Skip to content
Merged
Show file tree
Hide file tree
Changes from 11 commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
36 changes: 36 additions & 0 deletions .github/workflows/native-build.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,36 @@
name: Build Advanced Security Component in Native Environment

on:
push:
branches: [ main, 'sprint/**', 'release/**', develop ]
pull_request:
branches: [ main, 'sprint/**', 'release/**', topic/RDK*, develop ]

jobs:
build-advanced-security-on-pr:
name: Build advanced-security component in github rdkcentral
runs-on: ubuntu-latest
container:
image: ghcr.io/rdkcentral/docker-rdk-ci:latest
Copy link

Copilot AI Feb 9, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Using the latest tag makes CI non-reproducible and can break builds when the image changes. Pin the container image to a specific version tag or immutable digest (e.g., @sha256:...) so Coverity/native builds are stable over time.

Suggested change
image: ghcr.io/rdkcentral/docker-rdk-ci:latest
image: ghcr.io/rdkcentral/docker-rdk-ci:1.5.0

Copilot uses AI. Check for mistakes.

steps:
- name: Checkout code
uses: actions/checkout@v3
Copy link

Copilot AI Feb 9, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

actions/checkout@v3 is outdated. Update to actions/checkout@v4 (or the repository-standard pinned major) to pick up security and performance fixes.

Suggested change
uses: actions/checkout@v3
uses: actions/checkout@v4

Copilot uses AI. Check for mistakes.
Copy link

Copilot AI Feb 11, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

actions/checkout@v3 is outdated and misses fixes/features added in newer major versions. Bump to the current supported major version (and consider pinning to a commit SHA for supply-chain hardening).

Suggested change
uses: actions/checkout@v3
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

Copilot uses AI. Check for mistakes.

- name: native build
run: |
# Trust the workspace
git config --global --add safe.directory '*'
Copy link

Copilot AI Feb 11, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Setting safe.directory to '*' disables git’s ownership safety checks globally for all repos in the container, which is broader than needed. Prefer scoping this to the checked-out workspace only (e.g., add the specific working directory) so other directories remain protected.

Suggested change
git config --global --add safe.directory '*'
git config --global --add safe.directory "$GITHUB_WORKSPACE"

Copilot uses AI. Check for mistakes.

# Pull the latest changes for the native build system
git submodule update --init --recursive --remote

# Build and install dependencies
chmod +x build_tools_workflows/cov_docker_script/setup_dependencies.sh
./build_tools_workflows/cov_docker_script/setup_dependencies.sh ./cov_docker_script/component_config.json

# Build component
chmod +x build_tools_workflows/cov_docker_script/build_native.sh
./build_tools_workflows/cov_docker_script/build_native.sh ./cov_docker_script/component_config.json "$(pwd)"
env:
GITHUB_TOKEN: ${{ secrets.RDKCM_RDKE }}
Copy link

Copilot AI Feb 9, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Overriding GITHUB_TOKEN with a separate secret increases the risk of accidental token exposure (e.g., script logging) and can also break PR builds from forks where secrets aren’t available. Prefer the built-in GitHub token (${{ github.token }} / ${{ secrets.GITHUB_TOKEN }}) or pass a separate token under a different env var name with the minimum required permissions.

Suggested change
GITHUB_TOKEN: ${{ secrets.RDKCM_RDKE }}
GITHUB_TOKEN: ${{ github.token }}
RDKCM_RDKE_TOKEN: ${{ secrets.RDKCM_RDKE }}

Copilot uses AI. Check for mistakes.
4 changes: 4 additions & 0 deletions .gitmodules
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@
[submodule "build_tools_workflows"]
path = build_tools_workflows
url = https://github.com/rdkcentral/build_tools_workflows
branch = develop
1 change: 1 addition & 0 deletions build_tools_workflows
Submodule build_tools_workflows added at 11f192
3 changes: 3 additions & 0 deletions cov_docker_script/README.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,3 @@
# 🔧 Coverity Native Build System for RDK-B Components

The documentation and source for the RDK-B native build system has been centralized in [rdkcentral/build_tools_workflows](https://github.com/rdkcentral/build_tools_workflows/blob/develop/cov_docker_script/README.md)
111 changes: 111 additions & 0 deletions cov_docker_script/component_config.json
Original file line number Diff line number Diff line change
@@ -0,0 +1,111 @@
{
"_comment": "Component Build Configuration for Coverity/Native Builds",
"_version": "2.0",
"_description": "Defines dependencies and build settings for the native component",

"dependencies": {
Copy link

Copilot AI Feb 9, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

JSON indentation is inconsistent here (this key doesn’t align with surrounding fields). Reformatting the file with a consistent JSON formatter will make future edits and reviews less error-prone.

