RDKB-65607: Check devicetype RFC for prod images alone

[NareshM1702]

Reason for change: Bind dropbear according to DeviceType RFC for prod images only
Test Procedure: build and test ssh
Risks: Low
Priority: P1
Signed-off by : nareshkumar_m@comcast.com

[Copilot]

Pull request overview

This PR updates the dropbear (sshd) startup logic to apply the DeviceType RFC check only for prod images, while defaulting to development authorization keys for non-prod builds.

Changes:

• Moves DeviceType-based authorized_keys_dev selection into do_start().
• Gates DeviceType RFC evaluation behind BUILD_TYPE=prod and defaults non-prod builds to dev keys.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (1)

source/scripts/init/service.d/service_sshd.sh:156

• The BUILD_TYPE, DEVICETYPE, and USE_DYNAMICKEYING variables are unquoted in [ tests. If any are empty/unset, the test can error (e.g., "unary operator expected") and prevent sshd/dropbear from starting. Also, dmcli is executed even for non-prod builds where DEVICETYPE is ignored; moving the dmcli call inside the prod branch matches the intent (check DeviceType RFC for prod images only) and avoids the extra runtime dependency.

    DEVICETYPE=$(dmcli eRT getv Device.DeviceInfo.X_RDKCENTRAL-COM_RFC.Identity.DeviceType | grep value | cut -d ":" -f 3 | tr -d ' ' | tr -s ' ' | tr '[:lower:]' '[:upper:]')
    if [ $BUILD_TYPE = "prod" ]; then
        if [ $DEVICETYPE = "TEST" ] && [ $USE_DYNAMICKEYING = "TRUE" ]; then
            USE_DEVKEYS="-f authorized_keys_dev"
            echo_t "[utopia]: dropbear using dev authorization keys"

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (1)

source/scripts/init/service.d/service_sshd.sh:156

• dmcli is invoked on every do_start, even though the DeviceType RFC value is only used to decide key selection for prod images. This contradicts the PR intent (“prod images only”) and adds an unnecessary runtime dependency/cost (and potential hang/failure) on non-prod builds. Gate the RFC query under the BUILD_TYPE=prod branch.

    USE_DEVKEYS="-f authorized_keys_dev"
    DEVICETYPE=$(dmcli eRT getv Device.DeviceInfo.X_RDKCENTRAL-COM_RFC.Identity.DeviceType | grep value | cut -d ":" -f 3 | tr -d ' ' | tr -s ' ' | tr '[:lower:]' '[:upper:]')
    if [ "$BUILD_TYPE" = "prod" -a "$DEVICETYPE" = "PROD" ]; then
	    USE_DEVKEYS=""
    fi

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (1)

source/scripts/init/service.d/service_sshd.sh:156

• DeviceType RFC is queried unconditionally and the result is only used to clear USE_DEVKEYS for prod builds; this contradicts the PR intent (“prod images alone”) and adds an unnecessary dmcli dependency/latency on non-prod images. Also, on prod builds the current logic defaults to dev keys unless DeviceType resolves exactly to PROD (fail-open if the RFC read fails/returns unexpected), which is security-sensitive.

Consider only querying RFC on prod builds and defaulting to prod keys on prod builds, enabling dev keys only for an explicit TEST value (and avoid test -a by using nested if/&&).

    USE_DEVKEYS="-f authorized_keys_dev"
    DEVICETYPE=$(dmcli eRT getv Device.DeviceInfo.X_RDKCENTRAL-COM_RFC.Identity.DeviceType | grep value | cut -d ":" -f 3 | tr -d ' ' | tr -s ' ' | tr '[:lower:]' '[:upper:]')
    if [ "$BUILD_TYPE" = "prod" -a "$DEVICETYPE" = "PROD" ]; then
	    USE_DEVKEYS=""
    fi

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (1)

source/scripts/init/service.d/service_sshd.sh:157

• USE_DEVKEYS currently defaults to the dev authorized_keys file and is only cleared when both BUILD_TYPE=prod and the RFC returns PROD. On a prod image, if the dmcli read fails or returns an unexpected/empty value, this becomes a security-sensitive fail-open to dev keys. Also, per the PR description (“prod images alone”), the RFC read should be done only for prod builds.

    USE_DEVKEYS="-f authorized_keys_dev"
    DEVICETYPE=$(dmcli eRT getv Device.DeviceInfo.X_RDKCENTRAL-COM_RFC.Identity.DeviceType | grep value | cut -d ":" -f 3 | tr -d ' ' | tr -s ' ' | tr '[:lower:]' '[:upper:]')
    if [ "$BUILD_TYPE" = "prod" -a "$DEVICETYPE" = "PROD" ]; then
	    USE_DEVKEYS=""
    fi

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

Suppressed comments (1)

source/scripts/init/service.d/service_sshd.sh:157

• dmcli ... DeviceType is executed unconditionally and USE_DEVKEYS defaults to dev keys. On a prod build, if the RFC read fails/returns empty, this falls back to dev keys (fail-open) and also contradicts the PR intent of checking DeviceType only for prod images. Consider reading the RFC only when BUILD_TYPE=prod and defaulting to prod keys when the RFC value is missing.

    USE_DEVKEYS="-f authorized_keys_dev"
    DEVICETYPE=$(dmcli eRT getv Device.DeviceInfo.X_RDKCENTRAL-COM_RFC.Identity.DeviceType | grep value | cut -d ":" -f 3 | tr -d ' ' | tr -s ' ' | tr '[:lower:]' '[:upper:]')
    if [ "$BUILD_TYPE" = "prod" -a "$DEVICETYPE" = "PROD" ]; then
	    USE_DEVKEYS=""
    fi