Initial RK1 media-center image project

2026-08-17 18:42:29 +00:00
commit 5fe41e79e9
81 changed files with 5725 additions and 0 deletions
@@ -0,0 +1,40 @@
+#!/usr/bin/env bash
+# Fetch the exact Debian package payload described by the integrity lock.
+
+set -Eeuo pipefail
+
+SCRIPT_DIR=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd -P)
+PROJECT_DIR=$(cd -- "$SCRIPT_DIR/.." && pwd -P)
+LOCK_FILE=${1:-"$SCRIPT_DIR/debian-packages.lock.tsv"}
+OUTPUT_DIR=${2:-"$PROJECT_DIR/work/apt/archives"}
+
+[[ -s "$LOCK_FILE" ]] || { echo "Missing package lock: $LOCK_FILE" >&2; exit 1; }
+mkdir -p "$OUTPUT_DIR"
+
+while IFS=$'\t' read -r filename expected_size expected_sha url; do
+  [[ "$filename" == '# filename' ]] && continue
+  [[ -n "$filename" && "$expected_sha" =~ ^[0-9a-f]{64}$ ]] || {
+    echo "Malformed package lock row: $filename" >&2
+    exit 1
+  }
+  output="$OUTPUT_DIR/$filename"
+  if [[ -f "$output" ]] &&
+     [[ "$(stat -c '%s' "$output")" == "$expected_size" ]] &&
+     [[ "$(sha256sum "$output" | awk '{print $1}')" == "$expected_sha" ]]; then
+    continue
+  fi
+  partial="$output.partial"
+  rm -f -- "$partial"
+  curl --fail --location --show-error --output "$partial" "$url"
+  [[ "$(stat -c '%s' "$partial")" == "$expected_size" ]] || {
+    echo "Size mismatch for $filename" >&2
+    exit 1
+  }
+  echo "$expected_sha  $partial" | sha256sum --check --status || {
+    echo "Checksum mismatch for $filename" >&2
+    exit 1
+  }
+  mv -- "$partial" "$output"
+done <"$LOCK_FILE"
+
+echo "Verified locked package bundle: $OUTPUT_DIR"