Initial RK1 media-center image project

2026-08-17 18:42:29 +00:00
commit 5fe41e79e9
81 changed files with 5725 additions and 0 deletions
@@ -0,0 +1,3 @@
+APT::Periodic::Update-Package-Lists "1";
+APT::Periodic::Unattended-Upgrade "1";
+
@@ -0,0 +1,22 @@
+// Security fixes may install automatically. Platform/media packages remain
+// pinned until a rebuilt image passes the RK1 hardware acceptance suite.
+#clear Unattended-Upgrade::Allowed-Origins;
+#clear Unattended-Upgrade::Origins-Pattern;
+
+Unattended-Upgrade::Origins-Pattern {
+        "origin=Debian,codename=${distro_codename}-security,label=Debian-Security";
+};
+
+Unattended-Upgrade::Package-Blacklist {
+		"^linux-image-.*$";
+		"^linux-dtb-.*$";
+		"^linux-u-boot-.*$";
+		"^armbian-bsp-.*$";
+		"^mesa-.*$";
+		"^kodi.*$";
+		"^rknn.*$";
+		"^rockchip.*$";
+};
+
+Unattended-Upgrade::Automatic-Reboot "false";
+Unattended-Upgrade::Remove-Unused-Kernel-Packages "false";
@@ -0,0 +1,8 @@
+# Generated by rk1-media-image. Administrative access is SSH-key-only.
+PermitRootLogin no
+PasswordAuthentication no
+KbdInteractiveAuthentication no
+PubkeyAuthentication yes
+AuthenticationMethods publickey
+PermitEmptyPasswords no
+
@@ -0,0 +1,14 @@
+[Unit]
+Description=RK1 media image first-boot identity setup
+After=local-fs.target
+Before=ssh.service sshd.service
+ConditionPathExists=/var/lib/rk1-media/first-boot.pending
+
+[Service]
+Type=oneshot
+ExecStart=/usr/local/sbin/rk1-media-first-boot
+RemainAfterExit=yes
+
+[Install]
+WantedBy=multi-user.target
+
@@ -0,0 +1,4 @@
+[Unit]
+Requires=rk1-media-first-boot.service
+After=rk1-media-first-boot.service
+
@@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+umask 077
+
+readonly MARKER="/var/lib/rk1-media/first-boot.pending"
+[[ -e "${MARKER}" ]] || exit 0
+
+rm -f /etc/ssh/ssh_host_*
+ssh-keygen -A
+
+found_key="no"
+for private_key in /etc/ssh/ssh_host_*_key; do
+	if [[ -s "${private_key}" ]]; then
+		found_key="yes"
+		break
+	fi
+done
+[[ "${found_key}" == "yes" ]] || { echo "No SSH host key was generated" >&2; exit 1; }
+
+/usr/sbin/sshd -t
+rm -f "${MARKER}"
+sync
+