137 lines
4.4 KiB
Bash
Executable File
137 lines
4.4 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -Eeuo pipefail
|
|
|
|
RELEASE="${1:?missing Armbian release}"
|
|
LINUXFAMILY="${2:?missing Linux family}"
|
|
BOARD="${3:?missing board}"
|
|
BUILD_DESKTOP="${4:?missing desktop flag}"
|
|
ARCH="${5:?missing architecture}"
|
|
|
|
readonly RELEASE LINUXFAMILY BOARD BUILD_DESKTOP ARCH
|
|
readonly OVERLAY_ROOT="/tmp/overlay/rootfs"
|
|
readonly AUTHORIZED_KEYS_INPUT="/tmp/overlay/build-input/authorized_keys"
|
|
readonly SOURCE_LOCK_INPUT="/tmp/overlay/build-input/source-lock.env"
|
|
|
|
fail() {
|
|
echo "rk1-media customize: $*" >&2
|
|
exit 1
|
|
}
|
|
|
|
configure_identity() {
|
|
printf '%s\n' "rk1-media" > /etc/hostname
|
|
if grep -Eq '^127\.0\.1\.1[[:space:]]' /etc/hosts; then
|
|
sed -Ei 's/^127\.0\.1\.1[[:space:]].*$/127.0.1.1 rk1-media/' /etc/hosts
|
|
else
|
|
printf '%s\n' '127.0.1.1 rk1-media' >> /etc/hosts
|
|
fi
|
|
}
|
|
|
|
configure_boot() {
|
|
local env_file="/boot/armbianEnv.txt"
|
|
local overlays
|
|
[[ -f "${env_file}" ]] || fail "Armbian boot environment is missing: ${env_file}"
|
|
|
|
if grep -q '^overlays=' "${env_file}"; then
|
|
overlays="$(sed -n 's/^overlays=//p' "${env_file}" | head -n 1)"
|
|
case " ${overlays} " in
|
|
*" panthor-gpu "*) ;;
|
|
*) sed -i "0,/^overlays=.*/s//overlays=${overlays} panthor-gpu/" "${env_file}" ;;
|
|
esac
|
|
else
|
|
printf '%s\n' 'overlays=panthor-gpu' >> "${env_file}"
|
|
fi
|
|
}
|
|
|
|
configure_admin() {
|
|
if ! getent group rkadmin >/dev/null; then
|
|
groupadd rkadmin
|
|
fi
|
|
if ! id rkadmin >/dev/null 2>&1; then
|
|
useradd --create-home --gid rkadmin --shell /bin/bash --comment "RK1 administrator" rkadmin
|
|
else
|
|
usermod --gid rkadmin rkadmin
|
|
fi
|
|
|
|
local group groups_csv
|
|
local -a groups=(sudo adm systemd-journal audio video render input)
|
|
local -a available_groups=()
|
|
for group in "${groups[@]}"; do
|
|
getent group "${group}" >/dev/null && available_groups+=("${group}")
|
|
done
|
|
groups_csv="$(IFS=,; echo "${available_groups[*]}")"
|
|
[[ -z "${groups_csv}" ]] || usermod --append --groups "${groups_csv}" rkadmin
|
|
|
|
install -d -o rkadmin -g rkadmin -m 0700 /home/rkadmin/.ssh
|
|
install -o rkadmin -g rkadmin -m 0600 "${AUTHORIZED_KEYS_INPUT}" /home/rkadmin/.ssh/authorized_keys
|
|
install -m 0440 /dev/null /etc/sudoers.d/90-rkadmin
|
|
printf '%s\n' 'rkadmin ALL=(ALL:ALL) NOPASSWD: ALL' > /etc/sudoers.d/90-rkadmin
|
|
visudo --check --file=/etc/sudoers.d/90-rkadmin >/dev/null
|
|
|
|
# Replace (rather than merely prefix) the build-time password hashes.
|
|
usermod --password '!' root
|
|
usermod --password '!' rkadmin
|
|
rm -f /root/.not_logged_in_yet
|
|
}
|
|
|
|
hold_platform_packages() {
|
|
local package
|
|
local -a held=()
|
|
while IFS= read -r package; do
|
|
case "${package}" in
|
|
linux-image-*|linux-dtb-*|linux-u-boot-*|armbian-bsp-*)
|
|
apt-mark hold "${package}" >/dev/null
|
|
held+=("${package}")
|
|
;;
|
|
esac
|
|
done < <(dpkg-query --show --showformat='${binary:Package}\n')
|
|
printf '%s\n' "${held[@]}" | LC_ALL=C sort -u > /usr/share/rk1-media/held-packages.txt
|
|
}
|
|
|
|
configure_services() {
|
|
install -d -m 0755 /var/lib/rk1-media
|
|
install -m 0600 /dev/null /var/lib/rk1-media/first-boot.pending
|
|
|
|
# Validate the complete SSH configuration, then remove generated host keys so
|
|
# every flashed module creates a unique set before ssh.service can start.
|
|
ssh-keygen -A
|
|
/usr/sbin/sshd -t
|
|
rm -f /etc/ssh/ssh_host_*
|
|
|
|
systemctl enable rk1-media-first-boot.service
|
|
systemctl enable ssh.service
|
|
systemctl enable avahi-daemon.service
|
|
systemctl enable apt-daily.timer
|
|
systemctl enable apt-daily-upgrade.timer
|
|
}
|
|
|
|
write_build_manifest() {
|
|
install -d -m 0755 /usr/share/rk1-media
|
|
install -m 0644 "${SOURCE_LOCK_INPUT}" /usr/share/rk1-media/source-lock.env
|
|
dpkg-query --show --showformat='${binary:Package}\t${Version}\t${Architecture}\n' \
|
|
| LC_ALL=C sort > /usr/share/rk1-media/package-manifest.tsv
|
|
}
|
|
|
|
main() {
|
|
[[ "${RELEASE}" == "trixie" ]] || fail "unexpected release: ${RELEASE}"
|
|
[[ "${BOARD}" == "turing-rk1" ]] || fail "unexpected board: ${BOARD}"
|
|
[[ "${BUILD_DESKTOP}" == "no" ]] || fail "desktop images are not supported by this customization"
|
|
[[ "${ARCH}" == "arm64" ]] || fail "unexpected architecture: ${ARCH}"
|
|
[[ -d "${OVERLAY_ROOT}" ]] || fail "rootfs overlay is missing"
|
|
[[ -s "${AUTHORIZED_KEYS_INPUT}" ]] || fail "authorized_keys build input is missing"
|
|
[[ -s "${SOURCE_LOCK_INPUT}" ]] || fail "source lock build input is missing"
|
|
|
|
cp -a "${OVERLAY_ROOT}/." /
|
|
configure_identity
|
|
configure_boot
|
|
configure_admin
|
|
write_build_manifest
|
|
hold_platform_packages
|
|
configure_services
|
|
|
|
# systemd creates a unique machine ID on the first real boot.
|
|
: > /etc/machine-id
|
|
rm -f /var/lib/dbus/machine-id
|
|
}
|
|
|
|
main "$@"
|