[madhubabutt]

No description provided.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you all sign our Contributor License Agreement before we can accept your contribution.
2 out of 3 committers have signed the CLA.

✅ maniselva006c
✅ Alan-Ryan
❌ mselva006c

---

mselva006c seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[github-actions]

Thank you for your submission, we really appreciate it. Like many open-source projects, we ask that you all sign our Contributor License Agreement before we can accept your contribution. You can sign the CLA by just posting a Pull Request Comment same as the below format.

---

I have read the CLA Document and I hereby sign the CLA

---

7 out of 10 committers have signed the CLA.
✅ maniselva006c
✅ Alan-Ryan
✅ sbarre01
✅ Arjun-DR
✅ sktraja
✅ tharunaa
✅ vbabypublic
❌ Marcin Mikula
❌ Marcin Mikuła
❌ cksharpa
Marcin Mikula, Marcin Mikuła seem not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account.
_{You can retrigger this bot by commenting recheck in this Pull Request. Posted by the CLA Assistant Lite bot.}

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.

Comments suppressed due to low confidence (2)

conf/machine/include/oss.inc:10

• get_oss_machine(d) / get_oss_arch(d) are referenced but no longer defined anywhere in this layer, and OSS_LAYER_VERSION is referenced without being set. As-is, BitBake parsing/evaluation will fail and the generated feed paths may be incorrect. Also, the inline-python comparison in PACKAGE_EXTRA_ARCHS:append is currently comparing literal strings (e.g. '${REL_OSS_LAYER_ARCH}') rather than variable values, so it will not behave as intended.

REL_OSS_MACHINE = "${@get_oss_machine(d)}"
REL_OSS_LAYER_ARCH = "${@get_oss_arch(d)}"
PACKAGE_EXTRA_ARCHS:append = "${@ '' if '${REL_OSS_LAYER_ARCH}' == '${OSS_LAYER_ARCH}' else ' ${REL_OSS_LAYER_ARCH}'}"
REL_OSS_LAYER_EXTENSION = "${REL_OSS_LAYER_ARCH}"
REL_OSS_IPK_SERVER_PATH ?= "${RDK_ARTIFACTS_BASE_URL}/rdk-oss-rel/${OSS_LAYER_VERSION}/${REL_OSS_MACHINE}/ipks"

CHANGELOG.md:51

• Spelling: "assigment" should be "assignment" in these changelog entries.

- RDKCOM-5437, RDKDEV-1130: Weak assigment of REL_OSS_IPK_SERVER_PATH [`#47`](https://github.com/rdkcentral/meta-oss-reference-release/pull/47)
- Update CODEOWNERS [`#73`](https://github.com/rdkcentral/meta-oss-reference-release/pull/73)
- RDKE-899: Update changelog for Rel 4.10.0 [`0191197`](https://github.com/rdkcentral/meta-oss-reference-release/commit/01911972f7a9063942ea8e180d4c05152232e397)
- Merge tag '4.9.0' into develop [`6f9d2df`](https://github.com/rdkcentral/meta-oss-reference-release/commit/6f9d2df82f9cfaf5cab200bb39b2a63c77259cec)
- RDKDEV-1130: Weak assigment of REL_OSS_IPK_SERVER_PATH [`6109869`](https://github.com/rdkcentral/meta-oss-reference-release/commit/6109869e439fc23150954e0a37d0bfc6f381ab69)

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (9)

conf/machine/include/oss.inc:7

• REL_OSS_MACHINE/REL_OSS_LAYER_ARCH are computed via get_oss_machine(d) / get_oss_arch(d), but those helper functions are no longer defined anywhere in this repository (verified via search). As-is, parsing this include will fail unless another required metadata file defines them; please either reintroduce the helpers here or explicitly require the file that provides them so the dependency is clear and parse order is guaranteed.

REL_OSS_MACHINE = "${@get_oss_machine(d)}"
REL_OSS_LAYER_ARCH = "${@get_oss_arch(d)}"

conf/machine/include/oss.inc:8

• This ${@...} comparison is currently comparing the literal strings '${REL_OSS_LAYER_ARCH}' and '${OSS_LAYER_ARCH}', not their values, so it will never behave as intended. Use d.getVar() to compare the expanded variable values and only append when needed.