Suggested change
"dependencies": {
"dependencies": {

Copilot uses AI. Check for mistakes.
"_comment": "External repositories needed by this component",
"repos": [
{
"name": "common-library",
"repo": "https://github.com/rdkcentral/common-library.git",
"branch": "develop",
"header_paths": [
{ "source": "source/cosa/include", "destination": "$HOME/usr/include/rdkb" },
{ "source": "source/cosa/include/linux", "destination": "$HOME/usr/include/rdkb/linux" },
{ "source": "source/cosa/include/linux", "destination": "$HOME/usr/include/rdkb/" },
Copy link

Copilot AI Feb 9, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The same source directory is copied to two different destinations, including the include root (.../rdkb/). This can unintentionally flatten/duplicate headers and change include resolution order. Keep only the canonical destination (likely .../rdkb/linux) or copy only specific headers into the root if that’s required.

Suggested change
{ "source": "source/cosa/include/linux", "destination": "$HOME/usr/include/rdkb/" },

Copilot uses AI. Check for mistakes.
{ "source": "source/ccsp/custom", "destination": "$HOME/usr/include/rdkb" },
{ "source": "source/ccsp/include", "destination": "$HOME/usr/include/rdkb" },
{ "source": "source/debug_api/include", "destination": "$HOME/usr/include/rdkb" },
{ "source": "source/util_api/http/include", "destination": "$HOME/usr/include/rdkb" },
{ "source": "source/ccsp/components/include", "destination": "$HOME/usr/include/rdkb" },
{ "source": "source/util_api/ansc/include", "destination": "$HOME/usr/include/rdkb" },
{ "source": "source/dm_pack", "destination": "$HOME/usr/include/rdkb" },
{ "source": "source/cosa/package/slap/include", "destination": "$HOME/usr/include/rdkb" },
{ "source": "source/ccsp/components/common/MessageBusHelper/include", "destination": "$HOME/usr/include/rdkb" }
],
"source_patches": [
{
"file": "source/ccsp/include/ccsp_message_bus.h",
"search": "typedef struct _CCSP_MESSAGE_BUS_CONNECTION",
"replace": "typedef struct DBusLoop DBusLoop;\n\ntypedef struct _CCSP_MESSAGE_BUS_CONNECTION"
},
{
"file": "$HOME/usr/include/rdkb/ccsp_message_bus.h",
"search": "typedef struct _CCSP_MESSAGE_BUS_CONNECTION",
"replace": "typedef struct DBusLoop DBusLoop;\n\ntypedef struct _CCSP_MESSAGE_BUS_CONNECTION"
Copy link

Copilot AI Jan 19, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The source_patches array contains duplicate patches for the same change. Patches at indices 0 and 1 both attempt to add the same DBusLoop forward declaration to ccsp_message_bus.h, but target different file paths. The second patch targets a file in $HOME/usr/include/rdkb/ which suggests it's patching the already-copied header. This duplication is confusing and could lead to patch failures if the first patch succeeds but the second one doesn't find the expected content. Consider removing the duplicate patch or clarifying why both are needed.

Suggested change
},
{
"file": "$HOME/usr/include/rdkb/ccsp_message_bus.h",
"search": "typedef struct _CCSP_MESSAGE_BUS_CONNECTION",
"replace": "typedef struct DBusLoop DBusLoop;\n\ntypedef struct _CCSP_MESSAGE_BUS_CONNECTION"

Copilot uses AI. Check for mistakes.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do we require this source patch field ? could you please check how moca-agent and utopia is used ?

}
Copy link

Copilot AI Jan 19, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The source_patches configuration in the dependencies section is not processed by setup_dependencies.sh. The script only processes header_paths and build configuration for dependencies, but the source_patches array defined here will be silently ignored. If patches are needed for dependencies, they should either be handled in setup_dependencies.sh or this configuration should be removed to avoid confusion.

