rebase topic branch by madhubabutt · Pull Request #49 · rdkcentral/meta-oss-reference-release

madhubabutt · 2025-08-19T07:37:13Z

No description provided.

OSS Release 4.7.0

Reason for change: Added support for consuming release OSS IPK packages using the architecture specified in REL_OSS_LAYER_ARCH, and for building OSS with an extended architecture defined by OSS_LAYER_ARCH.

Reason for change: Update release version for 4.8.0 Signed-off-by: mselva006c <mani_selvaraj@comcast.com>

Reason for change: Update change log for oss release 4.8.0 Signed-off-by: mselva006c <mani_selvaraj@comcast.com>

OSS Release 4.8.0

With this change REL_OSS_IPK_SERVER_PATH can be override from local.conf for custom/local builds.

CLAassistant · 2025-08-19T07:37:22Z

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you all sign our Contributor License Agreement before we can accept your contribution.
2 out of 3 committers have signed the CLA.

✅ maniselva006c
✅ Alan-Ryan
❌ mselva006c

mselva006c seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

Deploy cla action

Reason for the change - The meta-oss-reference-release repository has been excluded from the manifest to support the new OSS consumption model. Consequently, the OSS_LAYER_VERSION parameter previously defined in that repository is no longer available to the build. To address this, the OSS_LAYER_VERSION parameter has been moved to the reference layer to ensure continued availability during the build process.

RDKOSS-490: Move OSS_LAYER_VERSION to reference layer

Signed-off-by: mselva006c <mani_selvaraj@comcast.com>

RDKE-893: Update Release note for 4.9.0

Signed-off-by: mselva006c <mani_selvaraj@comcast.com>

OSS Release 4.9.0

Update CODEOWNERS

RDKCOM-5437, RDKDEV-1130: Weak assigment of REL_OSS_IPK_SERVER_PATH

Signed-off-by: mselva006c <mani_selvaraj@comcast.com>

OSS Release tag 4.10.0

Signed-off-by: mselva006c <mani_selvaraj@comcast.com>

RDKE-971: Update release notes for 4.11.0

Copilot

Pull request overview

This PR appears to rebase/update the OSS reference release layer to a newer release (4.11.0), updating feed configuration, release documentation, and repository governance automation (CLA + CODEOWNERS).

Changes:

Updates conf/machine/include/oss.inc to use REL_OSS_* variables and adds CVE tarball feed + checksum mapping.
Updates release documentation (README.md) and project history (CHANGELOG.md) for newer release versions.
Adds a CLA GitHub Actions workflow and adjusts CODEOWNERS.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 8 comments.

Show a summary per file

File	Description
`conf/machine/include/oss.inc`	Refactors feed/arch variables and adds CVE feed/checksum logic for the release artifacts.
`README.md`	Updates release notes content to 4.11.0 and refreshes component/layer versions.
`CHANGELOG.md`	Adds entries for multiple historical releases.
`.github/workflows/cla.yml`	Introduces CLA enforcement via a reusable workflow.
`.github/CODEOWNERS`	Updates default code ownership reviewers.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-03-01T04:55:54Z

+        "rdk-arm7ve-oss": "68ea40be1f0a0bdeb50d358202b246b7fe11552f1e35f858010411de3f30c04d",
+        "rdk-arm64-oss":  "04f29148179c3c56a0662554aa69734414dda880f8b0a0848ec2fe9cd2fe7d69",
+    }
+    return  mapping.get(arch)


CVE_LAYER_FEED_PATH appends sha256sum=${CVE_FILE_CHECKSUM} unconditionally. If CVE_FILE_CHECKSUM is empty/None, this will generate a broken feed URI (e.g., sha256sum=None). Gate this append on a valid checksum or emit a clear error when it’s missing.

Suggested change

return mapping.get(arch)

checksum = mapping.get(arch)

if not checksum:

bb.fatal("No CVE checksum defined for REL_OSS_LAYER_ARCH='%s' in oss.inc" % arch)

return checksum

Copilot · 2026-03-01T04:55:55Z

+permissions:
+  contents: read
+  pull-requests: write
+  actions: write


The workflow grants broad write permissions at the workflow level (actions/statuses/pull-requests). If the reusable CLA workflow doesn’t need all of these, reduce to the minimum required to limit blast radius if the workflow is misused or compromised.

Suggested change

actions: write

Copilot · 2026-03-01T04:55:55Z

+  pull_request_target:
+    types: [opened, closed, synchronize]
+
+jobs:
+  CLA-Lite:
+    name: "Signature"
+    uses: rdkcentral/cmf-actions/.github/workflows/cla.yml@v1
+    secrets:
+      PERSONAL_ACCESS_TOKEN: ${{ secrets.CLA_ASSISTANT }}


Using pull_request_target together with a PAT-like secret (CLA_ASSISTANT) is high risk because pull_request_target runs in the base-repo context and can expose secrets if any PR-controlled code is checked out or executed (even indirectly) by the called reusable workflow. Ensure the reusable workflow never runs PR code, or switch to a safer trigger/token model for CLA checks.

