Skip to content
Merged
Changes from 1 commit
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
271 changes: 239 additions & 32 deletions cov_docker_script/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@
**Generic, reusable build system enabling Coverity static analysis for any RDK-B component.**

[![Docker](https://img.shields.io/badge/Docker-Enabled-blue)](https://github.com/rdkcentral/docker-rdk-ci)
[![GitHub Actions](https://img.shields.io/badge/CI-GitHub_Actions-green)](https://github.com/rdkcentral/moca-agent/blob/feature/cov_native_build/.github/workflows/native-build.yml)
[![GitHub Actions](https://img.shields.io/badge/CI-GitHub_Actions-green)](https://docs.github.com/en/actions)
[![Coverity](https://img.shields.io/badge/Coverity-Ready-orange)](https://www.synopsys.com/software-integrity/security-testing/static-analysis-sast.html)

---
Expand All @@ -27,7 +27,7 @@
- [CI/CD Integration](#cicd-integration)
- [GitHub Actions](#github-actions-integration)
- [Coverity Enablement](#coverity-enablement-flow)
- [Migration Guide](#migration-guide)
- [Component Adoption Guide](#component-adoption-guide)
- [Governance & Rules](#governance--rules)
- [References](#references)

Expand Down Expand Up @@ -123,16 +123,30 @@ This build system provides a **standardized native build workflow** that enables

### Quick Start

**For existing components with `cov_docker_script` already integrated:**
**For components using wrapper scripts (recommended):**

```bash
# Navigate to component root
cd /path/to/your-component

# Run complete build pipeline
./cov_docker_script/common_external_build.sh
./cov_docker_script/run_setup_dependencies.sh
./cov_docker_script/run_native_build.sh

# Clean build (removes previous artifacts)
CLEAN_BUILD=true ./cov_docker_script/run_setup_dependencies.sh
```

**For components with build scripts directly committed (legacy):**

```bash
# Navigate to component root
cd /path/to/your-component

# Run complete build pipeline
./cov_docker_script/common_external_build.sh

# Clean build
CLEAN_BUILD=true ./cov_docker_script/common_external_build.sh
```

Expand Down Expand Up @@ -247,22 +261,30 @@ cd your-component
**Copy the directory structure from reference:**

```bash
# Example structure
# Recommended structure with wrapper scripts
your-component/
├── cov_docker_script/
│ ├── common_build_utils.sh # Utility functions
│ ├── setup_dependencies.sh # Dependency setup
│ ├── build_native.sh # Component build
│ ├── common_external_build.sh # Orchestrator
│ ├── component_config.json # Configuration
│ └── configure_options.conf # Build flags (optional)
│ ├── component_config.json # Configuration (component-specific)
│ ├── configure_options.conf # Build flags (optional, component-specific)
│ ├── run_setup_dependencies.sh # Wrapper: Setup & run dependencies
│ ├── run_native_build.sh # Wrapper: Setup & build component
│ └── README.md # Component-specific documentation
├── source/
└── ... (component files)

# Note: The following scripts are automatically downloaded by wrapper scripts:
# - common_build_utils.sh
# - setup_dependencies.sh
# - build_native.sh
# - common_external_build.sh
```

**Reference:** [moca-agent/cov_docker_script](https://github.com/rdkcentral/moca-agent/blob/feature/cov_native_build/cov_docker_script)
Copy link

Copilot AI Jan 27, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The reference link points to a specific branch 'feature/cov_native_build' which may be temporary. If this is a feature branch that will be merged or deleted, the link will become broken. Consider updating the reference to point to the main/master branch once the feature is merged, or documenting that this is a temporary reference.

Suggested change
**Reference:** [moca-agent/cov_docker_script](https://github.com/rdkcentral/moca-agent/blob/feature/cov_native_build/cov_docker_script)
**Reference:** [moca-agent/cov_docker_script](https://github.com/rdkcentral/moca-agent/blob/main/cov_docker_script)

Copilot uses AI. Check for mistakes.

