Initial RK1 media-center image project

media/packaging/control.in

@@ -0,0 +1,15 @@
+Package: rk1-media-stack
+Version: @VERSION@
+Section: video
+Priority: optional
+Architecture: arm64
+Maintainer: RK1 Media Image Builder <root@localhost>
+Installed-Size: @INSTALLED_SIZE@
+Depends: @DEPENDS@
+Recommends: armbian-firmware, libgl1-mesa-dri, mesa-vulkan-drivers
+Homepage: https://github.com/armsurvivors/kodi-rockchip-deb
+X-RKMedia-Provenance-SHA256: @LOCK_SHA256@
+Description: isolated RK3588 Kodi GBM and FFmpeg hardware media stack
+ Kodi for direct GBM/GLES rendering plus a matched FFmpeg-Rockchip, MPP,
+ RGA, dav1d, and libdisplay-info runtime. Custom software is isolated under
+ /opt/rkmedia and does not replace the distribution FFmpeg packages.

media/packaging/postinst

@@ -0,0 +1,34 @@
+#!/bin/sh
+
+set -e
+
+if ! getent group kodi >/dev/null 2>&1; then
+  addgroup --system kodi
+fi
+if ! getent passwd kodi >/dev/null 2>&1; then
+  adduser --system --ingroup kodi --home /var/lib/kodi --no-create-home \
+    --disabled-login --shell /usr/sbin/nologin kodi
+fi
+
+for group in video render audio input; do
+  if getent group "${group}" >/dev/null 2>&1; then
+    adduser kodi "${group}" >/dev/null
+  fi
+done
+
+systemd-tmpfiles --create rkmedia.conf >/dev/null 2>&1 || true
+udevadm control --reload-rules >/dev/null 2>&1 || true
+udevadm trigger --action=change --subsystem-match=drm >/dev/null 2>&1 || true
+udevadm trigger --action=change --subsystem-match=dma_heap >/dev/null 2>&1 || true
+udevadm trigger --action=change --subsystem-match=misc >/dev/null 2>&1 || true
+udevadm settle >/dev/null 2>&1 || true
+
+if command -v deb-systemd-helper >/dev/null 2>&1; then
+  deb-systemd-helper unmask kodi-rk.service >/dev/null || true
+  deb-systemd-helper enable kodi-rk.service >/dev/null || true
+fi
+if [ -d /run/systemd/system ]; then
+  systemctl daemon-reload >/dev/null || true
+fi
+
+exit 0

media/packaging/postrm

@@ -0,0 +1,16 @@
+#!/bin/sh
+
+set -e
+
+if command -v deb-systemd-helper >/dev/null 2>&1; then
+  if [ "$1" = purge ]; then
+    deb-systemd-helper purge kodi-rk.service >/dev/null || true
+  fi
+fi
+if [ -d /run/systemd/system ]; then
+  systemctl daemon-reload >/dev/null || true
+fi
+
+# Deliberately retain /var/lib/kodi and the locked account on removal. The
+# media database and settings must never be deleted by a package uninstall.
+exit 0

media/packaging/prerm

@@ -0,0 +1,8 @@
+#!/bin/sh
+
+set -e
+
+if [ "$1" = remove ] && [ -d /run/systemd/system ]; then
+  systemctl --no-reload stop kodi-rk.service >/dev/null 2>&1 || true
+fi
+exit 0

media/packaging/rootfs/etc/rkmedia/kodi.env

@@ -0,0 +1,8 @@
+# Environment loaded by kodi-rk.service. This file is preserved across package
+# upgrades. Kodi command-line arguments live in the unit so values here never
+# undergo unsafe shell word splitting.
+KODI_DATA=/var/lib/kodi/.kodi
+CRASHLOG_DIR=/var/lib/kodi
+XDG_CACHE_HOME=/var/cache/kodi
+MESA_SHADER_CACHE_DIR=/var/cache/kodi/mesa_shader_cache
+

media/packaging/rootfs/opt/rkmedia/bin/ffmpeg-rk

@@ -0,0 +1,7 @@
+#!/bin/sh
+
+set -eu
+prefix=/opt/rkmedia
+export LD_LIBRARY_PATH="${prefix}/lib${LD_LIBRARY_PATH:+:${LD_LIBRARY_PATH}}"
+exec "${prefix}/bin/ffmpeg" "$@"
+

media/packaging/rootfs/opt/rkmedia/bin/ffprobe-rk

@@ -0,0 +1,7 @@
+#!/bin/sh
+
+set -eu
+prefix=/opt/rkmedia
+export LD_LIBRARY_PATH="${prefix}/lib${LD_LIBRARY_PATH:+:${LD_LIBRARY_PATH}}"
+exec "${prefix}/bin/ffprobe" "$@"
+