Copilot · 2026-03-01T04:55:55Z

@@ -3,33 +3,25 @@
 RDK_ARTIFACTS_BASE_URL ?= ""
 RDK_ARTIFACTS_URL ?= ""



get_oss_machine() is referenced but no longer defined anywhere in this repo (search found no remaining definition). This will cause BitBake parse-time failures. Reintroduce get_oss_machine/get_oss_arch definitions here, or include them from another .inc/.bbclass that is guaranteed to be in BBPATH before these variables are expanded.

Suggested change

def get_oss_machine(d):

"""

Return the machine identifier to be used for OSS artifacts.

By default, this is the current BitBake MACHINE value.

"""

return d.getVar('MACHINE') or ''

def get_oss_arch(d):

"""

Return the architecture identifier to be used for OSS artifacts.

Prefer an explicitly configured OSS_LAYER_ARCH, and fall back

to common BitBake architecture variables if needed.

"""

return (d.getVar('OSS_LAYER_ARCH')

or d.getVar('TARGET_ARCH')

or d.getVar('PACKAGE_ARCH')

or '')

Copilot · 2026-03-01T04:55:55Z

-OSS_IPK_SERVER_PATH = "${RDK_ARTIFACTS_BASE_URL}/rdk-oss-release/${OSS_LAYER_VERSION}/${OSS_MACHINE}/ipks"
+REL_OSS_MACHINE = "${@get_oss_machine(d)}"
+REL_OSS_LAYER_ARCH = "${@get_oss_arch(d)}"
+PACKAGE_EXTRA_ARCHS:append = "${@ '' if '${REL_OSS_LAYER_ARCH}' == '${OSS_LAYER_ARCH}' else ' ${REL_OSS_LAYER_ARCH}'}"


OSS_LAYER_ARCH is referenced in the PACKAGE_EXTRA_ARCHS:append expression, but OSS_LAYER_ARCH is no longer set anywhere in this repository (only remaining references are in this file). If it expands to an empty string, the comparison logic and resulting PACKAGE_EXTRA_ARCHS will be incorrect. Ensure OSS_LAYER_ARCH is defined (e.g., set it here again or require/provide it from a guaranteed include).

Suggested change

PACKAGE_EXTRA_ARCHS:append = "${@ '' if '${REL_OSS_LAYER_ARCH}' == '${OSS_LAYER_ARCH}' else ' ${REL_OSS_LAYER_ARCH}'}"

PACKAGE_EXTRA_ARCHS:append = " ${REL_OSS_LAYER_ARCH}"

Copilot · 2026-03-01T04:55:55Z

+REL_OSS_LAYER_ARCH = "${@get_oss_arch(d)}"
+PACKAGE_EXTRA_ARCHS:append = "${@ '' if '${REL_OSS_LAYER_ARCH}' == '${OSS_LAYER_ARCH}' else ' ${REL_OSS_LAYER_ARCH}'}"
+REL_OSS_LAYER_EXTENSION = "${REL_OSS_LAYER_ARCH}"
+REL_OSS_IPK_SERVER_PATH ?= "${RDK_ARTIFACTS_BASE_URL}/rdk-oss-rel/${OSS_LAYER_VERSION}/${REL_OSS_MACHINE}/ipks"


OSS_LAYER_VERSION is now only referenced (not defined) within this layer. If the build environment doesn’t set it, REL_OSS_IPK_SERVER_PATH and CVE_LAYER_FEED_PATH will contain an empty version segment, producing invalid artifact URLs. Consider restoring a default (e.g., OSS_LAYER_VERSION ?= "...") or failing early with a clear error if it’s unset.

Copilot · 2026-03-01T04:55:55Z

+        "rdk-arm7ve-oss": "68ea40be1f0a0bdeb50d358202b246b7fe11552f1e35f858010411de3f30c04d",
+        "rdk-arm64-oss":  "04f29148179c3c56a0662554aa69734414dda880f8b0a0848ec2fe9cd2fe7d69",
+    }
+    return  mapping.get(arch)


get_cve_checksum() uses mapping.get(arch), which returns None if REL_OSS_LAYER_ARCH isn’t one of the listed keys. That propagates into CVE_FILE_CHECKSUM and can produce an invalid/empty checksum downstream. Consider failing fast for unknown arches (e.g., bb.fatal) or providing a defined default/explicit handling.

Suggested change

return mapping.get(arch)

if not arch:

bb.fatal("REL_OSS_LAYER_ARCH is not set, cannot determine CVE file checksum")

if arch not in mapping:

bb.fatal("Unsupported REL_OSS_LAYER_ARCH '%s' for CVE file checksum" % arch)

return mapping[arch]

Copilot · 2026-03-01T04:55:56Z

+- RDKCOM-5437, RDKDEV-1130: Weak assigment of REL_OSS_IPK_SERVER_PATH [`#47`](https://github.com/rdkcentral/meta-oss-reference-release/pull/47)
+- Update CODEOWNERS [`#73`](https://github.com/rdkcentral/meta-oss-reference-release/pull/73)
+- Merge tag '4.9.0' into develop [`6f9d2df`](https://github.com/rdkcentral/meta-oss-reference-release/commit/6f9d2df82f9cfaf5cab200bb39b2a63c77259cec)
+- RDKDEV-1130: Weak assigment of REL_OSS_IPK_SERVER_PATH [`6109869`](https://github.com/rdkcentral/meta-oss-reference-release/commit/6109869e439fc23150954e0a37d0bfc6f381ab69)


Typo in changelog entry: "assigment" should be "assignment" (appears multiple times in this new release section).

