Add xPKI certifier server configuration and seed certificate to enable certificate procurement for SSA-CPC by Sidsohail · Pull Request #138 · rdkcentral/docker-device-mgt-service-test

Sidsohail · 2026-03-05T03:57:01Z

No description provided.

rdkcmf-jenkins · 2026-03-05T03:57:56Z

b'## Blackduck scan failure details

Summary: 0 violations, 0 files pending approval, 1 file pending identification.

Protex Server Path: /home/blackduck/github/docker-device-mgt-service-test/138/rdkcentral/docker-device-mgt-service-test
Commit: b56859c

Report detail: gist'

Copilot

Pull request overview

This PR extends the container-based test environment for RDK-61060 by adding (1) optional PKCS#11 support to the native-platform mTLS certificate flow and (2) a new mock XPKI Certifier HTTPS service in the mock-xconf container, exposed via docker-compose.

Changes:

Add ENABLE_PKCS11 plumbing and PKCS#11 setup steps to native-platform startup + certificate generation flow.
Add a new xpki-certifier.js service to mock-xconf (port 50054) and generate a dedicated Test-RDK-xpki CA hierarchy for signing CSRs.
Update Dockerfiles/compose to include required scripts/deps and expose the new service port.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 7 comments.

Show a summary per file

File	Description
native-platform/entrypoint.sh	Exports `ENABLE_PKCS11` and documents PKCS#11-aware cert setup.
native-platform/certs.sh	Improves server CA import and adds PKCS#11 OpenSSL/token setup + reference P12 handling.
native-platform/Dockerfile	Pins `rdk-cert-config` and installs PKCS#11 dependencies + symlinks setup scripts.
mock-xconf/xpki-certifier.js	New HTTPS mock XPKI certifier service that signs CSRs using an XPKI ICA.
mock-xconf/entrypoint.sh	Starts the new XPKI certifier service.
mock-xconf/certs.sh	Generates a Test-RDK-xpki root/ICA for the XPKI certifier.
mock-xconf/Dockerfile	Copies the new service into the image and documents port 50054.
compose.yaml	Publishes port 50054 to the host for the new service.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.

rdkcmf-jenkins · 2026-03-05T07:38:42Z

b'## Blackduck scan failure details

Summary: 0 violations, 0 files pending approval, 1 file pending identification.

Protex Server Path: /home/blackduck/github/docker-device-mgt-service-test/138/rdkcentral/docker-device-mgt-service-test
Commit: e3ecff4

Report detail: gist'

rdkcmf-jenkins · 2026-03-05T07:43:08Z

b'## Blackduck scan failure details

Summary: 0 violations, 0 files pending approval, 1 file pending identification.

Protex Server Path: /home/blackduck/github/docker-device-mgt-service-test/138/rdkcentral/docker-device-mgt-service-test
Commit: a887d08

Report detail: gist'

Copilot

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated 7 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.

rdkcmf-jenkins · 2026-03-05T11:03:03Z

b'## WARNING: A Blackduck scan failure has been waived

A prior failure has been upvoted

Upvote reason: Spurious match, OK
Commit: a887d08
'

Copilot

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated 12 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.

Copilot

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated 10 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.

Copilot

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated 6 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.

Copilot

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated 7 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.

Copilot

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated 3 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated no new comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated 1 comment.

Comments suppressed due to low confidence (1)

mock-xconf/entrypoint.sh:66

The entrypoint backgrounds multiple Node processes and then PID 1 becomes an infinite while true loop, but there’s no trap to forward SIGTERM/SIGINT and gracefully stop child processes (including xpki-certifier). This can cause slow/unclean container shutdowns and orphaned processes. Add a trap that kills/waits for background jobs before exiting.

## Keep the container running . Running an independent process will help in simulating scenarios of webservices going down and coming up
while true ; do echo "Mocked webservice heartbeat ..." && sleep 5 ; done

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated 2 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated 2 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

- Remove 30s wait loop for xPKI seed certificate - Seed cert check/copy moved to test execution (ci-run-pkcs11-tests.sh) - Faster container startup - no blocking on test-specific files

Copilot

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 3 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

- Remove unnecessary cert copying to /etc/xconf/xpki-certs/ - Use original cert paths from /etc/pki/Test-RDK-root/ directly - Change seed cert validity: 30 days → 1 day - Change operational cert validity: 90 days → 1 day (default fallback) - All tests complete within seconds, 1-day validity is sufficient

rdkcmf-jenkins · 2026-04-21T03:53:46Z

b'## Blackduck scan failure details

Summary: 0 violations, 0 files pending approval, 1 file pending identification.

Protex Server Path: /home/blackduck/github/docker-device-mgt-service-test/138/rdkcentral/docker-device-mgt-service-test
Commit: 70597a0

Report detail: gist'

rdkcmf-jenkins · 2026-04-21T09:17:19Z

b'## Blackduck scan failure details

Summary: 0 violations, 0 files pending approval, 1 file pending identification.

Protex Server Path: /home/blackduck/github/docker-device-mgt-service-test/138/rdkcentral/docker-device-mgt-service-test
Commit: 70597a0

Report detail: gist'

rdkcmf-jenkins · 2026-04-21T09:30:11Z

b'## WARNING: A Blackduck scan failure has been waived

A prior failure has been upvoted

Upvote reason: OK - boilerplate match
Commit: 70597a0
'

shibu-kv

Approving from container changes perspective. Please get approval from @vbaska for the mTLS certs related mocking.

