RDK-61784: Bind authorized_keys based on DeviceType RFC in prod builds alone

[NareshM1702]

No description provided.

[Copilot]

Pull request overview

This PR updates start_ssh.sh to select which authorized_keys file Dropbear uses based on the DeviceType RFC, but only for production builds (per the PR title).

Changes:

• Adds a build-type guard intended to apply the RFC-based DeviceType check only in non-dev vs dev builds.
• Adds a “prod vs dev keys” selection branch based on the RFC DeviceType value.
• Sets USE_DEVKEYS via systemctl set-environment for downstream Dropbear startup behavior.

Comments suppressed due to low confidence (2)

lib/rdk/start_ssh.sh:78

• DEVICETYPE is currently assigned with 2>&1 > /dev/null, which discards stdout (the value) and captures stderr instead. That makes $DEVICETYPE empty on success, so the TEST comparison never matches.

    DEVICETYPE=$(tr181 -d Device.DeviceInfo.X_RDKCENTRAL-COM_RFC.Identity.DeviceType 2>&1 > /dev/null)

lib/rdk/start_ssh.sh:89

• In the non-prod branch, the log says "use dev authorization keys by default" but USE_DEVKEYS is set to empty (prod keys). This likely inverts the intended behavior for dev/non-prod builds.

else
    USE_DEVKEYS=""
    echo " Build type is dev , use dev authorization keys by default"
fi

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[vbaska]

Consider re-writing it like this.

DEVICETYPE=$(tr181 -d Device.DeviceInfo.X_RDKCENTRAL-COM_RFC.Identity.DeviceType 2>&1 > /dev/null)
USE_DEVKEYS=""

if [ "$DEVICETYPE" = "TEST" -a "$BUILD_TYPE" != "dev"]; then
USE_DEVKEYS="-f authorized_keys_dev"
echo " dropbear using dev authorization keys"
fi

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

Comments suppressed due to low confidence (1)

lib/rdk/start_ssh.sh:81

• The BUILD_TYPE check is comparing the literal string "BUILD_TYPE" (so this branch will always run), and the dev-build branch sets USE_DEVKEYS to empty while the log says it will use dev keys. Also, the PR title says this DeviceType-based selection should apply to prod builds only, but the current condition applies to all non-dev build types.

if [ "BUILD_TYPE" != "dev" ]; then
    DEVICETYPE=$(tr181 -d Device.DeviceInfo.X_RDKCENTRAL-COM_RFC.Identity.DeviceType 2>&1 > /dev/null)
    if [ "$DEVICETYPE" = "TEST" ]; then
        USE_DEVKEYS="-f authorized_keys_dev"
        echo " dropbear using dev authorization keys"

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (4)

lib/rdk/start_ssh.sh:77

• The BUILD_TYPE comparison is using the literal string "BUILD_TYPE" instead of the BUILD_TYPE variable, so this condition will always be true and the dev-build branch will never run.

if [ "BUILD_TYPE" != "dev" ]; then

lib/rdk/start_ssh.sh:78

• This command substitution redirects stdout to /dev/null, so DEVICETYPE won’t contain the DeviceType value (it may capture stderr instead). That makes the TEST/prod selection unreliable.

    DEVICETYPE=$(tr181 -d Device.DeviceInfo.X_RDKCENTRAL-COM_RFC.Identity.DeviceType 2>&1 > /dev/null)

lib/rdk/Start_MaintenanceTasks.sh:105

• The marker file "/tmp/.RFCsynccomplete" is created even when rfcMgr is missing or returns an error (result=-1 or other non-0/1). Given the name, this can incorrectly signal successful RFC sync completion.

    touch /tmp/.RFCsynccomplete
    # Handle both success (0) and acceptable warning (1) exit codes, flag other results as errors
    if [ "$result" -ne 0 ] && [ "$result" -ne 1 ]; then
        eventSender "MaintenanceMGR" "$MAINT_RFC_ERROR"
    fi

lib/rdk/start_ssh.sh:88

• In the dev-build branch the log says dev authorization keys will be used, but USE_DEVKEYS is set to empty (prod keys). This is inconsistent with the intent (and with the prod-only DeviceType check).

else
    USE_DEVKEYS=""
    echo " Build type is dev , use dev authorization keys by default"