Suggested change

- RDKCOM-5437, RDKDEV-1130: Weak assigment of REL_OSS_IPK_SERVER_PATH [`#47`](https://github.com/rdkcentral/meta-oss-reference-release/pull/47)

- Update CODEOWNERS [`#73`](https://github.com/rdkcentral/meta-oss-reference-release/pull/73)

- Merge tag '4.9.0' into develop [`6f9d2df`](https://github.com/rdkcentral/meta-oss-reference-release/commit/6f9d2df82f9cfaf5cab200bb39b2a63c77259cec)

- RDKDEV-1130: Weak assigment of REL_OSS_IPK_SERVER_PATH [`6109869`](https://github.com/rdkcentral/meta-oss-reference-release/commit/6109869e439fc23150954e0a37d0bfc6f381ab69)

- RDKCOM-5437, RDKDEV-1130: Weak assignment of REL_OSS_IPK_SERVER_PATH [`#47`](https://github.com/rdkcentral/meta-oss-reference-release/pull/47)

- Update CODEOWNERS [`#73`](https://github.com/rdkcentral/meta-oss-reference-release/pull/73)

- Merge tag '4.9.0' into develop [`6f9d2df`](https://github.com/rdkcentral/meta-oss-reference-release/commit/6f9d2df82f9cfaf5cab200bb39b2a63c77259cec)

- RDKDEV-1130: Weak assignment of REL_OSS_IPK_SERVER_PATH [`6109869`](https://github.com/rdkcentral/meta-oss-reference-release/commit/6109869e439fc23150954e0a37d0bfc6f381ab69)

Signed-off-by: mselva006c <mani_selvaraj@comcast.com>

OSS Release 4.11.0

Signed-off-by: mselva006c <mani_selvaraj@comcast.com>

RDKE-971: Updated Release note for 4.12.0

Signed-off-by: mselva006c <mani_selvaraj@comcast.com>

Copilot

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 7 comments.

Comments suppressed due to low confidence (1)

README.md:20

The PR title implies this is only a rebase, but it introduces functional/config changes (new CLA workflow, CODEOWNERS update, feed/CVE config updates, and release-note updates). Please update the PR title/description to reflect the actual scope so reviewers understand the intent and risk.

|Date|1st March 2026|
|Author|RDKE Platform & Tools Team|

| Components | Tag |
|----------|--------|
| packagegroup-oss-layer | 4.12.0-r0|



## Table of Contents

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-03-02T00:55:19Z

+CVE_FILE_CHECKSUM = "${@get_cve_checksum(d)}"
+CVE_LAYER_FEED_PATH += " ${REL_OSS_LAYER_EXTENSION}##${RDK_ARTIFACTS_BASE_URL}/rdk-oss-rel/${OSS_LAYER_VERSION}/${REL_OSS_MACHINE}/tarball/cve/${REL_OSS_LAYER_EXTENSION}.tgz;sha256sum=${CVE_FILE_CHECKSUM}"


get_cve_checksum returns None for unknown architectures, which will produce an invalid sha256sum= entry in CVE_LAYER_FEED_PATH. Consider failing fast (e.g., fatal error) when the checksum is missing, or avoid appending the CVE feed path unless a checksum is available.

Suggested change

CVE_FILE_CHECKSUM = "${@get_cve_checksum(d)}"

CVE_LAYER_FEED_PATH += " ${REL_OSS_LAYER_EXTENSION}##${RDK_ARTIFACTS_BASE_URL}/rdk-oss-rel/${OSS_LAYER_VERSION}/${REL_OSS_MACHINE}/tarball/cve/${REL_OSS_LAYER_EXTENSION}.tgz;sha256sum=${CVE_FILE_CHECKSUM}"

def get_cve_layer_feed_path(d):

"""

Build the CVE layer feed path only when a valid checksum is available.

Returns an empty string if no checksum is found for the current architecture.

"""

checksum = get_cve_checksum(d)

if not checksum:

return ""

rel_ext = d.getVar('REL_OSS_LAYER_EXTENSION') or ''

base_url = d.getVar('RDK_ARTIFACTS_BASE_URL') or ''

version = d.getVar('OSS_LAYER_VERSION') or ''

machine = d.getVar('REL_OSS_MACHINE') or ''

return f" {rel_ext}##{base_url}/rdk-oss-rel/{version}/{machine}/tarball/cve/{rel_ext}.tgz;sha256sum={checksum}"

CVE_FILE_CHECKSUM = "${@get_cve_checksum(d)}"

CVE_LAYER_FEED_PATH += "${@get_cve_layer_feed_path(d)}"

Copilot · 2026-03-02T00:55:20Z

 Generated by [`auto-changelog`](https://github.com/CookPete/auto-changelog).