media/packaging/rootfs/opt/rkmedia/bin/kodi-rk

@@ -0,0 +1,25 @@
+#!/bin/sh
+
+set -eu
+prefix=/opt/rkmedia
+data_dir="${KODI_DATA:-${HOME}/.kodi}"
+userdata_dir="${data_dir}/userdata"
+
+export PATH="${prefix}/bin:${PATH}"
+export LD_LIBRARY_PATH="${prefix}/lib${LD_LIBRARY_PATH:+:${LD_LIBRARY_PATH}}"
+
+mkdir -p "${userdata_dir}"
+if [ ! -e "${userdata_dir}/guisettings.xml" ]; then
+  cp /usr/share/rkmedia/kodi/guisettings.xml "${userdata_dir}/guisettings.xml"
+fi
+
+if [ -x "${prefix}/bin/kodi" ]; then
+  kodi_launcher="${prefix}/bin/kodi"
+elif [ -x /usr/local/bin/kodi ]; then
+  kodi_launcher=/usr/local/bin/kodi
+else
+  printf 'kodi-rk: no Kodi launcher found under /opt/rkmedia or /usr/local\n' >&2
+  exit 127
+fi
+
+exec "${kodi_launcher}" "$@"

media/packaging/rootfs/usr/lib/systemd/system/kodi-rk.service

@@ -0,0 +1,51 @@
+[Unit]
+Description=Kodi RK3588 GBM appliance
+Documentation=https://github.com/armsurvivors/kodi-rockchip-deb
+Wants=network-online.target
+After=systemd-user-sessions.service network-online.target sound.target
+Conflicts=display-manager.service [email protected]
+
+[Service]
+Type=simple
+User=kodi
+Group=kodi
+SupplementaryGroups=video render audio input
+Environment=HOME=/var/lib/kodi
+Environment=XDG_RUNTIME_DIR=/run/kodi
+Environment=LD_LIBRARY_PATH=/opt/rkmedia/lib
+EnvironmentFile=-/etc/rkmedia/kodi.env
+RuntimeDirectory=kodi
+RuntimeDirectoryMode=0700
+StateDirectory=kodi
+StateDirectoryMode=0750
+CacheDirectory=kodi
+CacheDirectoryMode=0750
+PAMName=login
+UtmpIdentifier=tty1
+UtmpMode=user
+StandardInput=tty
+TTYPath=/dev/tty1
+TTYReset=yes
+TTYVHangup=yes
+TTYVTDisallocate=yes
+ExecStart=/opt/rkmedia/bin/kodi-rk --standalone --logging=console --windowing=gbm --audio-backend=alsa
+Restart=always
+RestartSec=2s
+TimeoutStopSec=15s
+LimitNOFILE=16384
+NoNewPrivileges=yes
+PrivateTmp=yes
+ProtectSystem=full
+ProtectHome=yes
+ProtectKernelTunables=yes
+ProtectKernelModules=yes
+ProtectControlGroups=yes
+RestrictNamespaces=yes
+RestrictSUIDSGID=yes
+LockPersonality=yes
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
+CapabilityBoundingSet=CAP_SYS_TTY_CONFIG
+AmbientCapabilities=CAP_SYS_TTY_CONFIG
+
+[Install]
+WantedBy=multi-user.target

media/packaging/rootfs/usr/lib/tmpfiles.d/rkmedia.conf

@@ -0,0 +1,4 @@
+d /var/lib/kodi 0750 kodi kodi -
+d /var/lib/kodi/.kodi 0750 kodi kodi -
+d /var/cache/kodi 0750 kodi kodi -
+

media/packaging/rootfs/usr/lib/udev/rules.d/70-rkmedia.rules

@@ -0,0 +1,22 @@
+# Primary and render DRM nodes used by Kodi GBM and DRM PRIME.
+SUBSYSTEM=="drm", KERNEL=="card[0-9]*", GROUP="video", MODE="0660", TAG+="uaccess"
+SUBSYSTEM=="drm", KERNEL=="renderD[0-9]*", GROUP="render", MODE="0660", TAG+="uaccess"
+
+# Rockchip vendor-kernel media accelerators. Optional compatibility names are
+# included because their exact node names vary across BSP kernel revisions.
+SUBSYSTEM=="dma_heap", GROUP="video", MODE="0660"
+KERNEL=="rga", GROUP="video", MODE="0660"
+KERNEL=="iep", GROUP="video", MODE="0660"
+KERNEL=="mpp_service", GROUP="video", MODE="0660"
+KERNEL=="mpp-service", GROUP="video", MODE="0660"
+KERNEL=="vpu_service", GROUP="video", MODE="0660"
+KERNEL=="vpu-service", GROUP="video", MODE="0660"
+KERNEL=="hevc_service", GROUP="video", MODE="0660"
+KERNEL=="hevc-service", GROUP="video", MODE="0660"
+KERNEL=="rkvdec", GROUP="video", MODE="0660"
+KERNEL=="rkvenc", GROUP="video", MODE="0660"
+KERNEL=="vepu", GROUP="video", MODE="0660"
+KERNEL=="h265e", GROUP="video", MODE="0660"
+
+# Rockchip NPU control/render compatibility nodes used by RKNN diagnostics.
+KERNEL=="rknpu*", GROUP="render", MODE="0660"

media/packaging/rootfs/usr/share/rkmedia/kodi/guisettings.xml

@@ -0,0 +1,5 @@
+<settings version="2">
+  <setting id="videoplayer.useprimedecoder">true</setting>
+  <setting id="videoplayer.useprimedecoderforhw" default="true">true</setting>
+  <setting id="videoplayer.useprimerenderer">0</setting>
+</settings>