Copilot AI review requested due to automatic review settings March 5, 2026 03:57

Sidsohail requested a review from a team as a code owner March 5, 2026 03:57

Copilot started reviewing on behalf of Sidsohail March 5, 2026 03:57 View session

github-advanced-security AI found potential problems Mar 5, 2026

View reviewed changes

Comment thread mock-xconf/xpki-certifier.js Fixed

Copilot AI reviewed Mar 5, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings March 5, 2026 07:38

Copilot started reviewing on behalf of Sidsohail March 5, 2026 07:39 View session

Copilot AI reviewed Mar 5, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings March 9, 2026 05:31

Copilot started reviewing on behalf of Sidsohail March 9, 2026 05:32 View session

Copilot AI reviewed Mar 9, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings March 9, 2026 06:55

Copilot started reviewing on behalf of Sidsohail March 9, 2026 06:55 View session

Copilot AI reviewed Mar 9, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings March 10, 2026 04:20

Copilot started reviewing on behalf of Sidsohail March 10, 2026 04:21 View session

Copilot AI reviewed Mar 10, 2026

View reviewed changes

Comment thread mock-xconf/certs.sh Outdated

Comment thread mock-xconf/certs.sh Outdated

Comment thread mock-xconf/xpki-certifier.js Outdated

Comment thread mock-xconf/xpki-certifier.js

Comment thread native-platform/entrypoint.sh Outdated

Comment thread native-platform/certs.sh

Copilot AI review requested due to automatic review settings March 10, 2026 08:21

Copilot started reviewing on behalf of Sidsohail March 10, 2026 08:21 View session

Copilot AI reviewed Mar 10, 2026

View reviewed changes

shibu-kv approved these changes Mar 11, 2026

View reviewed changes

shibu-kv previously approved these changes Mar 11, 2026

View reviewed changes

Sidsohail dismissed shibu-kv’s stale review via fd57619 March 23, 2026 06:08

Copilot AI review requested due to automatic review settings March 23, 2026 10:08

Copilot started reviewing on behalf of Sidsohail March 23, 2026 10:09 View session

Copilot AI reviewed Mar 23, 2026

View reviewed changes

Comment thread native-platform/Dockerfile

Comment thread mock-xconf/xpki-certifier.js Outdated

Comment thread mock-xconf/certs.sh Outdated

Copilot AI reviewed Apr 13, 2026

View reviewed changes

“sahmad154” and others added 2 commits April 13, 2026 08:04

Fix mTLS race condition: verify ca-chain.pem is non-empty before copying

0a06666

Update certs.sh

9c3ca4e

Copilot AI review requested due to automatic review settings April 13, 2026 12:10

Copilot started reviewing on behalf of Sidsohail April 13, 2026 12:11 View session

Copilot AI reviewed Apr 13, 2026

View reviewed changes

Comment thread mock-xconf/xpki-certifier.js

Update certs.sh

97e2d02

Copilot AI review requested due to automatic review settings April 13, 2026 14:54

Copilot started reviewing on behalf of Sidsohail April 13, 2026 14:54 View session

Copilot AI reviewed Apr 13, 2026

View reviewed changes

Comment thread mock-xconf/entrypoint.sh

Comment thread test_docker.py

“sahmad154” and others added 2 commits April 13, 2026 16:40

Add xPKI seed certificate wait logic for PKCS#11 tests

40d8f4e

Update certs.sh

7ed5e79

Copilot AI review requested due to automatic review settings April 14, 2026 03:47

Copilot started reviewing on behalf of Sidsohail April 14, 2026 03:47 View session

Copilot AI reviewed Apr 14, 2026

View reviewed changes

Comment thread mock-xconf/certs.sh

Comment thread mock-xconf/xpki-certifier.js

“sahmad154” and others added 3 commits April 14, 2026 05:40

Remove seed cert wait logic from container startup

e2b13e0

- Remove 30s wait loop for xPKI seed certificate - Seed cert check/copy moved to test execution (ci-run-pkcs11-tests.sh) - Faster container startup - no blocking on test-specific files

Update certs.sh

4815306

Align certs.sh with develop

a94341b

Copilot AI review requested due to automatic review settings April 15, 2026 05:43

Copilot started reviewing on behalf of Sidsohail April 15, 2026 05:44 View session

Copilot AI reviewed Apr 15, 2026

View reviewed changes

Comment thread test_docker.py

Comment thread mock-xconf/xpki-certifier.js

Comment thread mock-xconf/certs.sh

vbaska requested changes Apr 20, 2026

View reviewed changes

Comment thread mock-xconf/certs.sh Outdated

Comment thread mock-xconf/certs.sh Outdated

vbaska approved these changes Apr 21, 2026

View reviewed changes

shibu-kv approved these changes Apr 21, 2026

View reviewed changes

Sidsohail merged commit 5673843 into develop Apr 22, 2026
9 checks passed

github-actions Bot locked and limited conversation to collaborators Apr 22, 2026

Conversation

Sidsohail commented Mar 5, 2026

Uh oh!

rdkcmf-jenkins commented Mar 5, 2026

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

rdkcmf-jenkins commented Mar 5, 2026

Uh oh!

rdkcmf-jenkins commented Mar 5, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

rdkcmf-jenkins commented Mar 5, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!