+#### [4.11.0](https://github.com/rdkcentral/meta-oss-reference-release/compare/4.10.1...4.11.0)
+


This entry is missing the release date line (the rest of the changelog uses a > <date> line under each version header). Add the date for 4.11.0 to keep the format consistent.

Suggested change

> 27 February 2026

Copilot · 2026-03-02T00:55:20Z

+- RDKCOM-5437, RDKDEV-1130: Weak assigment of REL_OSS_IPK_SERVER_PATH [`#47`](https://github.com/rdkcentral/meta-oss-reference-release/pull/47)
+- Update CODEOWNERS [`#73`](https://github.com/rdkcentral/meta-oss-reference-release/pull/73)
+- RDKE-899: Update changelog for Rel 4.10.0 [`0191197`](https://github.com/rdkcentral/meta-oss-reference-release/commit/01911972f7a9063942ea8e180d4c05152232e397)
+- Merge tag '4.9.0' into develop [`6f9d2df`](https://github.com/rdkcentral/meta-oss-reference-release/commit/6f9d2df82f9cfaf5cab200bb39b2a63c77259cec)
+- RDKDEV-1130: Weak assigment of REL_OSS_IPK_SERVER_PATH [`6109869`](https://github.com/rdkcentral/meta-oss-reference-release/commit/6109869e439fc23150954e0a37d0bfc6f381ab69)


Spelling: "assigment" should be "assignment".

Suggested change

- RDKCOM-5437, RDKDEV-1130: Weak assigment of REL_OSS_IPK_SERVER_PATH [`#47`](https://github.com/rdkcentral/meta-oss-reference-release/pull/47)

- Update CODEOWNERS [`#73`](https://github.com/rdkcentral/meta-oss-reference-release/pull/73)

- RDKE-899: Update changelog for Rel 4.10.0 [`0191197`](https://github.com/rdkcentral/meta-oss-reference-release/commit/01911972f7a9063942ea8e180d4c05152232e397)

- Merge tag '4.9.0' into develop [`6f9d2df`](https://github.com/rdkcentral/meta-oss-reference-release/commit/6f9d2df82f9cfaf5cab200bb39b2a63c77259cec)

- RDKDEV-1130: Weak assigment of REL_OSS_IPK_SERVER_PATH [`6109869`](https://github.com/rdkcentral/meta-oss-reference-release/commit/6109869e439fc23150954e0a37d0bfc6f381ab69)

- RDKCOM-5437, RDKDEV-1130: Weak assignment of REL_OSS_IPK_SERVER_PATH [`#47`](https://github.com/rdkcentral/meta-oss-reference-release/pull/47)

- Update CODEOWNERS [`#73`](https://github.com/rdkcentral/meta-oss-reference-release/pull/73)

- RDKE-899: Update changelog for Rel 4.10.0 [`0191197`](https://github.com/rdkcentral/meta-oss-reference-release/commit/01911972f7a9063942ea8e180d4c05152232e397)

- Merge tag '4.9.0' into develop [`6f9d2df`](https://github.com/rdkcentral/meta-oss-reference-release/commit/6f9d2df82f9cfaf5cab200bb39b2a63c77259cec)

- RDKDEV-1130: Weak assignment of REL_OSS_IPK_SERVER_PATH [`6109869`](https://github.com/rdkcentral/meta-oss-reference-release/commit/6109869e439fc23150954e0a37d0bfc6f381ab69)

Copilot · 2026-03-02T00:55:20Z

+- RDKCOM-5437, RDKDEV-1130: Weak assigment of REL_OSS_IPK_SERVER_PATH [`#47`](https://github.com/rdkcentral/meta-oss-reference-release/pull/47)
+- Update CODEOWNERS [`#73`](https://github.com/rdkcentral/meta-oss-reference-release/pull/73)
+- RDKE-899: Update changelog for Rel 4.10.0 [`0191197`](https://github.com/rdkcentral/meta-oss-reference-release/commit/01911972f7a9063942ea8e180d4c05152232e397)
+- Merge tag '4.9.0' into develop [`6f9d2df`](https://github.com/rdkcentral/meta-oss-reference-release/commit/6f9d2df82f9cfaf5cab200bb39b2a63c77259cec)
+- RDKDEV-1130: Weak assigment of REL_OSS_IPK_SERVER_PATH [`6109869`](https://github.com/rdkcentral/meta-oss-reference-release/commit/6109869e439fc23150954e0a37d0bfc6f381ab69)


Spelling: "assigment" should be "assignment".

