-
Notifications
You must be signed in to change notification settings - Fork 9
RDKB-62985 RDKB-62986: Native build for Coverity #39
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Changes from 11 commits
111e0f9
ade908b
cde2cec
3e3633a
e576e65
919e89e
beae32e
76dfd24
78d72b0
a48ab3e
155de65
056451a
c2a5b41
2615d01
2bcf44c
bc067ea
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change | ||||||||
|---|---|---|---|---|---|---|---|---|---|---|
| @@ -0,0 +1,36 @@ | ||||||||||
| name: Build Advanced Security Component in Native Environment | ||||||||||
|
|
||||||||||
| on: | ||||||||||
| push: | ||||||||||
| branches: [ main, 'sprint/**', 'release/**', develop ] | ||||||||||
| pull_request: | ||||||||||
| branches: [ main, 'sprint/**', 'release/**', topic/RDK*, develop ] | ||||||||||
|
|
||||||||||
| jobs: | ||||||||||
| build-advanced-security-on-pr: | ||||||||||
| name: Build advanced-security component in github rdkcentral | ||||||||||
| runs-on: ubuntu-latest | ||||||||||
| container: | ||||||||||
| image: ghcr.io/rdkcentral/docker-rdk-ci:latest | ||||||||||
|
|
||||||||||
| steps: | ||||||||||
| - name: Checkout code | ||||||||||
| uses: actions/checkout@v3 | ||||||||||
|
||||||||||
| uses: actions/checkout@v3 | |
| uses: actions/checkout@v4 |
Copilot
AI
Feb 11, 2026
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
actions/checkout@v3 is outdated and misses fixes/features added in newer major versions. Bump to the current supported major version (and consider pinning to a commit SHA for supply-chain hardening).
| uses: actions/checkout@v3 | |
| uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 |
Copilot
AI
Feb 11, 2026
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Setting safe.directory to '*' disables git’s ownership safety checks globally for all repos in the container, which is broader than needed. Prefer scoping this to the checked-out workspace only (e.g., add the specific working directory) so other directories remain protected.
| git config --global --add safe.directory '*' | |
| git config --global --add safe.directory "$GITHUB_WORKSPACE" |
Copilot
AI
Feb 9, 2026
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Overriding GITHUB_TOKEN with a separate secret increases the risk of accidental token exposure (e.g., script logging) and can also break PR builds from forks where secrets aren’t available. Prefer the built-in GitHub token (${{ github.token }} / ${{ secrets.GITHUB_TOKEN }}) or pass a separate token under a different env var name with the minimum required permissions.
| GITHUB_TOKEN: ${{ secrets.RDKCM_RDKE }} | |
| GITHUB_TOKEN: ${{ github.token }} | |
| RDKCM_RDKE_TOKEN: ${{ secrets.RDKCM_RDKE }} |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,4 @@ | ||
| [submodule "build_tools_workflows"] | ||
| path = build_tools_workflows | ||
| url = https://github.com/rdkcentral/build_tools_workflows | ||
| branch = develop |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,3 @@ | ||
| # 🔧 Coverity Native Build System for RDK-B Components | ||
|
|
||
| The documentation and source for the RDK-B native build system has been centralized in [rdkcentral/build_tools_workflows](https://github.com/rdkcentral/build_tools_workflows/blob/develop/cov_docker_script/README.md) |
| Original file line number | Diff line number | Diff line change | ||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| @@ -0,0 +1,111 @@ | ||||||||||||||||||||||||||
| { | ||||||||||||||||||||||||||
| "_comment": "Component Build Configuration for Coverity/Native Builds", | ||||||||||||||||||||||||||
| "_version": "2.0", | ||||||||||||||||||||||||||
| "_description": "Defines dependencies and build settings for the native component", | ||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||
| "dependencies": { | ||||||||||||||||||||||||||
|
||||||||||||||||||||||||||
| "dependencies": { | |
| "dependencies": { |
Copilot
AI
Feb 9, 2026
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The same source directory is copied to two different destinations, including the include root (.../rdkb/). This can unintentionally flatten/duplicate headers and change include resolution order. Keep only the canonical destination (likely .../rdkb/linux) or copy only specific headers into the root if that’s required.