> ⚠️ **Important:** Scripts must remain unchanged. Only JSON/conf files are modifiable.
> ⚠️ **Important:**
> - **DO NOT** manually copy build scripts (they are auto-downloaded by wrapper scripts)
> - **DO** customize `component_config.json` and `configure_options.conf`
> - **DO** create wrapper scripts (`run_*.sh`) that fetch build tools automatically

#### Step 3: Configure Dependencies

Expand Down Expand Up @@ -330,6 +352,177 @@ ls -la $HOME/usr/local/lib/

---

### Component Wrapper Scripts (Recommended Approach)

**Components should use wrapper scripts that automatically fetch build tools from this repository.**

#### Why Use Wrapper Scripts?

| Benefit | Description |
|---------|-------------|
| 🔄 **Always Up-to-Date** | Fetches latest scripts from build_tools_workflows |
| 📦 **No Script Duplication** | Avoids committing build scripts to component repos |
| 🛡️ **Consistent Versions** | All components use same build logic |
| 🔧 **Easy Maintenance** | Script updates propagate automatically |

#### Wrapper Script Template

**run_setup_dependencies.sh** - Sets up build tools and runs dependency setup:

```bash
#!/usr/bin/env bash
set -e

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
NATIVE_COMPONENT_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
BUILD_TOOLS_REPO_URL="https://github.com/rdkcentral/build_tools_workflows"
BUILD_TOOLS_DIR="$NATIVE_COMPONENT_DIR/build_tools_workflows"
REQUIRED_SCRIPTS=("build_native.sh" "common_build_utils.sh" "common_external_build.sh" "setup_dependencies.sh")

# Basic logging
log() { echo "[INFO] $*"; }
ok() { echo "[OK] $*"; }
err() { echo "[ERROR] $*" >&2; }

echo ""
echo "===== Setup Dependencies Pipeline ====="
echo ""

# Clone build_tools_workflows
if [[ -d "$BUILD_TOOLS_DIR" ]]; then
log "build_tools_workflows already exists, skipping clone"
else
log "Cloning build_tools_workflows (develop)"
cd "$NATIVE_COMPONENT_DIR"
git clone -b develop "$BUILD_TOOLS_REPO_URL" || { err "Clone failed"; exit 1; }
Copy link

Copilot AI Jan 27, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The wrapper script clones the build_tools_workflows repository but doesn't specify any authentication mechanism. If the repository is private or requires authentication, the clone will fail silently with the generic error message "Clone failed". Consider adding more specific error messages that differentiate between network issues, authentication failures, and repository not found scenarios.

Suggested change
git clone -b develop "$BUILD_TOOLS_REPO_URL" || { err "Clone failed"; exit 1; }
if ! clone_output=$(git clone -b develop "$BUILD_TOOLS_REPO_URL" 2>&1); then
status=$?
if echo "$clone_output" | grep -qiE 'authentication failed|permission denied|access denied'; then
err "Clone failed: authentication error while accessing '$BUILD_TOOLS_REPO_URL'."
err "Ensure you have the correct credentials/SSH keys and access to the repository."
elif echo "$clone_output" | grep -qiE 'not found|repository .* does not exist'; then
err "Clone failed: repository not found for '$BUILD_TOOLS_REPO_URL' (branch: develop)."
err "Verify that the URL and branch name are correct and that the repository exists."
elif echo "$clone_output" | grep -qiE 'could not resolve host|failed to connect|network is unreachable'; then
err "Clone failed: network error while trying to reach '$BUILD_TOOLS_REPO_URL'."
err "Check your network connectivity and DNS settings."
else
err "Clone failed with exit code $status. git output:"
err "$clone_output"
fi
exit 1
fi

Copilot uses AI. Check for mistakes.
ok "Repository cloned"