Suggested change

- RDKCOM-5437, RDKDEV-1130: Weak assigment of REL_OSS_IPK_SERVER_PATH [`#47`](https://github.com/rdkcentral/meta-oss-reference-release/pull/47)

- Update CODEOWNERS [`#73`](https://github.com/rdkcentral/meta-oss-reference-release/pull/73)

- RDKE-899: Update changelog for Rel 4.10.0 [`0191197`](https://github.com/rdkcentral/meta-oss-reference-release/commit/01911972f7a9063942ea8e180d4c05152232e397)

- Merge tag '4.9.0' into develop [`6f9d2df`](https://github.com/rdkcentral/meta-oss-reference-release/commit/6f9d2df82f9cfaf5cab200bb39b2a63c77259cec)

- RDKDEV-1130: Weak assigment of REL_OSS_IPK_SERVER_PATH [`6109869`](https://github.com/rdkcentral/meta-oss-reference-release/commit/6109869e439fc23150954e0a37d0bfc6f381ab69)

- RDKCOM-5437, RDKDEV-1130: Weak assignment of REL_OSS_IPK_SERVER_PATH [`#47`](https://github.com/rdkcentral/meta-oss-reference-release/pull/47)

- Update CODEOWNERS [`#73`](https://github.com/rdkcentral/meta-oss-reference-release/pull/73)

- RDKE-899: Update changelog for Rel 4.10.0 [`0191197`](https://github.com/rdkcentral/meta-oss-reference-release/commit/01911972f7a9063942ea8e180d4c05152232e397)

- Merge tag '4.9.0' into develop [`6f9d2df`](https://github.com/rdkcentral/meta-oss-reference-release/commit/6f9d2df82f9cfaf5cab200bb39b2a63c77259cec)

- RDKDEV-1130: Weak assignment of REL_OSS_IPK_SERVER_PATH [`6109869`](https://github.com/rdkcentral/meta-oss-reference-release/commit/6109869e439fc23150954e0a37d0bfc6f381ab69)

Copilot · 2026-03-02T00:55:21Z

 | Components | Tag |
 |----------|--------|
-| packagegroup-oss-layer | 4.7.0-r0|
+| packagegroup-oss-layer | 4.12.0-r0|



The README is describing a 4.12.0 release, but the changelog’s latest entry is 4.11.0. Either add a 4.12.0 section to CHANGELOG.md or align the README/version references so the release documentation is consistent.

Copilot · 2026-03-02T00:55:21Z

@@ -36,7 +36,7 @@ Unified OSS Layer - The components of the OSS (Open Source Software) layer, incl

 This release will provide a versioned `"meta-oss-reference-release"` that will be used by other stack layes to resolve build and runtime dependencies.


Spelling: "layes" should be "layers".

Suggested change

This release will provide a versioned `"meta-oss-reference-release"` that will be used by other stack layes to resolve build and runtime dependencies.

This release will provide a versioned `"meta-oss-reference-release"` that will be used by other stack layers to resolve build and runtime dependencies.

Copilot · 2026-03-02T00:55:21Z

+permissions:
+  contents: read
+  pull-requests: write
+  actions: write
+  statuses: write
+
+on:
+  issue_comment:
+    types: [created]
+  pull_request_target:
+    types: [opened, closed, synchronize]
+
+jobs:
+  CLA-Lite:
+    name: "Signature"
+    uses: rdkcentral/cmf-actions/.github/workflows/cla.yml@v1
+    secrets:
+      PERSONAL_ACCESS_TOKEN: ${{ secrets.CLA_ASSISTANT }}


This workflow runs on pull_request_target and passes a PAT-like secret (CLA_ASSISTANT) while granting multiple write permissions. Since pull_request_target executes in the base repo context, ensure the referenced reusable workflow cannot be influenced to run untrusted PR code (e.g., avoid checking out PR head or executing scripts from the PR). If not strictly required, reduce permissions to the minimum needed and consider restricting triggers/conditions to trusted actors.

OSS Release 4.12.0

Update CODEOWNERS

Copilot

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 3 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-04-16T14:18:45Z

+- RDKCOM-5437, RDKDEV-1130: Weak assigment of REL_OSS_IPK_SERVER_PATH [`#47`](https://github.com/rdkcentral/meta-oss-reference-release/pull/47)
+- Update CODEOWNERS [`#73`](https://github.com/rdkcentral/meta-oss-reference-release/pull/73)
+- RDKE-899: Update changelog for Rel 4.10.0 [`0191197`](https://github.com/rdkcentral/meta-oss-reference-release/commit/01911972f7a9063942ea8e180d4c05152232e397)
+- Merge tag '4.9.0' into develop [`6f9d2df`](https://github.com/rdkcentral/meta-oss-reference-release/commit/6f9d2df82f9cfaf5cab200bb39b2a63c77259cec)
+- RDKDEV-1130: Weak assigment of REL_OSS_IPK_SERVER_PATH [`6109869`](https://github.com/rdkcentral/meta-oss-reference-release/commit/6109869e439fc23150954e0a37d0bfc6f381ab69)


Correct spelling of 'assigment' to 'assignment'.