PACKAGE_EXTRA_ARCHS:append = "${@ '' if '${REL_OSS_LAYER_ARCH}' == '${OSS_LAYER_ARCH}' else ' ${REL_OSS_LAYER_ARCH}'}"

conf/machine/include/oss.inc:10

• REL_OSS_IPK_SERVER_PATH (and the CVE feed path below) expand ${OSS_LAYER_VERSION}, but OSS_LAYER_VERSION is not defined anywhere in this repository anymore (verified via search). If this is meant to be provided externally, consider documenting/validating it here; otherwise, add a default or set it in this layer to avoid generating invalid feed URLs.

REL_OSS_IPK_SERVER_PATH ?= "${RDK_ARTIFACTS_BASE_URL}/rdk-oss-rel/${OSS_LAYER_VERSION}/${REL_OSS_MACHINE}/ipks"

conf/machine/include/oss.inc:23

• If REL_OSS_LAYER_ARCH is unexpected/missing, get_cve_checksum() currently returns None, which would produce an invalid ;sha256sum= (or None) in CVE_LAYER_FEED_PATH. Failing fast with a clear error makes misconfiguration easier to diagnose.

def get_cve_checksum (d):
    arch = d.getVar('REL_OSS_LAYER_ARCH') or ''
    mapping = {
        "rdk-arm7a-oss":  "fe379211bf571831cb3e4becbc884f0338b2f05b2124dfdb91afb129ec8db478",
        "rdk-arm7ve-oss": "68e724e5231fc0dce52037d3cecf1154415f95d4bac223606ef4d1358254df72",
        "rdk-arm64-oss":  "0db073343ed9c60e748f0534ddb427a887bdffafacc1077739f1dda86362b583",
    }
    return  mapping.get(arch)

CHANGELOG.md:12

• This release entry is missing the date line (> ...) that the rest of the changelog uses (e.g., 4.12.2 and below). Adding the release date keeps the changelog consistent and easier to scan.

#### [4.13.0](https://github.com/rdkcentral/meta-oss-reference-release/compare/4.12.2...4.13.0)

- RDKE-1040: Update release notes for 4.13.0 [`#88`](https://github.com/rdkcentral/meta-oss-reference-release/pull/88)
- Update CODEOWNERS [`#87`](https://github.com/rdkcentral/meta-oss-reference-release/pull/87)
- Merge tag '4.12.0' into develop [`0fa9124`](https://github.com/rdkcentral/meta-oss-reference-release/commit/0fa912471d4bb121e2842a2c38fe0731146d99e9)

CHANGELOG.md:51

• Typo: "assigment" should be "assignment" in these two entries.

- RDKCOM-5437, RDKDEV-1130: Weak assigment of REL_OSS_IPK_SERVER_PATH [`#47`](https://github.com/rdkcentral/meta-oss-reference-release/pull/47)
- Update CODEOWNERS [`#73`](https://github.com/rdkcentral/meta-oss-reference-release/pull/73)
- RDKE-899: Update changelog for Rel 4.10.0 [`0191197`](https://github.com/rdkcentral/meta-oss-reference-release/commit/01911972f7a9063942ea8e180d4c05152232e397)
- Merge tag '4.9.0' into develop [`6f9d2df`](https://github.com/rdkcentral/meta-oss-reference-release/commit/6f9d2df82f9cfaf5cab200bb39b2a63c77259cec)
- RDKDEV-1130: Weak assigment of REL_OSS_IPK_SERVER_PATH [`6109869`](https://github.com/rdkcentral/meta-oss-reference-release/commit/6109869e439fc23150954e0a37d0bfc6f381ab69)

CHANGELOG.md:122

• Typo: "auxilary" should be "auxiliary".