Suggested change
],
"source_patches": [
{
"file": "source/ccsp/include/ccsp_message_bus.h",
"search": "typedef struct _CCSP_MESSAGE_BUS_CONNECTION",
"replace": "typedef struct DBusLoop DBusLoop;\n\ntypedef struct _CCSP_MESSAGE_BUS_CONNECTION"
},
{
"file": "$HOME/usr/include/rdkb/ccsp_message_bus.h",
"search": "typedef struct _CCSP_MESSAGE_BUS_CONNECTION",
"replace": "typedef struct DBusLoop DBusLoop;\n\ntypedef struct _CCSP_MESSAGE_BUS_CONNECTION"
}

Copilot uses AI. Check for mistakes.
],
"build": {
"type": "script",
"script": "build_tools_workflows/cov_docker_script/common_external_build.sh"
}
},
{
"name": "rdkb-halif-platform",
"repo": "https://github.com/rdkcentral/rdkb-halif-platform.git",
"branch": "main",
"header_paths": [
{ "source": "include", "destination": "$HOME/usr/include/rdkb/ccsp" }
]
},
{
"name": "rdkb-halif-cm",
"repo": "https://github.com/rdkcentral/rdkb-halif-cm.git",
"branch": "main",
"header_paths": [
{ "source": "include", "destination": "$HOME/usr/include/rdkb/ccsp" }
]
},
{
"name": "rbus",
"repo": "https://github.com/rdkcentral/rbus.git",
"branch": "v2.7.0",
"header_paths": [
{ "source": "include", "destination": "$HOME/usr/include/rdkb/rbus" },
{ "source": "src/rbus", "destination": "$HOME/usr/include/rdkb/rbus" }
]
},
{
"name": "WebconfigFramework",
"repo": "https://github.com/rdkcentral/WebconfigFramework.git",
"branch": "develop",
"header_paths": [
{ "source": "include", "destination": "$HOME/usr/include/rdkb" }
],
"build": {
"type": "autotools",
"configure_flags": "CPPFLAGS=\"-I$HOME/usr/include/rdkb -I$HOME/usr/include/rdkb/rbus -I$HOME/usr/local/include -I$HOME/usr/include/rdkb/rtmessage\" LDFLAGS=\"-L$HOME/usr/local/lib -L$HOME/usr/lib\" LIBS=\"-lrbus -lrtMessage\""
}
},
{
"name": "Utopia",
"repo": "https://github.com/rdkcentral/utopia.git",
"branch": "develop",
"header_paths": [
{ "source": "source/include/syscfg", "destination": "$HOME/usr/include/rdkb/syscfg" }
],
"build": {
"type": "script",
"script": "build_tools_workflows/cov_docker_script/common_external_build.sh"
}
}
]
},
"native_component": {
"_comment": "Configuration for the main component being built",
"name": "advanced-security",
"include_path": "$HOME/usr/include/rdkb/",
"lib_output_path": "$HOME/usr/local/lib/",
"pre_build_commands": [
{
"description": "Generate dm_pack_datamodel.c from XML",
"command": "python3 $HOME/usr/include/rdkb/dm_pack_code_gen.py config/TR181-AdvSecurity.xml source/AdvSecuritySsp/dm_pack_datamodel.c"
}
],
"build": {
"type": "autotools",
"configure_options_file": "cov_docker_script/configure_options.conf"
}
}
}
138 changes: 138 additions & 0 deletions cov_docker_script/configure_options.conf
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is this configuration taken from do_compile log ?

Original file line number Diff line number Diff line change
@@ -0,0 +1,138 @@
# Common Library Agent Configure Options
# This file contains autotools configure options for the common-library component
# Each section can be edited independently for better maintainability

# ============================================================================
# CPPFLAGS - Preprocessor flags (includes and defines)
# ============================================================================
[CPPFLAGS]
# Autotools configuration
-DHAVE_CONFIG_H

# Include paths
-I$HOME/usr/include/rdkb/
-I/usr/include/dbus-1.0
-I/usr/lib/x86_64-linux-gnu/dbus-1.0/include
-I/usr/include/cjson

# Core system defines
-DSAFEC_DUMMY_API
-D_COSA_HAL_
-U_COSA_SIM_
-DCONFIG_SYSTEM_MOCA

# ANSC framework defines
-D_ANSC_LINUX
-D_ANSC_USER
-D_ANSC_LITTLE_ENDIAN_
-D_ANSC_USE_OPENSSL_
-D_ANSC_AES_USED_
-D_NO_ANSC_ZLIB_
-U_ANSC_IPV6_COMPATIBLE_

# CCSP/Component defines
-D_CCSP_CWMP_TCP_CONNREQ_HANDLER
-D_DSLH_STUN_
-D_NO_PKI_KB5_SUPPORT
-D_BBHM_SSE_FILE_IO
-DCCSP_SUPPORT_ENABLED

# Product/Platform defines
-D_COSA_INTEL_USG_ARM_
-D_COSA_FOR_COMCAST_
-D_COSA_BCM_ARM_
-D_XB6_PRODUCT_REQ_
-D_XB7_PRODUCT_REQ_
-D_XB8_PRODUCT_REQ_