Suggested change

- RDKCOM-5437, RDKDEV-1130: Weak assigment of REL_OSS_IPK_SERVER_PATH [`#47`](https://github.com/rdkcentral/meta-oss-reference-release/pull/47)

- Update CODEOWNERS [`#73`](https://github.com/rdkcentral/meta-oss-reference-release/pull/73)

- RDKE-899: Update changelog for Rel 4.10.0 [`0191197`](https://github.com/rdkcentral/meta-oss-reference-release/commit/01911972f7a9063942ea8e180d4c05152232e397)

- Merge tag '4.9.0' into develop [`6f9d2df`](https://github.com/rdkcentral/meta-oss-reference-release/commit/6f9d2df82f9cfaf5cab200bb39b2a63c77259cec)

- RDKDEV-1130: Weak assigment of REL_OSS_IPK_SERVER_PATH [`6109869`](https://github.com/rdkcentral/meta-oss-reference-release/commit/6109869e439fc23150954e0a37d0bfc6f381ab69)

- RDKCOM-5437, RDKDEV-1130: Weak assignment of REL_OSS_IPK_SERVER_PATH [`#47`](https://github.com/rdkcentral/meta-oss-reference-release/pull/47)

- Update CODEOWNERS [`#73`](https://github.com/rdkcentral/meta-oss-reference-release/pull/73)

- RDKE-899: Update changelog for Rel 4.10.0 [`0191197`](https://github.com/rdkcentral/meta-oss-reference-release/commit/01911972f7a9063942ea8e180d4c05152232e397)

- Merge tag '4.9.0' into develop [`6f9d2df`](https://github.com/rdkcentral/meta-oss-reference-release/commit/6f9d2df82f9cfaf5cab200bb39b2a63c77259cec)

- RDKDEV-1130: Weak assignment of REL_OSS_IPK_SERVER_PATH [`6109869`](https://github.com/rdkcentral/meta-oss-reference-release/commit/6109869e439fc23150954e0a37d0bfc6f381ab69)

Copilot · 2026-04-16T14:18:45Z

+  actions: write
+  statuses: write


The workflow requests multiple write scopes. If the called reusable workflow doesn’t strictly require actions: write and statuses: write, drop them to follow least-privilege. Keeping only the minimal required permissions materially reduces the impact of any token misuse in pull_request_target / comment-trigger contexts.

Suggested change

actions: write

statuses: write

Copilot · 2026-04-16T14:18:46Z

@@ -0,0 +1,20 @@
+name: "CLA"


The PR title suggests only a rebase, but the diff includes functional/config changes (feed logic + CVE feed), documentation version bumps, and new GitHub workflow/CODEOWNERS updates. Consider updating the PR title/description to reflect the actual scope so reviewers and release tooling have accurate context.

Reason for change: Update the README inline with latest release 4.13.0 Signed-off-by: Arjun <arjun_daasuramdass@comcast.com>

Release 4.13.0

Copilot

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 4 comments.

 Generated by [`auto-changelog`](https://github.com/CookPete/auto-changelog).

+#### [4.13.0](https://github.com/rdkcentral/meta-oss-reference-release/compare/4.12.2...4.13.0)
+


- [ ] meta-rdk-oss-reference [4.6.0-->4.7.0] (https://github.com/rdkcentral/meta-rdk-oss-reference/compare/4.6.0...4.7.0)
- [ ] poky [4.3.0-->4.3.1] (https://github.com/rdkcentral/poky/compare/4.3.0...4.3.1)
+- [ ] meta-rdk-auxiliary [1.8.0-->1.9.0] (https://github.com/rdkcentral/meta-rdk-auxiliary/compare/1.8.0...1.9.0)
+- [ ] meta-rdk-oss-reference [4.12.0-->4.13.0] (https://github.com/rdkcentral/meta-rdk-oss-reference/compare/4.12.0...4.13.0)


+- RDKCOM-5437, RDKDEV-1130: Weak assigment of REL_OSS_IPK_SERVER_PATH [`#47`](https://github.com/rdkcentral/meta-oss-reference-release/pull/47)
+- Update CODEOWNERS [`#73`](https://github.com/rdkcentral/meta-oss-reference-release/pull/73)
+- RDKE-899: Update changelog for Rel 4.10.0 [`0191197`](https://github.com/rdkcentral/meta-oss-reference-release/commit/01911972f7a9063942ea8e180d4c05152232e397)
+- Merge tag '4.9.0' into develop [`6f9d2df`](https://github.com/rdkcentral/meta-oss-reference-release/commit/6f9d2df82f9cfaf5cab200bb39b2a63c77259cec)
+- RDKDEV-1130: Weak assigment of REL_OSS_IPK_SERVER_PATH [`6109869`](https://github.com/rdkcentral/meta-oss-reference-release/commit/6109869e439fc23150954e0a37d0bfc6f381ab69)


+> 3 September 2025
+
+- 4.7.4-community changelog [`e2b02bf`](https://github.com/rdkcentral/meta-oss-reference-release/commit/e2b02bfc8c0c92b0e78e458a0231bab397d7073f)
+- RDKEOSS-3 fix meta-rdk-auxilary and meta-rdk-oss-reference versions [`0485e7e`](https://github.com/rdkcentral/meta-oss-reference-release/commit/0485e7e824323179570e669cd439a5fe98774670)


mselva006c and others added 8 commits June 8, 2025 03:13

Merge tag '4.7.0' into develop

89c0990

OSS Release 4.7.0

Deploy cla action

71726fe

RDKOSS-420: Support for REL_OSS_LAYER_ARCH and OSS_LAYER_ARCH (#43)

72cb387

Reason for change: Added support for consuming release OSS IPK packages using the architecture specified in REL_OSS_LAYER_ARCH, and for building OSS with an extended architecture defined by OSS_LAYER_ARCH.