- RDKEOSS-3 fix meta-rdk-auxilary and meta-rdk-oss-reference versions [`0485e7e`](https://github.com/rdkcentral/meta-oss-reference-release/commit/0485e7e824323179570e669cd439a5fe98774670)

.github/workflows/cla.yml:7

• This workflow runs on pull_request_target and is granted broad write permissions (including actions: write). Consider reducing permissions to the minimum required by the reusable CLA workflow to limit blast radius if the workflow is ever abused or misconfigured.

permissions:
  contents: read
  pull-requests: write
  actions: write
  statuses: write

.github/workflows/cla.yml:19

• The reusable workflow is referenced by a mutable tag (@v1). For supply-chain safety, prefer pinning reusable workflows to an immutable commit SHA (or a protected, immutable tag if your org enforces it).

  CLA-Lite:
    name: "Signature"
    uses: rdkcentral/cmf-actions/.github/workflows/cla.yml@v1
    secrets:

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (4)

conf/machine/include/oss.inc:10

• get_oss_machine() / get_oss_arch() are referenced but are no longer defined anywhere in this layer (repo-wide search shows no definitions). This will break BitBake parsing when REL_OSS_MACHINE / REL_OSS_LAYER_ARCH expand unless another included file defines them. If these functions were not intentionally relocated, reintroduce them here (and default OSS_LAYER_ARCH so the comparison in PACKAGE_EXTRA_ARCHS has a value).

REL_OSS_MACHINE = "${@get_oss_machine(d)}"
REL_OSS_LAYER_ARCH = "${@get_oss_arch(d)}"
PACKAGE_EXTRA_ARCHS:append = "${@ '' if '${REL_OSS_LAYER_ARCH}' == '${OSS_LAYER_ARCH}' else ' ${REL_OSS_LAYER_ARCH}'}"
REL_OSS_LAYER_EXTENSION = "${REL_OSS_LAYER_ARCH}"
REL_OSS_IPK_SERVER_PATH ?= "${RDK_ARTIFACTS_BASE_URL}/rdk-oss-rel/${OSS_LAYER_VERSION}/${REL_OSS_MACHINE}/ipks"

conf/machine/include/oss.inc:23

• get_cve_checksum() returns None for unknown/empty REL_OSS_LAYER_ARCH, which would result in an invalid sha256sum=None feed entry. Failing fast makes misconfiguration easier to detect and avoids publishing/consuming a bad feed URL.

def get_cve_checksum (d):
    arch = d.getVar('REL_OSS_LAYER_ARCH') or ''
    mapping = {
        "rdk-arm7a-oss":  "fe379211bf571831cb3e4becbc884f0338b2f05b2124dfdb91afb129ec8db478",
        "rdk-arm7ve-oss": "68e724e5231fc0dce52037d3cecf1154415f95d4bac223606ef4d1358254df72",
        "rdk-arm64-oss":  "0db073343ed9c60e748f0534ddb427a887bdffafacc1077739f1dda86362b583",
    }
    return  mapping.get(arch)

CHANGELOG.md:12

• The 4.14.0 changelog entry is missing the release date line (> ...) that is present for adjacent releases; the file header also states dates are displayed in UTC. Add the date for consistency and to avoid ambiguity.

#### [4.14.0](https://github.com/rdkcentral/meta-oss-reference-release/compare/4.13.0...4.14.0)

- Update OSS stack layer with new meta layer [`#93`](https://github.com/rdkcentral/meta-oss-reference-release/pull/93)
- RDKOSS-1063 : OSS Release 4.14.0 [`#91`](https://github.com/rdkcentral/meta-oss-reference-release/pull/91)
- Merge tag '4.13.0' into develop [`5d4365c`](https://github.com/rdkcentral/meta-oss-reference-release/commit/5d4365c6fbcc0ee33112d3b6d5f97498b67d0d4c)

.github/workflows/cla.yml:20

• The workflow calls a reusable workflow using @v1, which is typically a mutable reference. To reduce supply-chain risk for pull_request_target workflows (especially when using a PAT secret), pin uses: to an immutable commit SHA (or an immutable, semver-specific tag if your org guarantees tag immutability).