| { "source": "source/cosa/include/linux", "destination": "$HOME/usr/include/rdkb/" }, |
Outdated
Copilot
AI
Jan 19, 2026
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The source_patches array contains duplicate patches for the same change. Patches at indices 0 and 1 both attempt to add the same DBusLoop forward declaration to ccsp_message_bus.h, but target different file paths. The second patch targets a file in $HOME/usr/include/rdkb/ which suggests it's patching the already-copied header. This duplication is confusing and could lead to patch failures if the first patch succeeds but the second one doesn't find the expected content. Consider removing the duplicate patch or clarifying why both are needed.
| }, | |
| { | |
| "file": "$HOME/usr/include/rdkb/ccsp_message_bus.h", | |
| "search": "typedef struct _CCSP_MESSAGE_BUS_CONNECTION", | |
| "replace": "typedef struct DBusLoop DBusLoop;\n\ntypedef struct _CCSP_MESSAGE_BUS_CONNECTION" |
Outdated
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Do we require this source patch field ? could you please check how moca-agent and utopia is used ?
Outdated
Copilot
AI
Jan 19, 2026
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The source_patches configuration in the dependencies section is not processed by setup_dependencies.sh. The script only processes header_paths and build configuration for dependencies, but the source_patches array defined here will be silently ignored. If patches are needed for dependencies, they should either be handled in setup_dependencies.sh or this configuration should be removed to avoid confusion.
| ], | |
| "source_patches": [ | |
| { | |
| "file": "source/ccsp/include/ccsp_message_bus.h", | |
| "search": "typedef struct _CCSP_MESSAGE_BUS_CONNECTION", | |
| "replace": "typedef struct DBusLoop DBusLoop;\n\ntypedef struct _CCSP_MESSAGE_BUS_CONNECTION" | |
| }, | |
| { | |
| "file": "$HOME/usr/include/rdkb/ccsp_message_bus.h", | |
| "search": "typedef struct _CCSP_MESSAGE_BUS_CONNECTION", | |
| "replace": "typedef struct DBusLoop DBusLoop;\n\ntypedef struct _CCSP_MESSAGE_BUS_CONNECTION" | |
| } |
|
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Is this configuration taken from do_compile log ? |
| Original file line number | Diff line number | Diff line change | ||||||||
|---|---|---|---|---|---|---|---|---|---|---|
| @@ -0,0 +1,138 @@ | ||||||||||
| # Common Library Agent Configure Options | ||||||||||
| # This file contains autotools configure options for the common-library component | ||||||||||
| # Each section can be edited independently for better maintainability | ||||||||||
|
|
||||||||||
| # ============================================================================ | ||||||||||
| # CPPFLAGS - Preprocessor flags (includes and defines) | ||||||||||
| # ============================================================================ | ||||||||||
