rk1/DESIGN.md

Design and source lock

Production artifact inputs

• Armbian Community 26.11.0-trunk.1 Turing RK1 Trixie minimal image, vendor kernel 6.1.115: SHA-256 cbbd16d90786331fbfbbb695614a53f5e87ea441ea37b425d986334318190cf6.
• Repacked Kodi/RKMPP appliance package: SHA-256 dd0ca68696aa35b1998f9c9e131fdf8f0d1ef4ba6f58a36d0d99f0625d47f430.
• RKNN Toolkit2 v2.3.2 commit 42aa1d426c0a9e0869b6374edba009f7208a1926, with per-asset checksums.
• 140 Debian Trixie dependency packages locked by filename, size, SHA-256, and signed-index URL in packages/debian-packages.lock.tsv.

The upstream Kodi release recipe followed moving branches, so its immutable release asset SHA-256 is the authoritative input for the fast repack path. A fully source-pinned native build recipe is retained with these commits:

• MPP a9380ef333102ac318628f83b5f7a460d377749e
• RGA 1d330cc28551943bed3380261a5a9c6fbd58ff53
• FFmpeg-Rockchip d90e3a1c18d7929383cf88c1b3da2e2d1c966cbf
• dav1d b546257f770768b2c88258c533da38b91a06f737
• libdisplay-info f1b75310181e364f97a16464efcd92bc82e57ccc
• Kodi 9c56bf593441a6c246fdc6931177e71f349ee2bc

The source-level Armbian base recipe separately pins:

• Armbian framework ea18947bed789c829a260df129e815c353c14908
• Rockchip kernel 6.1.115 5280f9b4336199c4025c8eed894d2b4e2268dcc6
• U-Boot ece349ade2973e220f524ce59e59711cc919263f
• RKBin 452f49a987097d7ca675811e51a873b42ebd101f
• Armbian firmware d9846710f54da5e4383e2d67311819659ac2cf5c

Trust and update boundaries

The vendor kernel, Rockchip binary boot components, RKNN runtime, and upstream Kodi media integration are trusted community/vendor inputs, not Debian or LibreELEC-supported RK1 components. Each is pinned and isolated, but pins do not turn proprietary firmware/runtime blobs into auditable source.

Debian security updates run automatically. Kernel, DTB, U-Boot/BSP, Mesa/media, and RKNN changes are deliberately excluded from unattended upgrades because they must move together and pass the physical acceptance suite. Rebuild and requalify the image to update those layers.

The open GPU and proprietary GPU stacks are mutually exclusive in practice: Panthor/Panfrost/PanVK is selected for KMS, OpenGL, Vulkan, and Kodi stability; Mali kbase/libMali/OpenCL is not installed. NPU compute is provided separately by RKNN.

Security posture

• No default or image-time password remains; root’s shadow field is exactly ! before the raw image is emitted.
• SSH accepts public keys only, refuses root, and is ordered after unique host key generation. The identity unit creates SSH's /run/sshd runtime directory before validating the daemon configuration; ssh.service recreates it for its own lifetime. Armbian’s later first-run key regeneration is disabled.
• The build rejects private-key input and authorized-key options.
• Kodi runs under a locked system user with device groups and systemd sandboxing.
• Package and injected-directory modes are normalized and asserted so a collaborative host umask cannot make /, /etc, /usr, or /opt group-writable.
• First-boot package installation is fully offline; APT simulation proves its dependency closure before image creation.