  CLA-Lite:
    name: "Signature"
    uses: rdkcentral/cmf-actions/.github/workflows/cla.yml@v1
    secrets:
      PERSONAL_ACCESS_TOKEN: ${{ secrets.CLA_ASSISTANT }}

[Copilot]

🟡 Changes recommended

The audit parser is inaccurate for BitBake overrides, authorization can fail open, and private-repository metadata may be published.

6 open findings

• Prevent publishing private repository metadata in committed reports · New
• Prevent PR guard fallback from authorizing invalid source repositories · New
• The reusable workflow is referenced via the mutable @v1 tag. Because this workflow runs on…
• Preserve BitBake override semantics when merging variables · New
• Correct the spelling of auxilary to auxiliary in the changelog entry.
• Correct the spelling of assigment to assignment in the changelog entry.

🧠 Review effort: Balanced

[Copilot]

🟡 Changes recommended

The authorization guard is bypassable, cleanup can delete unrelated files, and audit parsing and failure handling need correction.

7 open issues

• Remove only per-repository clones during cleanup · New
• Prevent PR guard fallback from authorizing invalid source repositories
• Prevent publishing private repository metadata in committed reports
• The reusable workflow is referenced via the mutable @v1 tag. Because this workflow runs on…
• Preserve BitBake override semantics when merging variables
• Correct the spelling of auxilary to auxiliary in the changelog entry.
• Correct the spelling of assigment to assignment in the changelog entry.

3 previously missed issues

In code that hasn't changed since last review

Upload partial audit reports when scanning fails

.github/​workflows/​oss-audit.yml:42

When a repository cannot be cloned or scanned, oss_audit.py writes the partial reports and failure details, then exits nonzero. This upload step's implicit success condition skips the artifacts, so those reports are lost when the runner is discarded. Upload them on failed runs as well, while leaving generation and the overall job failed and keeping the commit step success-only.

Avoid confusing independent BitBake variables with LICENSE

scripts/​oss_audit.py:230

The underscore-prefix match treats independent BitBake variables such as LICENSE_FLAGS and LICENSE_PATH as LICENSE. For example, LICENSE = "LGPL-2.1-only" followed by LICENSE_FLAGS = "commercial" produces a reported license of commercial, replacing the actual license in both reports. Distinguish independent variables from supported legacy overrides and modifiers before normalizing metadata names.

Run verification workflow from trusted base with pull_request_target

.github/​workflows/​oss-pr-guard.yml:4

A pull_request run uses the workflow definition from the PR's merge ref. An unauthorized fork can therefore replace verification with a successful command while preserving the job's check name. Checking out the base SHA protects the policy and script, but not the workflow that invokes them. Use pull_request_target so the workflow also comes from the trusted base, and retain the base-only checkout without executing head-branch code.

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

The authorization guard is bypassable, and audit metadata handling, failure-report retention, and CVE checksum coverage need correction.

8 open issues

• Use trusted pull_request_target workflow for verification · New
• Remove only per-repository clones during cleanup
• Prevent PR guard fallback from authorizing invalid source repositories
• Prevent publishing private repository metadata in committed reports
• The reusable workflow is referenced via the mutable @v1 tag. Because this workflow runs on…
• Preserve BitBake override semantics when merging variables
• Correct the spelling of auxilary to auxiliary in the changelog entry.
• Correct the spelling of assigment to assignment in the changelog entry.

2 previously missed issues

In code that hasn't changed since last review

Upload diagnostic artifacts after audit failures

.github/​workflows/​oss-audit.yml:41

When any repository cannot be cloned or scanned, oss_audit.py writes both reports with failure details and then exits unsuccessfully. The default success condition skips this upload step, so those diagnostic reports disappear with the runner. Run artifact upload after failures while leaving the commit step success-only.

Exclude independent license variables from override merging

scripts/​oss_audit.py:230

The underscore-prefix check treats independent BitBake variables such as LICENSE_FLAGS as license overrides. For example, LICENSE = "MIT" followed by LICENSE_FLAGS = "commercial" causes the scanner to report commercial as the license. Distinguish supported legacy override/modifier suffixes from independent variables such as LICENSE_FLAGS and LICENSE_FLAGS_ACCEPTED before merging metadata, so policy flags cannot overwrite the audited license.

_{Review effort: Balanced}