[eu-cra-compliance:scope-classifier] github/gh-aw-firewall CRA scope evidence

Chiusa
  • Qualcosa non va?
#19,631 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
5/5
Tempo stimato
Più di una settimana
Idoneità per principianti
18/100
Tipo di issue
Documentazione
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Stack tecnologico
github-actions, javascript
Ambito
security

Direzione di ricerca

Start with the issue’s evidence table and prioritized requests, then read the cited repository files: README.md, docs/architecture.md, docs/releasing.md, action.yml, and install.sh. Product counsel and the responsible maintainer must supply the missing legal, distribution, classification, and support evidence and review every decision row. Done means the record is complete and a non-bot reviewer adds a thumbs-up reaction.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

eu-cra-compliance eu-cra-compliance:scope-classifier

Overall status: INCOMPLETE. The snapshot clearly represents publicly distributed firewall software: a CLI, GitHub Action, standalone binaries, JavaScript bundle, schemas, and runtime containers. That evidence makes CRA scope and an important Class II firewall pathway plausible, but it does not decide them. Current primary legal text and Commission pages were inaccessible during this run, and the repository does not establish EU-market activity, GitHubs economic-operator role, commercial-activity treatment, support period, or the applicable classification/conformity route.

Action: GitHub product counsel and the responsible github/gh-aw-firewall maintainer should supply the prioritized evidence below and decide scope, role, FOSS treatment, classification, and support period; acceptance is a complete review of every decision row followed by the non-bot reviewers thumbs-up reaction.

Critical findings
  • Public releases and installation channels are active; latest observed release was v0.28.74 (2026-10-21), with binaries, bundle, tarball, schemas, attestations, and container manifest.
  • The project calls itself a network firewall and ships Squid/API-proxy/runtime containers. Annex III Class II is therefore a candidate pathway requiring human review, not a classification.
  • MIT licensing and public contributions support FOSS status, but do not by themselves prove development or supply outside commercial activity.
  • No support-period statement, EU distribution evidence, manufacturer/importer/distributor record, declaration, classification rationale, or published-OJ harmonised-standard mapping was found.
<b>Snapshot and product/distribution evidence</b>

Assessed github/gh-aw-firewall at de3c6b984bc832810992f68df7e872b1f0d04637; repository evidence verified 2026-10-23. Snapshot URL: https://github.com/github/gh-aw-firewall/tree/de3c6b984bc832810992f68df7e872b1f0d04637.

Topic Observed evidence Missing/limitation
Product / intended purpose README.md, docs/architecture.md: awf restricts agent-workflow HTTP(S) egress through containerised Squid and API-proxy components; supports local and GitHub Actions use. Intended-purpose statement for regulatory records not found.
Distribution docs/releasing.md, action.yml, install.sh: GitHub Releases, setup Action, Linux/macOS binaries, JS bundle, npm tarball, schemas, and GHCR images. GitHub metadata showed downloads. Sales, contracts, consideration, EU availability/use, and importer/distributor channels not verified.
Dependencies / support relationship Runtime depends on Docker and may connect to configured LLM/GitHub services; compatibility covers supported OS, Node, Docker, and runners. Whether any remote data processing is an in-scope product solution, and who provides it, is unresolved.
Support / modifications Compatibility and vulnerability-reporting instructions exist; retired versions are flagged. Declared support period, end-of-support notices, lifecycle owner, and substantial-modification process not found.
Entity signals package.json author is GitHub; copyright is GitHub Next. Legal manufacturer, authorised representative, importer, distributor, or steward designation not established.

Whats working: release documentation records provenance checks, checksums, attestations, immutable tag identity, SBOM-bearing enclave assets, and explicit compatibility evidence.

