1.7.16 release changelog updates

[satya200]

No description provided.

[Copilot]

Pull request overview

This PR extends the Docker-based test harness to support L3 certificate-revocation scenarios (CRL mTLS, cross-signed/bridge PKI, and OCSP stapling), updates the pinned rdk-cert-config dependency, and adds a full certificate-subsystem documentation set alongside compose hardening.

Changes:

• Add CRL mTLS (50061/50062), cross-signed PKI artifacts, and OCSP stapling (50063/50064) to mock-xconf + corresponding native-platform cert pickup/trust-store updates (gated by ENABLE_CRL_L3).
• Update harness validation to account for L3 ports/process counts when enabled.
• Add/organize certificate subsystem docs and update rdk-cert-config version pins.

Reviewed changes

Copilot reviewed 24 out of 24 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
test_docker.py	Makes expected ports and Node process counts conditional on ENABLE_CRL_L3.
native-platform/Dockerfile	Bumps rdk-cert-config dependency tag to 1.0.6.
native-platform/certs.sh	Adds ENABLE_CRL_L3 block to copy CRL/xsign assets and install test roots into system trust.
mock-xconf/ocsp-stapling-server.js	Adds a new OCSP-stapling HTTPS server on port 50064 with periodic cache refresh.
mock-xconf/entrypoint.sh	Starts CRL mTLS server and OCSP responder/stapling stack when ENABLE_CRL_L3=true.
mock-xconf/Dockerfile	Pins rdk-cert-config to 1.0.6, adds new JS servers, exposes new ports.
mock-xconf/crl-mtls-server.js	Adds mTLS server enforcing CRLs, with live reload support via setSecureContext().
mock-xconf/crl-control.js	Adds HTTP control endpoint to revoke certs and regenerate/reload CRLs.
mock-xconf/certs.sh	Generates CRL/OCSP PKI and cross-signed PKI under ENABLE_CRL_L3.
docs/README.md	Adds documentation index for the harness and certificate subsystem.
docs/certificates/README.md	Adds top-level certificate subsystem overview and link index.
docs/certificates/architecture.md	Documents PKI hierarchy and shared-volume trust flow.
docs/certificates/certificate-lifecycle.md	Documents ordered startup/generation/exchange lifecycle.
docs/certificates/shared-volume-contract.md	Documents shared-volume file contract and cleanup semantics.
docs/certificates/configuration.md	Documents env vars, ports, paths, and CertSelector configuration.
docs/certificates/pkcs11.md	Documents PKCS#11/SoftHSM flow in native-platform.
docs/certificates/xpki-certifier.md	Documents xPKI certifier behavior and endpoints.
docs/certificates/crl-mtls.md	Documents CRL mTLS + live revocation architecture.
docs/certificates/cross-signed-pki.md	Documents bridge/cross-signed PKI artifacts and tests.
docs/certificates/ocsp-stapling.md	Documents OCSP responder + stapling server design and verification.
docs/certificates/troubleshooting.md	Adds troubleshooting guide for certificate subsystem failures.
compose.yaml	Adds L3 ports/env toggles and capability/security hardening for services.
CHANGELOG.md	Adds 1.7.16 section entries.
.github/skills/technical-documentation-writer/SKILL.md	Adds a documentation-writing skill reference for this repo.

Suppressed comments (1)

test_docker.py:73

• container.exec_run("cat /proc/net/tcp6") is executed once per port, which adds noticeable overhead (and scales with the new L3 port list). You can run it once and reuse the output when checking multiple ports.

    for port in expected_ports:
        hex_port = format(port, '04x').upper()  # Convert port number to uppercase hex (e.g., 50050 -> 'C382')
        exit_code, output = container.exec_run("cat /proc/net/tcp6")

        print(f"Checking port {port} (Hex: {hex_port}) inside mockxconf...")

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[tdeva14]

LGTM