RDKEVD-6147 : Update CVE layer path

[vijithtv11]

RDKEVD-6147
{DO NOT MERGE]

[github-actions]

Thank you for your submission, we really appreciate it. Like many open-source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution. You can sign the CLA by just posting a Pull Request Comment same as the below format.

---

I have read the CLA Document and I hereby sign the CLA

---

_{You can retrigger this bot by commenting recheck in this Pull Request. Posted by the CLA Assistant Lite bot.}

[Copilot]

Pull request overview

This PR updates how the middleware OPKG feed paths are constructed, apparently to point builds at a CVE-layer artifact location in Artifactory.

Changes:

• Switches RELEASE_NUM and the primary middleware feed base path from middleware-rel/... to middleware-dbg/....
• Hardcodes the OSS middleware IPK path to a specific release string.
• Adds a new CVE-layer URL (currently a tarball URL) and appends it to IPK_FEED_URIS.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

File	Description
conf/machine/include/oss_mw.inc	Changes OSS feed path construction (currently hardcoded to a single release).
conf/machine/include/middleware.inc	Updates release/feed paths and introduces a CVE-layer URL added to feed URIs.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

Comments suppressed due to low confidence (2)

conf/machine/include/oss_mw.inc:5

• MW_OSS_IPK_PATH is now hardcoded to middleware-rel/8.6.1.0, while middleware.inc sets RELEASE_NUM to RDKEVD-6147-mw-t3. This makes OSS IPK feeds come from a different release than the middleware feed and removes the ability to switch releases via RELEASE_NUM overrides.

MW_OSS_IPK_PATH ?= "middleware-dbg/RDKEVD-6147-mw-t3"

conf/machine/include/middleware.inc:10

• PR description says "Update CVE layer path", but this diff also changes RELEASE_NUM and switches the main middleware feed from middleware-rel/... to middleware-dbg/..., which can change where all middleware IPKs are fetched from. Please confirm these broader feed changes are intended for this ticket/PR.

RELEASE_NUM = "RDKEVD-6147-mw-t3"

MW_IPK_PATH ?= "middleware-dbg/${RELEASE_NUM}"

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

Comments suppressed due to low confidence (3)

conf/machine/include/oss_mw.inc:5

• MW_OSS_IPK_PATH hardcodes the release/ticket string, while middleware.inc uses ${RELEASE_NUM} to drive the path. Using ${RELEASE_NUM} here keeps OSS/non-OSS feeds consistent and avoids having to update multiple files when the release identifier changes.

MW_OSS_IPK_PATH ?= "middleware-dbg/RDKEVD-6147-mw-t3"

conf/machine/include/middleware.inc:18

• This CVE feed URL hardcodes the release identifier (RDKEVD-6147-mw-t3) even though RELEASE_NUM is already defined above. Using ${RELEASE_NUM} keeps the value consistent with the configured feed paths.

CVE_LAYER_FEED_PATH += "https://partners.artifactory.comcast.com/artifactory/middleware-dbg/RDKEVD-6147-mw-t3/rdktv-us-armv8a/tarball/cve/debug/rdktv-us-armv8a-middleware.tgz;sha256sum=1cbb6d4534c7f18c699b642a9edece77575b25e387e9bcc19d4325969e346b18"

conf/machine/include/middleware.inc:10

• The PR title/description says this is a CVE layer path update, but this hunk also changes RELEASE_NUM and switches IPK feeds from middleware-rel/... to middleware-dbg/..., which is a broader behavior change. Either update the PR description/scope accordingly or split the CVE-path change from the feed/release changes to reduce review and rollout risk.

RELEASE_NUM = "RDKEVD-6147-mw-t3"

MW_IPK_PATH ?= "middleware-dbg/${RELEASE_NUM}"

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (5)

conf/machine/include/oss_mw.inc:5

• MW_OSS_IPK_PATH hardcodes the ticket build ID; since oss_mw.inc is included from middleware.inc where RELEASE_NUM is defined, reusing ${RELEASE_NUM} avoids duplication and keeps the OSS and non-OSS paths in sync.

MW_OSS_IPK_PATH ?= "middleware-dbg/RDKEVD-6147-mw-t3"

conf/machine/include/oss_mw.inc:8

• This CVE_LAYER_FEED_PATH entry is fully hardcoded (release ID, machine arch, build variant, and tarball name). In a machine include, this will likely break for any RDK_MW_ARCH other than rdktv-us-armv8a, and it duplicates values already available via variables. Consider composing the URL from ${MW_OSS_IPK_PATH}, ${RDK_MW_ARCH}, ${BUILD_VARIANT}, and ${MW_OSS} to keep it portable.

CVE_LAYER_FEED_PATH += "${MW_OSS}##${RDK_ARTIFACTS_BASE_URL}/middleware-dbg/RDKEVD-6147-mw-t3/rdktv-us-armv8a/tarball/cve/debug/rdk-arm64-oss-middleware.tgz;sha256sum=e3aa9d7b7e863bf14c20bec47096e5a3a4e5ffce9e12ccab5465c6ca3416df0d"

conf/machine/include/middleware.inc:18

• This CVE_LAYER_FEED_PATH entry hardcodes the machine directory (rdktv-us-armv8a), build variant (debug), and repeats the release ID even though ${RELEASE_NUM}, ${RDK_MW_ARCH}, ${BUILD_VARIANT}, and ${MIDDLEWARE_ARCH} are already available in this file. As written, this path will be wrong for other machines / variants.

CVE_LAYER_FEED_PATH += "${MIDDLEWARE_ARCH}##${RDK_ARTIFACTS_BASE_URL}/middleware-dbg/RDKEVD-6147-mw-t3/rdktv-us-armv8a/tarball/cve/debug/rdktv-us-armv8a-middleware.tgz;sha256sum=1cbb6d4534c7f18c699b642a9edece77575b25e387e9bcc19d4325969e346b18"

conf/machine/include/middleware.inc:10

• RELEASE_NUM is changed from a semantic release version to a ticket-specific debug identifier, and the PR description indicates "DO NOT MERGE". If this include is used for regular builds, these defaults may inadvertently point builds at a temporary debug feed. Consider gating these overrides behind a build flag/feature (or moving them to a local/CI-only config) so mergeable defaults still reference the standard release feed.

RELEASE_NUM = "RDKEVD-6147-mw-t3"

MW_IPK_PATH ?= "middleware-dbg/${RELEASE_NUM}"

conf/machine/include/middleware.inc:18

• Within this repository, CVE_LAYER_FEED_PATH is only assigned in these new lines and is not referenced anywhere else. If something is expected to consume it (e.g., a class/recipe that publishes or fetches CVE tarballs), consider adding that integration or documenting where it is used; otherwise this setting may have no effect.

include ${@'oss_mw.inc' if 'STACK_LAYER_OSS_SUPPORT' in d.getVar('DISTRO_FEATURES').split() else ''}

CVE_LAYER_FEED_PATH += "${MIDDLEWARE_ARCH}##${RDK_ARTIFACTS_BASE_URL}/middleware-dbg/RDKEVD-6147-mw-t3/rdktv-us-armv8a/tarball/cve/debug/rdktv-us-armv8a-middleware.tgz;sha256sum=1cbb6d4534c7f18c699b642a9edece77575b25e387e9bcc19d4325969e346b18"