Comment on lines +395 to +398
Copy link

Copilot AI Jan 27, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The clone command uses -b develop flag to specify the branch, but the repository URL doesn't verify if the 'develop' branch exists. If the develop branch doesn't exist in the build_tools_workflows repository, this command will fail. Consider adding a fallback to 'main' or 'master' branch, or making the branch configurable via an environment variable.

Suggested change
log "Cloning build_tools_workflows (develop)"
cd "$NATIVE_COMPONENT_DIR"
git clone -b develop "$BUILD_TOOLS_REPO_URL" || { err "Clone failed"; exit 1; }
ok "Repository cloned"
: "${BUILD_TOOLS_BRANCH:=develop}"
log "Cloning build_tools_workflows (branch: $BUILD_TOOLS_BRANCH)"
cd "$NATIVE_COMPONENT_DIR"
if git clone -b "$BUILD_TOOLS_BRANCH" "$BUILD_TOOLS_REPO_URL"; then
ok "Repository cloned (branch: $BUILD_TOOLS_BRANCH)"
else
log "Branch '$BUILD_TOOLS_BRANCH' not available, attempting fallbacks ('main', then 'master')"
if git ls-remote --exit-code --heads "$BUILD_TOOLS_REPO_URL" main >/dev/null 2>&1 && \
git clone -b main "$BUILD_TOOLS_REPO_URL"; then
ok "Repository cloned (branch: main)"
elif git ls-remote --exit-code --heads "$BUILD_TOOLS_REPO_URL" master >/dev/null 2>&1 && \
git clone -b master "$BUILD_TOOLS_REPO_URL"; then
ok "Repository cloned (branch: master)"
else
err "Clone failed: branches '$BUILD_TOOLS_BRANCH', 'main', and 'master' are not available"
exit 1
fi
fi

Copilot uses AI. Check for mistakes.
fi
Comment on lines +392 to +399
Copy link

Copilot AI Jan 27, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The run_setup_dependencies.sh wrapper script doesn't handle the case where build_tools_workflows exists but might be outdated or corrupted. Consider adding a check to verify the repository state or an option to force re-clone. Currently, it only skips cloning if the directory exists, which could lead to using stale or incomplete build tools.

Copilot uses AI. Check for mistakes.

# Verify required scripts
[[ ! -d "$BUILD_TOOLS_DIR/cov_docker_script" ]] && { err "cov_docker_script not found"; exit 1; }

log "Verifying required scripts..."
MISSING=()
for script in "${REQUIRED_SCRIPTS[@]}"; do
[[ -f "$BUILD_TOOLS_DIR/cov_docker_script/$script" ]] || MISSING+=("$script")
done

if [[ ${#MISSING[@]} -gt 0 ]]; then
err "Missing scripts: ${MISSING[*]}"
exit 1
fi
ok "All required scripts found"

# Verify setup_dependencies.sh exists before running
if [[ ! -f "$BUILD_TOOLS_DIR/cov_docker_script/setup_dependencies.sh" ]]; then
err "setup_dependencies.sh not found in build_tools_workflows"
exit 1
fi

# Run setup_dependencies.sh from build_tools_workflows
echo ""
log "Running setup_dependencies.sh from build_tools_workflows..."
cd "$NATIVE_COMPONENT_DIR"
"$BUILD_TOOLS_DIR/cov_docker_script/setup_dependencies.sh" "$SCRIPT_DIR/component_config.json"
Comment on lines +378 to +426
Copy link

Copilot AI Jan 27, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Security concern: The wrapper script clones from a hardcoded GitHub URL without verifying the integrity of the downloaded scripts before executing them. An attacker who gains control of the build_tools_workflows repository or performs a man-in-the-middle attack could inject malicious code. Consider adding verification steps such as checking commit signatures, verifying checksums, or pinning to a specific commit hash instead of the 'develop' branch.

Copilot uses AI. Check for mistakes.

echo ""
ok "Dependencies setup completed successfully!"
echo ""
```