RDKE-849: Update Release version

be3ffce

Reason for change: Update release version for 4.8.0 Signed-off-by: mselva006c <mani_selvaraj@comcast.com>

RDKE-849: Update change log for Rel 4.8.0

00b7e8e

Reason for change: Update change log for oss release 4.8.0 Signed-off-by: mselva006c <mani_selvaraj@comcast.com>

Merge branch 'release/4.8.0' into main

e3bcf8b

Merge tag '4.8.0' into develop

3abcfc7

OSS Release 4.8.0

RDKDEV-1130: Weak assigment of REL_OSS_IPK_SERVER_PATH

6109869

With this change REL_OSS_IPK_SERVER_PATH can be override from local.conf for custom/local builds.

madhubabutt requested review from a team August 19, 2025 07:37

rdkcmf-jenkins and others added 19 commits September 26, 2025 11:34

Merge branch 'develop' into feature/action-deploy-for/develop

d987d78

Deploy cla action

d325324

Merge pull request #39 from rdkcentral/feature/action-deploy-for/develop

1c0f2d1

Deploy cla action

Merge pull request #59 from rdkcentral/maniselva006c-patch-2

865b5ac

RDKOSS-490: Move OSS_LAYER_VERSION to reference layer

RDKE-893: Update Release note for 4.9.0

d20f5ae

Signed-off-by: mselva006c <mani_selvaraj@comcast.com>

Merge pull request #66 from rdkcentral/feature/RDKE-893

c4f2ee7

RDKE-893: Update Release note for 4.9.0

RDKE-893: Update changelog for Rel 4.9.0

411de3f

Signed-off-by: mselva006c <mani_selvaraj@comcast.com>

Merge branch 'release/4.9.0' into main

c1a840b

Merge tag '4.9.0' into develop

6f9d2df

OSS Release 4.9.0

Merge branch 'develop' into RDKDEV-1130

e5c0828

Update CODEOWNERS

3e1df04

Merge pull request #73 from rdkcentral/sbarre01-patch-1

1f5976d

Update CODEOWNERS

Merge branch 'develop' into RDKDEV-1130

5c29cb8

Merge pull request #47 from meecash/RDKDEV-1130

b3f7447

RDKCOM-5437, RDKDEV-1130: Weak assigment of REL_OSS_IPK_SERVER_PATH

RDKE-899: Update changelog for Rel 4.10.0

0191197

Signed-off-by: mselva006c <mani_selvaraj@comcast.com>

Merge branch 'release/4.10.0'

f80da68

Merge tag '4.10.0' into develop

0ac247d

OSS Release tag 4.10.0

RDKE-971: Update release notes for 4.11.0

174e68c

Signed-off-by: mselva006c <mani_selvaraj@comcast.com>

Merge pull request #79 from rdkcentral/feature/RDKE-971

38b8215

RDKE-971: Update release notes for 4.11.0

Copilot AI review requested due to automatic review settings March 1, 2026 04:52

Copilot started reviewing on behalf of maniselva006c March 1, 2026 04:52 View session

Copilot AI reviewed Mar 1, 2026

View reviewed changes

mselva006c and others added 5 commits March 1, 2026 17:01

RDKE-971: Update Changelog for Rel 4.11.0

e1b9f99

Signed-off-by: mselva006c <mani_selvaraj@comcast.com>

Merge branch 'release/4.11.0'

d24c9dc

Merge tag '4.11.0' into develop

532c056

OSS Release 4.11.0

RDKE-971: Updated Release note for 4.12.0

29cef43

Signed-off-by: mselva006c <mani_selvaraj@comcast.com>

Merge pull request #82 from rdkcentral/test_4_12_0

7da3f50

RDKE-971: Updated Release note for 4.12.0

Copilot AI review requested due to automatic review settings March 2, 2026 00:51

Copilot started reviewing on behalf of maniselva006c March 2, 2026 00:51 View session

RDKE-971: Update Changelog for Rel 4.12.0

83ded17

Signed-off-by: mselva006c <mani_selvaraj@comcast.com>

Copilot AI reviewed Mar 2, 2026

View reviewed changes

mselva006c and others added 4 commits March 2, 2026 00:56

Merge branch 'release/4.12.0'

4799f3b

Merge tag '4.12.0' into develop

0fa9124

OSS Release 4.12.0

Update CODEOWNERS

9e3c5ac

Merge pull request #87 from rdkcentral/sbarre01-patch-1

c3f9ec5

Update CODEOWNERS

Copilot AI review requested due to automatic review settings April 16, 2026 14:15

Copilot AI reviewed Apr 16, 2026

View reviewed changes

Arjun-DR and others added 4 commits May 14, 2026 09:45

RDKE-1040: Update release notes for 4.13.0 (#88)

7d31f4e

Reason for change: Update the README inline with latest release 4.13.0 Signed-off-by: Arjun <arjun_daasuramdass@comcast.com>

