rk1/armbian/README.md

Armbian base image for Turing RK1

This directory builds the minimal, remotely manageable base for the RK1 media appliance. It targets Debian 13 (Trixie), Armbian's Rockchip vendor kernel, and the rk3588-turing-rk1.dtb. Kodi and the pinned RKMPP/RGA media stack are added by the higher-level project layers.

Build

Use a dedicated administrator public key. Password and root login are disabled in the resulting image.

./build-image.sh --ssh-public-key /absolute/path/to/id_ed25519.pub

Useful non-building checks:

./tests/lint.sh
./build-image.sh --ssh-public-key /absolute/path/to/id_ed25519.pub --prepare-only
./build-image.sh --ssh-public-key /absolute/path/to/id_ed25519.pub --config-dump

The framework checkout, source caches, build logs, and images live under .work/armbian-build/; completed images are in its output/images/ directory. The build command creates an image and checksum but never flashes a device.

What is locked

userpatches/source-lock.env pins the Armbian framework, the 6.1.115 Rockchip kernel source, U-Boot, Rockchip's required binary boot components, and Armbian firmware by commit hash. The custom rkbin-tools extension and framework git_sources.json override prevent the two stock moving master inputs from silently changing.

Debian and Armbian archive packages are resolved when the image is built, so byte-for-byte reproduction also requires retaining the generated package manifest and a snapshot of the package repositories. Every built image records the resolved package versions in /usr/share/rk1-media/package-manifest.tsv.

First boot and updates

• rkadmin is created with the supplied SSH public key and passwordless sudo.
• Root and user password hashes are replaced with an unusable value.
• SSH password, keyboard-interactive, and root authentication are disabled.
• Image-time SSH host keys are erased and regenerated before SSH starts.
• Ethernet uses Armbian's systemd-networkd DHCP configuration.
• Avahi advertises the fixed hostname rk1-media.local.
• overlays=panthor-gpu selects Mesa's Panthor DRM path instead of libMali.
• Armbian's independent filesystem-resize service remains enabled.
• Debian security updates are automatic; kernel, boot, BSP, and media packages remain held until a rebuilt image passes hardware acceptance tests.

The raw Armbian image is suitable for eMMC, NVMe, or removable-media flashing. Always identify the destination by model, size, and serial immediately before a write; the build wrapper deliberately contains no flashing operation.