# Armbian base image for Turing RK1

This directory builds the minimal, remotely manageable base for the RK1 media
appliance. It targets Debian 13 (Trixie), Armbian's Rockchip vendor kernel, and
the `rk3588-turing-rk1.dtb`. Kodi and the pinned RKMPP/RGA media stack are added
by the higher-level project layers.

## Build

Use a dedicated administrator public key. Password and root login are disabled
in the resulting image.

```bash
./build-image.sh --ssh-public-key /absolute/path/to/id_ed25519.pub
```

Useful non-building checks:

```bash
./tests/lint.sh
./build-image.sh --ssh-public-key /absolute/path/to/id_ed25519.pub --prepare-only
./build-image.sh --ssh-public-key /absolute/path/to/id_ed25519.pub --config-dump
```

The framework checkout, source caches, build logs, and images live under
`.work/armbian-build/`; completed images are in its `output/images/` directory.
The build command creates an image and checksum but never flashes a device.

## What is locked

`userpatches/source-lock.env` pins the Armbian framework, the 6.1.115 Rockchip
kernel source, U-Boot, Rockchip's required binary boot components, and Armbian
firmware by commit hash. The custom `rkbin-tools` extension and framework
`git_sources.json` override prevent the two stock moving `master` inputs from
silently changing.

Debian and Armbian archive packages are resolved when the image is built, so
byte-for-byte reproduction also requires retaining the generated package
manifest and a snapshot of the package repositories. Every built image records
the resolved package versions in `/usr/share/rk1-media/package-manifest.tsv`.

## First boot and updates

- `rkadmin` is created with the supplied SSH public key and passwordless sudo.
- Root and user password hashes are replaced with an unusable value.
- SSH password, keyboard-interactive, and root authentication are disabled.
- Image-time SSH host keys are erased and regenerated before SSH starts.
- Ethernet uses Armbian's systemd-networkd DHCP configuration.
- Avahi advertises the fixed hostname `rk1-media.local`.
- `overlays=panthor-gpu` selects Mesa's Panthor DRM path instead of libMali.
- Armbian's independent filesystem-resize service remains enabled.
- Debian security updates are automatic; kernel, boot, BSP, and media packages
  remain held until a rebuilt image passes hardware acceptance tests.

The raw Armbian image is suitable for eMMC, NVMe, or removable-media flashing.
Always identify the destination by model, size, and serial immediately before a
write; the build wrapper deliberately contains no flashing operation.