| [CPPFLAGS] | ||||||||||
| # Autotools configuration | ||||||||||
| -DHAVE_CONFIG_H | ||||||||||
|
|
||||||||||
| # Include paths | ||||||||||
| -I$HOME/usr/include/rdkb/ | ||||||||||
| -I/usr/include/dbus-1.0 | ||||||||||
| -I/usr/lib/x86_64-linux-gnu/dbus-1.0/include | ||||||||||
| -I/usr/include/cjson | ||||||||||
|
|
||||||||||
| # Core system defines | ||||||||||
| -DSAFEC_DUMMY_API | ||||||||||
| -D_COSA_HAL_ | ||||||||||
| -U_COSA_SIM_ | ||||||||||
| -DCONFIG_SYSTEM_MOCA | ||||||||||
|
|
||||||||||
| # ANSC framework defines | ||||||||||
| -D_ANSC_LINUX | ||||||||||
| -D_ANSC_USER | ||||||||||
| -D_ANSC_LITTLE_ENDIAN_ | ||||||||||
| -D_ANSC_USE_OPENSSL_ | ||||||||||
| -D_ANSC_AES_USED_ | ||||||||||
| -D_NO_ANSC_ZLIB_ | ||||||||||
| -U_ANSC_IPV6_COMPATIBLE_ | ||||||||||
|
|
||||||||||
| # CCSP/Component defines | ||||||||||
| -D_CCSP_CWMP_TCP_CONNREQ_HANDLER | ||||||||||
| -D_DSLH_STUN_ | ||||||||||
| -D_NO_PKI_KB5_SUPPORT | ||||||||||
| -D_BBHM_SSE_FILE_IO | ||||||||||
| -DCCSP_SUPPORT_ENABLED | ||||||||||
|
|
||||||||||
| # Product/Platform defines | ||||||||||
| -D_COSA_INTEL_USG_ARM_ | ||||||||||
| -D_COSA_FOR_COMCAST_ | ||||||||||
| -D_COSA_BCM_ARM_ | ||||||||||
| -D_XB6_PRODUCT_REQ_ | ||||||||||
| -D_XB7_PRODUCT_REQ_ | ||||||||||
| -D_XB8_PRODUCT_REQ_ | ||||||||||
|
|
||||||||||
| # Vendor/Customer configuration | ||||||||||
| -DCONFIG_VENDOR_CUSTOMER_COMCAST | ||||||||||
| -DCONFIG_CISCO_HOTSPOT | ||||||||||
| -DCONFIG_VENDOR_NAME | ||||||||||
|
|
||||||||||
| # Security and debugging | ||||||||||
| -DENABLE_SA_KEY | ||||||||||
| -D_NO_EXECINFO_H_ | ||||||||||
| -D_DEBUG | ||||||||||
| -DINCLUDE_BREAKPAD | ||||||||||
|
|
||||||||||
| # System features | ||||||||||
| -DFEATURE_SUPPORT_RDKLOG | ||||||||||
| -DFEATURE_SUPPORT_SYSLOG | ||||||||||
| -DBUILD_WEB | ||||||||||
| -DUSE_NOTIFY_COMPONENT | ||||||||||
| -DNTPD_ENABLE | ||||||||||
| -DUTC_ENABLE | ||||||||||
| -DUTC_ENABLE_ATOM | ||||||||||
| -DXDNS_ENABLE | ||||||||||
|
|
||||||||||
| # Network features | ||||||||||
| -DENABLE_ETH_WAN | ||||||||||
| -DEROUTER_DHCP_OPTION_MTA | ||||||||||
| -DETH_4_PORTS | ||||||||||
| -D_2_5G_ETHERNET_SUPPORT_ | ||||||||||
| -D_MACSEC_SUPPORT_ | ||||||||||
| -D_BRIDGE_UTILS_BIN_ | ||||||||||
| -DAUTOWAN_ENABLE | ||||||||||
| -DENABLE_WANMODECHANGE_NOREBOOT | ||||||||||
| -DFEATURE_RDKB_WAN_MANAGER | ||||||||||
| -DFEATURE_RDKB_CONFIGURABLE_WAN_INTERFACE | ||||||||||
| -DWAN_MANAGER_UNIFICATION_ENABLED | ||||||||||
| -DWAN_FAILOVER_SUPPORTED | ||||||||||
| -DGATEWAY_FAILOVER_SUPPORTED | ||||||||||
|
|
||||||||||
| # WiFi features | ||||||||||
| -D_ENABLE_BAND_STEERING_ | ||||||||||
| -D_BEACONRATE_SUPPORT | ||||||||||
| -D_TRI_BAND_WIFI_ | ||||||||||
| -D_WIFI_AX_SUPPORT_ | ||||||||||
| -D_WIFI_CONSOLIDATED_STANDARDS_ | ||||||||||
| -DWIFI_HAL_VERSION_3 | ||||||||||
