Conversation
There was a problem hiding this comment.
Pull request overview
This pull request removes the ENABLE_MTLS compile-time flag from the telemetry build configuration. MTLS (Mutual TLS) provides bidirectional authentication between client and server, and was previously enabled in PR #276 (RDKE-900) in version 1.13.0. The removal of this flag disables mutual TLS support in the telemetry component.
Changes:
- Removed
-DENABLE_MTLSfrom CFLAGS in telemetry build recipe
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| inherit pkgconfig autotools systemd ${@bb.utils.contains("DISTRO_FEATURES", "kirkstone", "python3native", "pythonnative", d)} breakpad-logmapper | ||
|
|
||
| CFLAGS += " -DDROP_ROOT_PRIV -DENABLE_MTLS " | ||
| CFLAGS += " -DDROP_ROOT_PRIV " |
There was a problem hiding this comment.
The PR title "Update telemetry_git.bb" and the absence of a detailed description provide insufficient context for this security-significant change. The PR should clearly state the reason for removing MTLS support, any associated ticket references, and potential impacts on telemetry endpoint security.
| inherit pkgconfig autotools systemd ${@bb.utils.contains("DISTRO_FEATURES", "kirkstone", "python3native", "pythonnative", d)} breakpad-logmapper | ||
|
|
||
| CFLAGS += " -DDROP_ROOT_PRIV -DENABLE_MTLS " | ||
| CFLAGS += " -DDROP_ROOT_PRIV " |
There was a problem hiding this comment.
Removing MTLS support may have operational implications for existing deployments. Ensure that any telemetry endpoints currently configured to use mutual TLS authentication are either updated or have an alternative authentication mechanism in place. This change could break connectivity to endpoints requiring client certificate authentication.
| inherit pkgconfig autotools systemd ${@bb.utils.contains("DISTRO_FEATURES", "kirkstone", "python3native", "pythonnative", d)} breakpad-logmapper | ||
|
|
||
| CFLAGS += " -DDROP_ROOT_PRIV -DENABLE_MTLS " | ||
| CFLAGS += " -DDROP_ROOT_PRIV " |
There was a problem hiding this comment.
Removing the ENABLE_MTLS flag disables mutual TLS authentication, which was previously enabled by PR #276 (RDKE-900: Default to MTLS connection on all endpoints) in version 1.13.0. This is a security-relevant change that requires clear justification. The PR title and description should explain why MTLS is being disabled and document any security implications or alternative security measures being implemented.
| CFLAGS += " -DDROP_ROOT_PRIV " | |
| CFLAGS += " -DDROP_ROOT_PRIV -DENABLE_MTLS " |
No description provided.