**run_native_build.sh** - Verifies build tools and builds component:

```bash
#!/usr/bin/env bash
set -e

################################################################################
# Native Build Wrapper Script
# Verifies build tools and runs build_native.sh
# Usage: ./run_native_build.sh
# Note: run_setup_dependencies.sh should be executed first
################################################################################

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
NATIVE_COMPONENT_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
BUILD_TOOLS_DIR="$NATIVE_COMPONENT_DIR/build_tools_workflows"

# Basic logging functions
log() { echo "[INFO] $*"; }
ok() { echo "[OK] $*"; }
err() { echo "[ERROR] $*" >&2; }

echo ""
echo "===== Native Build Pipeline ====="
echo ""

# Verify build_tools_workflows exists (should be cloned by run_setup_dependencies.sh)
if [[ ! -d "$BUILD_TOOLS_DIR" ]]; then
err "build_tools_workflows directory not found. Please run run_setup_dependencies.sh first."
exit 1
fi

if [[ ! -f "$BUILD_TOOLS_DIR/cov_docker_script/build_native.sh" ]]; then
err "build_native.sh not found in build_tools_workflows. Please run run_setup_dependencies.sh first."
exit 1
fi

log "Build script found, proceeding with build..."

# Run build_native.sh from build_tools_workflows
echo ""
log "Running build_native.sh from build_tools_workflows..."
cd "$NATIVE_COMPONENT_DIR"
"$BUILD_TOOLS_DIR/cov_docker_script/build_native.sh" "$SCRIPT_DIR/component_config.json" "$NATIVE_COMPONENT_DIR"

echo ""
ok "Native build completed successfully!"

# Cleanup build_tools_workflows directory
log "Cleaning up build_tools_workflows directory..."
rm -rf "$BUILD_TOOLS_DIR"
ok "Cleanup completed"
Comment on lines +483 to +484
Copy link

Copilot AI Jan 27, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The cleanup operation uses rm -rf on a directory path constructed from variables. If any of the path components (NATIVE_COMPONENT_DIR or BUILD_TOOLS_DIR) are empty or incorrectly set, this could potentially delete unintended files. Consider adding a safety check to ensure BUILD_TOOLS_DIR is not empty and points to a valid subdirectory before deletion.

Suggested change
rm -rf "$BUILD_TOOLS_DIR"
ok "Cleanup completed"
if [[ -n "$BUILD_TOOLS_DIR" && -d "$BUILD_TOOLS_DIR" ]]; then
rm -rf "$BUILD_TOOLS_DIR"
ok "Cleanup completed"
else
err "Skipping cleanup: BUILD_TOOLS_DIR is not set or not a directory: '$BUILD_TOOLS_DIR'"
fi

Copilot uses AI. Check for mistakes.

echo ""
```

#### How Wrapper Scripts Work

```
Component Repository (e.g., moca-agent)
├── cov_docker_script/
│ ├── run_setup_dependencies.sh ← Wrapper script (committed)
│ ├── run_native_build.sh ← Wrapper script (committed)
│ ├── component_config.json ← Component config (committed)
│ └── configure_options.conf ← Build flags (committed)
└── build_tools_workflows/ ← Cloned by run_setup_dependencies.sh
└── cov_docker_script/ ← Scripts run from here with arguments
├── build_native.sh ← Called with config & component paths
├── common_build_utils.sh ← Sourced by other scripts
├── setup_dependencies.sh ← Called with config path
└── common_external_build.sh ← Optional orchestrator
```

**Build Flow:**
1. Developer runs `./cov_docker_script/run_setup_dependencies.sh`
- Clones `build_tools_workflows` repository
- Verifies required scripts exist
- Runs `setup_dependencies.sh` from build_tools_workflows, passing config path
- Leaves build_tools_workflows in place
2. Developer runs `./cov_docker_script/run_native_build.sh`
- Verifies build_tools_workflows exists
- Runs `build_native.sh` from build_tools_workflows, passing config and component paths
- Cleans up build_tools_workflows directory

**Result:** Component repository only commits wrapper scripts and config files. Build logic stays in build_tools_workflows and is used via arguments, not copied.

#### Example: moca-agent

See [moca-agent/cov_docker_script](https://github.com/rdkcentral/moca-agent/tree/feature/cov_native_build/cov_docker_script) for a complete working example.
Copy link

Copilot AI Jan 27, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The reference link points to a specific branch 'feature/cov_native_build' which may be temporary. If this is a feature branch that will be merged or deleted, the link will become broken. Consider updating the reference to point to the main/master branch once the feature is merged, or documenting that this is a temporary reference.

Suggested change
See [moca-agent/cov_docker_script](https://github.com/rdkcentral/moca-agent/tree/feature/cov_native_build/cov_docker_script) for a complete working example.
See [moca-agent/cov_docker_script](https://github.com/rdkcentral/moca-agent/tree/main/cov_docker_script) for a complete working example.

Copilot uses AI. Check for mistakes.

