scutarius-firmware-rk3588-edk2 (1.4+scutarius.harma) adam; urgency=medium

  * Ships the org-built firmware instead of upstream release binaries:
    edk2-rk3588 from source with the org's Secure Boot keys enrolled by
    default and its logo, generated per org by
    scripts/pkg/package-firmware-rk3588.sh. Rock 5B only; the 5B+ has no
    org build and the flash helper refuses it.
  * Two images per board: rock-5b-secureboot.img (Secure Boot enforced from
    the first boot) and rock-5b-nosecureboot.img (same default keys, board
    left in Setup Mode). The installer picks one from the org setting
    ENABLE_SECURE_BOOT_ON_SUPPORTED_HOSTS; flash-rk3588-edk2-spi requires
    --secure-boot or --no-secure-boot.
  * The image is zero-padded to the firmware's variable store (0x7C0000):
    writing it replaces everything below the store and keeps the settings.
  * flash-rk3588-edk2-spi picks the image from the device tree's compatible
    and refuses any board it has no image for.

 -- Kristof Csillag <kristof.csillag@deai-labs.com>  Wed, 16 Sep 2026 21:40:00 +0200

scutarius-firmware-rk3588-edk2 (1.2+scutarius.harma) adam; urgency=medium

  * Org-tagged version (spec 2026-09-06 sec. 8); no content change.

 -- Kristof Csillag <kristof.csillag@deai-labs.com>  Tue, 08 Sep 2026 08:45:09 +0200

scutarius-firmware-rk3588-edk2 (1.1) adam; urgency=medium

  * Initial package: banked upstream edk2-rk3588 v1.1 release image for
    Rock 5B+ (the image running on peter), sha256 pinned, plus the
    flash-rk3588-edk2-spi helper. Spec: docs/superpowers/specs/
    2026-08-24-installer-sbc-media-design.md (S7, S8).

 -- Kristof Csillag <csillag.kristof@gmail.com>  Sun, 24 Aug 2026 12:00:00 +0200
