Initial RK1 media-center image project

2026-08-17 18:42:29 +00:00
commit 5fe41e79e9
81 changed files with 5725 additions and 0 deletions
@@ -0,0 +1,65 @@
+#!/usr/bin/env bash
+# Generate an integrity lock for an already-resolved Debian package bundle.
+
+set -Eeuo pipefail
+
+SCRIPT_DIR=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd -P)
+PROJECT_DIR=$(cd -- "$SCRIPT_DIR/.." && pwd -P)
+ARCHIVE_DIR=${1:-"$PROJECT_DIR/work/apt/archives"}
+LIST_DIR=${2:-"$PROJECT_DIR/work/apt/lists"}
+OUTPUT=${3:-"$SCRIPT_DIR/debian-packages.lock.tsv"}
+
+[[ -d "$ARCHIVE_DIR" && -d "$LIST_DIR" ]] || {
+  echo "Usage: $0 [ARCHIVE-DIR LIST-DIR OUTPUT]" >&2
+  exit 2
+}
+
+INDEX=$(mktemp)
+OUTPUT_TMP=$(mktemp)
+trap 'rm -f -- "$INDEX" "$OUTPUT_TMP"' EXIT
+
+for package_list in "$LIST_DIR"/*_Packages; do
+  [[ -f "$package_list" ]] || continue
+  case "$(basename -- "$package_list")" in
+    security.debian.org_*) base_url=https://security.debian.org/debian-security ;;
+    deb.debian.org_*) base_url=https://deb.debian.org/debian ;;
+    *) continue ;;
+  esac
+  awk -v base_url="$base_url" '
+    /^Filename: / { filename=substr($0, 11) }
+    /^Size: / { size=substr($0, 7) }
+    /^SHA256: / { sha=substr($0, 9) }
+    /^$/ {
+      if (filename != "" && size != "" && sha != "") {
+        print sha "\t" size "\t" base_url "/" filename
+      }
+      filename=size=sha=""
+    }
+    END {
+      if (filename != "" && size != "" && sha != "") {
+        print sha "\t" size "\t" base_url "/" filename
+      }
+    }
+  ' "$package_list" >>"$INDEX"
+done
+LC_ALL=C sort -u -o "$INDEX" "$INDEX"
+
+printf '# filename\tsize\tsha256\turl\n' >"$OUTPUT_TMP"
+while IFS= read -r -d '' package_path; do
+  filename=$(basename -- "$package_path")
+  size=$(stat -c '%s' "$package_path")
+  sha=$(sha256sum "$package_path" | awk '{print $1}')
+  match=$(awk -F '\t' -v sha="$sha" -v size="$size" \
+    '$1 == sha && $2 == size { print; exit }' "$INDEX")
+  [[ -n "$match" ]] || {
+    echo "No signed package-index record for $filename" >&2
+    exit 1
+  }
+  url=${match#*$'\t'}
+  url=${url#*$'\t'}
+  printf '%s\t%s\t%s\t%s\n' "$filename" "$size" "$sha" "$url" \
+    >>"$OUTPUT_TMP"
+done < <(find "$ARCHIVE_DIR" -maxdepth 1 -type f -name '*.deb' -print0 | sort -z)
+
+install -m 0644 "$OUTPUT_TMP" "$OUTPUT"
+echo "Locked $(($(wc -l <"$OUTPUT") - 1)) Debian packages in $OUTPUT"