---

## 📖 Configuration Guide

### Scripts Overview
Expand Down Expand Up @@ -1134,22 +1327,32 @@ Native build validation enables Coverity integration.

---

## 📚 Migration Guide
## 📚 Component Adoption Guide

### Adopting for Another Component
### Adding Native Build to a New Component

**These scripts are 100% generic and component-agnostic!**

#### Step 1: Copy the Scripts
#### Step 1: Create Wrapper Scripts

Create `cov_docker_script/` directory in your component:

```bash
# Copy all scripts to your component's build directory
cp -r /reference/cov_docker_script /path/to/new-component/
mkdir -p /path/to/your-component/cov_docker_script
cd /path/to/your-component/cov_docker_script
```

Create `run_setup_dependencies.sh` and `run_native_build.sh` using the templates from the [Component Wrapper Scripts](#component-wrapper-scripts-recommended-approach) section above.

# Make executable
chmod +x /path/to/new-component/cov_docker_script/*.sh
```bash
chmod +x run_setup_dependencies.sh run_native_build.sh
```

**Key Points:**
- Wrapper scripts automatically clone build_tools_workflows
- No need to copy build scripts manually
- Build scripts are always up-to-date from the repository

#### Step 2: Create component_config.json

Create a new `component_config.json` for your component:
Expand Down Expand Up @@ -1222,21 +1425,25 @@ cd /path/to/new-component/cov_docker_script

---

### Example: Migrating from Utopia to CcspPandM
### Example: Using Wrapper Scripts for a New Component

```bash
# 1. Copy scripts to CcspPandM
cp -r utopia/cov_docker_script ccsp-p-and-m/
# 1. Create wrapper scripts in your component
mkdir -p your-component/cov_docker_script
cd your-component/cov_docker_script

# Create run_setup_dependencies.sh and run_native_build.sh
# (use wrapper script templates from this README)

# 2. Create ccsp-p-and-m/cov_docker_script/component_config.json
# Update: component name, dependencies, build settings
# 2. Create component_config.json
# Define: component name, dependencies, build settings

# 3. Run build
cd ccsp-p-and-m/cov_docker_script
./common_external_build.sh
./run_setup_dependencies.sh
./run_native_build.sh
```

**Scripts remain unchanged - only JSON changes!**
**Only config files in your repo - build scripts fetched automatically!**

---

Expand Down Expand Up @@ -1290,7 +1497,7 @@ cd ccsp-p-and-m/cov_docker_script
},

"native_component": {
"name": "moca-agent",
"name": "your-component",
"include_path": "$HOME/usr/include/rdkb/",
"lib_output_path": "$HOME/usr/local/lib/",
"header_sources": [
Expand All @@ -1299,7 +1506,7 @@ cd ccsp-p-and-m/cov_docker_script
"pre_build_commands": [
{
"description": "Generate dm_pack_datamodel.c from XML",
"command": "python3 $HOME/usr/include/rdkb/dm_pack_code_gen.py config/TR181-MoCA.XML source/MoCASsp/dm_pack_datamodel.c"
"command": "python3 $HOME/usr/include/rdkb/dm_pack_code_gen.py config/TR181-YourComponent.XML source/ComponentSsp/dm_pack_datamodel.c"
}
],
"build": {
Expand All @@ -1322,7 +1529,7 @@ cd ccsp-p-and-m/cov_docker_script
# Core system defines
-DSAFEC_DUMMY_API
-D_COSA_HAL_
-DCONFIG_SYSTEM_MOCA
-DCONFIG_SYSTEM_YOUR_COMPONENT

# CCSP/Component defines
-DCCSP_SUPPORT_ENABLED
Expand All @@ -1334,7 +1541,7 @@ cd ccsp-p-and-m/cov_docker_script

# Features
-DFEATURE_SUPPORT_WEBCONFIG
-DMOCA_HOME_ISOLATION
-DYOUR_COMPONENT_FEATURE

[CFLAGS]
-ffunction-sections
Expand All @@ -1349,7 +1556,7 @@ cd ccsp-p-and-m/cov_docker_script
**Build execution:**

```bash
cd /path/to/moca-agent/cov_docker_script
cd /path/to/your-component/cov_docker_script
./common_external_build.sh
```

Expand Down
Loading