4.13.0 release change log updates

274ec09

Merge branch 'release/4.13.0'

97dc61f

Merge tag '4.13.0' into develop

5d4365c

Release 4.13.0

Copilot AI review requested due to automatic review settings May 15, 2026 18:31

Copilot started reviewing on behalf of vbabypublic May 15, 2026 18:31 View session

Copilot AI reviewed May 15, 2026

View reviewed changes

-    return  mapping.get(arch)
+    checksum = mapping.get(arch)
+    if not checksum:
+        bb.fatal("No CVE checksum defined for REL_OSS_LAYER_ARCH='%s' in oss.inc" % arch)
+    return checksum

		@@ -3,33 +3,25 @@
		RDK_ARTIFACTS_BASE_URL ?= ""
		RDK_ARTIFACTS_URL ?= ""

+def get_oss_machine(d):
+    """
+    Return the machine identifier to be used for OSS artifacts.
+    By default, this is the current BitBake MACHINE value.
+    """
+    return d.getVar('MACHINE') or ''
+def get_oss_arch(d):
+    """
+    Return the architecture identifier to be used for OSS artifacts.
+    Prefer an explicitly configured OSS_LAYER_ARCH, and fall back
+    to common BitBake architecture variables if needed.
+    """
+    return (d.getVar('OSS_LAYER_ARCH')
+            or d.getVar('TARGET_ARCH')
+            or d.getVar('PACKAGE_ARCH')
+            or '')

	PACKAGE_EXTRA_ARCHS:append = "${@ '' if '${REL_OSS_LAYER_ARCH}' == '${OSS_LAYER_ARCH}' else ' ${REL_OSS_LAYER_ARCH}'}"
	PACKAGE_EXTRA_ARCHS:append = " ${REL_OSS_LAYER_ARCH}"

-    return  mapping.get(arch)
+    if not arch:
+        bb.fatal("REL_OSS_LAYER_ARCH is not set, cannot determine CVE file checksum")
+    if arch not in mapping:
+        bb.fatal("Unsupported REL_OSS_LAYER_ARCH '%s' for CVE file checksum" % arch)
+    return mapping[arch]

		CVE_FILE_CHECKSUM = "${@get_cve_checksum(d)}"
		CVE_LAYER_FEED_PATH += " ${REL_OSS_LAYER_EXTENSION}##${RDK_ARTIFACTS_BASE_URL}/rdk-oss-rel/${OSS_LAYER_VERSION}/${REL_OSS_MACHINE}/tarball/cve/${REL_OSS_LAYER_EXTENSION}.tgz;sha256sum=${CVE_FILE_CHECKSUM}"

-CVE_FILE_CHECKSUM = "${@get_cve_checksum(d)}"
-CVE_LAYER_FEED_PATH += " ${REL_OSS_LAYER_EXTENSION}##${RDK_ARTIFACTS_BASE_URL}/rdk-oss-rel/${OSS_LAYER_VERSION}/${REL_OSS_MACHINE}/tarball/cve/${REL_OSS_LAYER_EXTENSION}.tgz;sha256sum=${CVE_FILE_CHECKSUM}"
+def get_cve_layer_feed_path(d):
+    """
+    Build the CVE layer feed path only when a valid checksum is available.
+    Returns an empty string if no checksum is found for the current architecture.
+    """
+    checksum = get_cve_checksum(d)
+    if not checksum:
+        return ""
+    rel_ext = d.getVar('REL_OSS_LAYER_EXTENSION') or ''
+    base_url = d.getVar('RDK_ARTIFACTS_BASE_URL') or ''
+    version = d.getVar('OSS_LAYER_VERSION') or ''
+    machine = d.getVar('REL_OSS_MACHINE') or ''
+    return f" {rel_ext}##{base_url}/rdk-oss-rel/{version}/{machine}/tarball/cve/{rel_ext}.tgz;sha256sum={checksum}"
+CVE_FILE_CHECKSUM = "${@get_cve_checksum(d)}"
+CVE_LAYER_FEED_PATH += "${@get_cve_layer_feed_path(d)}"

		Generated by [`auto-changelog`](https://github.com/CookPete/auto-changelog).

		#### [4.11.0](https://github.com/rdkcentral/meta-oss-reference-release/compare/4.10.1...4.11.0)

		@@ -36,7 +36,7 @@ Unified OSS Layer - The components of the OSS (Open Source Software) layer, incl

		This release will provide a versioned `"meta-oss-reference-release"` that will be used by other stack layes to resolve build and runtime dependencies.

		Generated by [`auto-changelog`](https://github.com/CookPete/auto-changelog).

		#### [4.13.0](https://github.com/rdkcentral/meta-oss-reference-release/compare/4.12.2...4.13.0)

Conversation

madhubabutt commented Aug 19, 2025

Uh oh!

CLAassistant commented Aug 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Mar 1, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 1, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 1, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 1, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 1, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 1, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 1, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 1, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Mar 2, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 2, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 2, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 2, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 2, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 2, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 2, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Apr 16, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 16, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 16, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Reviewers

Assignees

Labels

CLAassistant commented Aug 19, 2025 •

edited

Loading