<b>Regulatory baseline and provenance</b>
Requirement/topic Instrument/provision Official URL Verification 2026-10-23
Scope; product/software and remote-processing concepts Regulation (EU) 2024/2847, Arts. 2-3 https://eur-lex.europa.eu/eli/reg/2024/2847/oj INCOMPLETE: entry point returned HTTP 403 and alternate official representations returned no content. Interpretation below is provisional.
Manufacturer/steward/operator duties and modification Regulation (EU) 2024/2847, Arts. 13, 18-24 same EUR-Lex URL INCOMPLETE: primary text unavailable.
Important/critical pathways and conformity assessment Regulation (EU) 2024/2847, Arts. 7-8, 32; Annexes III-IV; Implementing Regulation (EU) 2025/2392 https://eur-lex.europa.eu/eli/reg_impl/2025/2392/oj/eng NOT_ASSESSED: current technical descriptions were not retrieved.
Application dates Regulation (EU) 2024/2847, Art. 71 regulation URL above INCOMPLETE: prompts of 2024-12-10, 2026-06-11, 2026-09-11, and 2027-12-11 were not current-source verified.
Commission implementation guidance dated 2026-07-27 Non-binding Commission guidance https://digital-strategy.ec.europa.eu/en/policies/cyber-resilience-act INCOMPLETE: page returned HTTP 403; issue date/content not verified.
Harmonised standards / presumption Regulation (EU) 2024/2847, Art. 27 regulation URL above NOT_ASSESSED: no current Official Journal inventory was accessible. No standard or presumption is claimed.
Certification schemes Regulation (EU) 2024/2847, Art. 27(8)-(9); ENISA entry point https://www.enisa.europa.eu/ ENISA entry point accessible, but no product-specific scheme consequence was verified.

Guidance is non-binding. No delegated-act exclusion, reporting threshold, active exploitation, or incident-reportability determination was made.

<b>Decision records requiring human review</b>
Decision Evidence for Evidence against / gap Status / reviewer
Product with digital elements in CRA scope Installable software/components, network connectivity, public release channels. Topic: Arts. 2-3, regulation URL above. EU market placement and exclusions not established. HUMAN_REVIEW_REQUIRED — product counsel.
Non-commercial FOSS treatment MIT license, source public, community contributions. Topic: Art. 3 definitions and Arts. 24-26, regulation URL above. GitHub authorship, organised releases, product-support relationship, and possible commercial context; no commercial-activity record. HUMAN_REVIEW_REQUIRED — product counsel/business owner.
Economic-operator role GitHub controls repository and release workflow. Topic: Arts. 13, 18-24, regulation URL above. No legal-entity or supply-chain role record. HUMAN_REVIEW_REQUIRED — product counsel.
Default vs important Class II Product identifies as a firewall. Topic: Arts. 7, 32 and Annex III; implementing-act URL above. Technical category description and product boundary not verified. HUMAN_REVIEW_REQUIRED — security product owner + counsel.
Important Class I / critical product No affirmative repository evidence observed. Topic: Arts. 7-8; Annexes III-IV. Absence of repository evidence is not exclusion; implementing text unavailable. NOT_ASSESSED — same reviewers.
Conformity route / market-release eligibility none known. Topic: Art. 32. Depends on resolved scope, role, class, standards/scheme evidence. NOT_ASSESSED — conformity owner + counsel.
Substantial modification Active releases and many runtime components. Topic: Arts. 20-21. No modification-role analysis. HUMAN_REVIEW_REQUIRED — maintainer + counsel.
<b>Prioritized evidence requests</b>
  1. P0: Legal entity and accountable product counsel; EU offering/use; consideration, contracts, monetisation, and product-support relationship.
  2. P0: Signed scope/role/FOSS-commercial-activity and Annex III technical-description decision, including product boundary and remote-processing components.
  3. P0: Declared support period and lifecycle/version retirement policy.
  4. P1: Current Official Journal check for CRA harmonised-standard references; record exact citation and scope or none verified.
  5. P1: Applicable delegated/implementing acts and certification-scheme consequences; do not infer them from technical relevance.
  6. P1: Substantial-modification and downstream integrator/operator mapping.
Human Acceptance

A non-bot reviewer should add a thumbs-up reaction only after reviewing the complete scope, role, FOSS-treatment, distribution, classification, provenance, gap, and human-decision record. The reaction records review, not a legal or release approval.

cao: githubnext/gh-cao, correlation: 39900760283-891

Generated by 🔍 EU CRA / Scope · pi · gpt56 · ~56 AIC · ⌖ ~22 AIC · ⊞ 13.5K · ◷

  • expires on Nov 22, 2026, 4:43 AM UTC
Lingua principale
JavaScript
Stelle
14
Fork
5
Merge medio
4h 16m
PR unite (30g)
688

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di githubnext/gh-cao

Tutte le issue di githubnext/gh-cao

Issue simili

Altre issue su JavaScript

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.