lib/dbus/machine-id
+}
+
+main "$@"