# Vendor/Customer configuration
-DCONFIG_VENDOR_CUSTOMER_COMCAST
-DCONFIG_CISCO_HOTSPOT
-DCONFIG_VENDOR_NAME

# Security and debugging
-DENABLE_SA_KEY
-D_NO_EXECINFO_H_
-D_DEBUG
-DINCLUDE_BREAKPAD

# System features
-DFEATURE_SUPPORT_RDKLOG
-DFEATURE_SUPPORT_SYSLOG
-DBUILD_WEB
-DUSE_NOTIFY_COMPONENT
-DNTPD_ENABLE
-DUTC_ENABLE
-DUTC_ENABLE_ATOM
-DXDNS_ENABLE

# Network features
-DENABLE_ETH_WAN
-DEROUTER_DHCP_OPTION_MTA
-DETH_4_PORTS
-D_2_5G_ETHERNET_SUPPORT_
-D_MACSEC_SUPPORT_
-D_BRIDGE_UTILS_BIN_
-DAUTOWAN_ENABLE
-DENABLE_WANMODECHANGE_NOREBOOT
-DFEATURE_RDKB_WAN_MANAGER
-DFEATURE_RDKB_CONFIGURABLE_WAN_INTERFACE
-DWAN_MANAGER_UNIFICATION_ENABLED
-DWAN_FAILOVER_SUPPORTED
-DGATEWAY_FAILOVER_SUPPORTED

# WiFi features
-D_ENABLE_BAND_STEERING_
-D_BEACONRATE_SUPPORT
-D_TRI_BAND_WIFI_
-D_WIFI_AX_SUPPORT_
-D_WIFI_CONSOLIDATED_STANDARDS_
-DWIFI_HAL_VERSION_3
-DFEATURE_SUPPORT_MESH
-DFEATURE_SUPPORT_WEBCONFIG
-DFEATURE_SUPPORT_INTERWORKING
-DFEATURE_SUPPORT_PASSPOINT
-DWIFI_STATS_DISABLE_SPEEDTEST_RUNNING
-DFEATURE_SUPPORT_RADIUSGREYLIST
-DFEATURE_SUPPORT_ACL_SELFHEAL
-DFEATURE_CSI
-DFEATURE_SUPPORT_ONBOARD_LOGGING
-DFEATURE_OFF_CHANNEL_SCAN_5G
-DRDK_ONEWIFI
-DWIFI_MANAGE_SUPPORTED

# Advanced features
-D_PSM_TRANS_RDK_TRIGG_
-D_CM_HIGHSPLIT_SUPPORTED_
-DFEATURE_RDKB_INTER_DEVICE_MANAGER
-DFEATURE_SUPPORT_MAPT_NAT46
-DMAPT_UNIFICATION_ENABLED
-DSPEED_BOOST_SUPPORTED
-DAMENITIES_NETWORK_ENABLED

# Test/Development
-DCOLUMBO_HWTEST

# Build system
-DRBUS_BUILD_FLAG_ENABLE

# Standard defines
-D_GNU_SOURCE
-D__USE_XOPEN

# ============================================================================
# CFLAGS - Compiler flags
# ============================================================================
[CFLAGS]
-ffunction-sections
-fdata-sections
-fomit-frame-pointer
-fno-strict-aliasing

# ============================================================================
# LDFLAGS - Linker flags
# ============================================================================
[LDFLAGS]
-L$HOME/usr/local/lib/
-Wl,--allow-shlib-undefined
-Wl,--unresolved-symbols=ignore-all
Copy link

Copilot AI Feb 9, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

These linker flags can mask real link errors (--unresolved-symbols=ignore-all) and may produce incomplete/incorrect binaries, which can also reduce the value of Coverity results. If these are only needed for Coverity capture, consider scoping them to a Coverity-only mode or adding a clear comment explaining why they’re required and what risks they introduce; otherwise, prefer failing fast on unresolved symbols.

Suggested change
-Wl,--unresolved-symbols=ignore-all

Copilot uses AI. Check for mistakes.
Copy link

Copilot AI Feb 11, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

These linker flags can mask real link errors by allowing/ignoring unresolved symbols. If the goal is only to get a native build far enough for analysis, consider restricting this to specific known problematic libs or making it conditional (e.g., only for Coverity runs), so normal native builds still fail fast on genuine link issues.

Suggested change
-Wl,--unresolved-symbols=ignore-all
# NOTE: Avoid masking unresolved symbols; keep this disabled so real link errors are reported.
# -Wl,--unresolved-symbols=ignore-all

Copilot uses AI. Check for mistakes.
Loading