66 lines
3.1 KiB
Markdown
66 lines
3.1 KiB
Markdown
# Design and source lock
|
||
|
||
## Production artifact inputs
|
||
|
||
- Armbian Community 26.11.0-trunk.1 Turing RK1 Trixie minimal image, vendor
|
||
kernel 6.1.115: SHA-256
|
||
`cbbd16d90786331fbfbbb695614a53f5e87ea441ea37b425d986334318190cf6`.
|
||
- Repacked Kodi/RKMPP appliance package: SHA-256
|
||
`dd0ca68696aa35b1998f9c9e131fdf8f0d1ef4ba6f58a36d0d99f0625d47f430`.
|
||
- RKNN Toolkit2 v2.3.2 commit
|
||
`42aa1d426c0a9e0869b6374edba009f7208a1926`, with per-asset checksums.
|
||
- 140 Debian Trixie dependency packages locked by filename, size, SHA-256, and
|
||
signed-index URL in `packages/debian-packages.lock.tsv`.
|
||
|
||
The upstream Kodi release recipe followed moving branches, so its immutable
|
||
release asset SHA-256 is the authoritative input for the fast repack path. A
|
||
fully source-pinned native build recipe is retained with these commits:
|
||
|
||
- MPP `a9380ef333102ac318628f83b5f7a460d377749e`
|
||
- RGA `1d330cc28551943bed3380261a5a9c6fbd58ff53`
|
||
- FFmpeg-Rockchip `d90e3a1c18d7929383cf88c1b3da2e2d1c966cbf`
|
||
- dav1d `b546257f770768b2c88258c533da38b91a06f737`
|
||
- libdisplay-info `f1b75310181e364f97a16464efcd92bc82e57ccc`
|
||
- Kodi `9c56bf593441a6c246fdc6931177e71f349ee2bc`
|
||
|
||
The source-level Armbian base recipe separately pins:
|
||
|
||
- Armbian framework `ea18947bed789c829a260df129e815c353c14908`
|
||
- Rockchip kernel 6.1.115 `5280f9b4336199c4025c8eed894d2b4e2268dcc6`
|
||
- U-Boot `ece349ade2973e220f524ce59e59711cc919263f`
|
||
- RKBin `452f49a987097d7ca675811e51a873b42ebd101f`
|
||
- Armbian firmware `d9846710f54da5e4383e2d67311819659ac2cf5c`
|
||
|
||
## Trust and update boundaries
|
||
|
||
The vendor kernel, Rockchip binary boot components, RKNN runtime, and upstream
|
||
Kodi media integration are trusted community/vendor inputs, not Debian or
|
||
LibreELEC-supported RK1 components. Each is pinned and isolated, but pins do not
|
||
turn proprietary firmware/runtime blobs into auditable source.
|
||
|
||
Debian security updates run automatically. Kernel, DTB, U-Boot/BSP, Mesa/media,
|
||
and RKNN changes are deliberately excluded from unattended upgrades because
|
||
they must move together and pass the physical acceptance suite. Rebuild and
|
||
requalify the image to update those layers.
|
||
|
||
The open GPU and proprietary GPU stacks are mutually exclusive in practice:
|
||
Panthor/Panfrost/PanVK is selected for KMS, OpenGL, Vulkan, and Kodi stability;
|
||
Mali kbase/libMali/OpenCL is not installed. NPU compute is provided separately
|
||
by RKNN.
|
||
|
||
## Security posture
|
||
|
||
- No default or image-time password remains; root’s shadow field is exactly
|
||
`!` before the raw image is emitted.
|
||
- SSH accepts public keys only, refuses root, and is ordered after unique host
|
||
key generation. The identity unit creates SSH's `/run/sshd` runtime directory
|
||
before validating the daemon configuration; `ssh.service` recreates it for
|
||
its own lifetime. Armbian’s later first-run key regeneration is disabled.
|
||
- The build rejects private-key input and authorized-key options.
|
||
- Kodi runs under a locked system user with device groups and systemd sandboxing.
|
||
- Package and injected-directory modes are normalized and asserted so a
|
||
collaborative host umask cannot make `/`, `/etc`, `/usr`, or `/opt`
|
||
group-writable.
|
||
- First-boot package installation is fully offline; APT simulation proves its
|
||
dependency closure before image creation.
|