| -DFEATURE_SUPPORT_MESH | ||||||||||
| -DFEATURE_SUPPORT_WEBCONFIG | ||||||||||
| -DFEATURE_SUPPORT_INTERWORKING | ||||||||||
| -DFEATURE_SUPPORT_PASSPOINT | ||||||||||
| -DWIFI_STATS_DISABLE_SPEEDTEST_RUNNING | ||||||||||
| -DFEATURE_SUPPORT_RADIUSGREYLIST | ||||||||||
| -DFEATURE_SUPPORT_ACL_SELFHEAL | ||||||||||
| -DFEATURE_CSI | ||||||||||
| -DFEATURE_SUPPORT_ONBOARD_LOGGING | ||||||||||
| -DFEATURE_OFF_CHANNEL_SCAN_5G | ||||||||||
| -DRDK_ONEWIFI | ||||||||||
| -DWIFI_MANAGE_SUPPORTED | ||||||||||
|
|
||||||||||
| # Advanced features | ||||||||||
| -D_PSM_TRANS_RDK_TRIGG_ | ||||||||||
| -D_CM_HIGHSPLIT_SUPPORTED_ | ||||||||||
| -DFEATURE_RDKB_INTER_DEVICE_MANAGER | ||||||||||
| -DFEATURE_SUPPORT_MAPT_NAT46 | ||||||||||
| -DMAPT_UNIFICATION_ENABLED | ||||||||||
| -DSPEED_BOOST_SUPPORTED | ||||||||||
| -DAMENITIES_NETWORK_ENABLED | ||||||||||
|
|
||||||||||
| # Test/Development | ||||||||||
| -DCOLUMBO_HWTEST | ||||||||||
|
|
||||||||||
| # Build system | ||||||||||
| -DRBUS_BUILD_FLAG_ENABLE | ||||||||||
|
|
||||||||||
| # Standard defines | ||||||||||
| -D_GNU_SOURCE | ||||||||||
| -D__USE_XOPEN | ||||||||||
|
|
||||||||||
| # ============================================================================ | ||||||||||
| # CFLAGS - Compiler flags | ||||||||||
| # ============================================================================ | ||||||||||
| [CFLAGS] | ||||||||||
| -ffunction-sections | ||||||||||
| -fdata-sections | ||||||||||
| -fomit-frame-pointer | ||||||||||
| -fno-strict-aliasing | ||||||||||
|
|
||||||||||
| # ============================================================================ | ||||||||||
| # LDFLAGS - Linker flags | ||||||||||
| # ============================================================================ | ||||||||||
| [LDFLAGS] | ||||||||||
| -L$HOME/usr/local/lib/ | ||||||||||
| -Wl,--allow-shlib-undefined | ||||||||||
| -Wl,--unresolved-symbols=ignore-all | ||||||||||
|
||||||||||
| -Wl,--unresolved-symbols=ignore-all |
Outdated
Copilot
AI
Feb 11, 2026
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
These linker flags can mask real link errors by allowing/ignoring unresolved symbols. If the goal is only to get a native build far enough for analysis, consider restricting this to specific known problematic libs or making it conditional (e.g., only for Coverity runs), so normal native builds still fail fast on genuine link issues.
| -Wl,--unresolved-symbols=ignore-all | |
| # NOTE: Avoid masking unresolved symbols; keep this disabled so real link errors are reported. | |
| # -Wl,--unresolved-symbols=ignore-all |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Using the
latesttag makes CI non-reproducible and can break builds when the image changes. Pin the container image to a specific version tag or immutable digest (e.g.,@sha256:...) so Coverity/native builds are stable over time.