[eu-cra-compliance:scope-classifier] github/gh-aw-firewall CRA scope evidence

Đã đóng
  • Có gì không ổn?
#19,631 0 bình luận 0 reaction 0 người được giao Xem trên GitHub

Maintainer thường phản hồi trong vòng 1 ngày

Chưa có ai nhận issue này.

Đánh giá

Độ khó
5/5
Thời gian dự kiến
Hơn một tuần
Mức phù hợp với người mới
18/100
Loại issue
Tài liệu
Độ rõ ràng
Khá rõ ràng
Mức độ hoạt động
Sôi nổi
Công nghệ
github-actions, javascript
Lĩnh vực
security

Hướng nghiên cứu

Start with the issue’s evidence table and prioritized requests, then read the cited repository files: README.md, docs/architecture.md, docs/releasing.md, action.yml, and install.sh. Product counsel and the responsible maintainer must supply the missing legal, distribution, classification, and support evidence and review every decision row. Done means the record is complete and a non-bot reviewer adds a thumbs-up reaction.

Do mô hình lập chỉ mục viết ra từ nội dung của issue.

Mô tả

eu-cra-compliance eu-cra-compliance:scope-classifier

Overall status: INCOMPLETE. The snapshot clearly represents publicly distributed firewall software: a CLI, GitHub Action, standalone binaries, JavaScript bundle, schemas, and runtime containers. That evidence makes CRA scope and an important Class II firewall pathway plausible, but it does not decide them. Current primary legal text and Commission pages were inaccessible during this run, and the repository does not establish EU-market activity, GitHubs economic-operator role, commercial-activity treatment, support period, or the applicable classification/conformity route.

Action: GitHub product counsel and the responsible github/gh-aw-firewall maintainer should supply the prioritized evidence below and decide scope, role, FOSS treatment, classification, and support period; acceptance is a complete review of every decision row followed by the non-bot reviewers thumbs-up reaction.

Critical findings
  • Public releases and installation channels are active; latest observed release was v0.28.74 (2026-10-21), with binaries, bundle, tarball, schemas, attestations, and container manifest.
  • The project calls itself a network firewall and ships Squid/API-proxy/runtime containers. Annex III Class II is therefore a candidate pathway requiring human review, not a classification.
  • MIT licensing and public contributions support FOSS status, but do not by themselves prove development or supply outside commercial activity.
  • No support-period statement, EU distribution evidence, manufacturer/importer/distributor record, declaration, classification rationale, or published-OJ harmonised-standard mapping was found.
<b>Snapshot and product/distribution evidence</b>

Assessed github/gh-aw-firewall at de3c6b984bc832810992f68df7e872b1f0d04637; repository evidence verified 2026-10-23. Snapshot URL: https://github.com/github/gh-aw-firewall/tree/de3c6b984bc832810992f68df7e872b1f0d04637.

Topic Observed evidence Missing/limitation
Product / intended purpose README.md, docs/architecture.md: awf restricts agent-workflow HTTP(S) egress through containerised Squid and API-proxy components; supports local and GitHub Actions use. Intended-purpose statement for regulatory records not found.
Distribution docs/releasing.md, action.yml, install.sh: GitHub Releases, setup Action, Linux/macOS binaries, JS bundle, npm tarball, schemas, and GHCR images. GitHub metadata showed downloads. Sales, contracts, consideration, EU availability/use, and importer/distributor channels not verified.
Dependencies / support relationship Runtime depends on Docker and may connect to configured LLM/GitHub services; compatibility covers supported OS, Node, Docker, and runners. Whether any remote data processing is an in-scope product solution, and who provides it, is unresolved.
Support / modifications Compatibility and vulnerability-reporting instructions exist; retired versions are flagged. Declared support period, end-of-support notices, lifecycle owner, and substantial-modification process not found.
Entity signals package.json author is GitHub; copyright is GitHub Next. Legal manufacturer, authorised representative, importer, distributor, or steward designation not established.

Whats working: release documentation records provenance checks, checksums, attestations, immutable tag identity, SBOM-bearing enclave assets, and explicit compatibility evidence.

<b>Regulatory baseline and provenance</b>
Requirement/topic Instrument/provision Official URL Verification 2026-10-23
Scope; product/software and remote-processing concepts Regulation (EU) 2024/2847, Arts. 2-3 https://eur-lex.europa.eu/eli/reg/2024/2847/oj INCOMPLETE: entry point returned HTTP 403 and alternate official representations returned no content. Interpretation below is provisional.
Manufacturer/steward/operator duties and modification Regulation (EU) 2024/2847, Arts. 13, 18-24 same EUR-Lex URL INCOMPLETE: primary text unavailable.
Important/critical pathways and conformity assessment Regulation (EU) 2024/2847, Arts. 7-8, 32; Annexes III-IV; Implementing Regulation (EU) 2025/2392 https://eur-lex.europa.eu/eli/reg_impl/2025/2392/oj/eng NOT_ASSESSED: current technical descriptions were not retrieved.
Application dates Regulation (EU) 2024/2847, Art. 71 regulation URL above INCOMPLETE: prompts of 2024-12-10, 2026-06-11, 2026-09-11, and 2027-12-11 were not current-source verified.
Commission implementation guidance dated 2026-07-27 Non-binding Commission guidance https://digital-strategy.ec.europa.eu/en/policies/cyber-resilience-act INCOMPLETE: page returned HTTP 403; issue date/content not verified.
Harmonised standards / presumption Regulation (EU) 2024/2847, Art. 27 regulation URL above NOT_ASSESSED: no current Official Journal inventory was accessible. No standard or presumption is claimed.
Certification schemes Regulation (EU) 2024/2847, Art. 27(8)-(9); ENISA entry point https://www.enisa.europa.eu/ ENISA entry point accessible, but no product-specific scheme consequence was verified.

Guidance is non-binding. No delegated-act exclusion, reporting threshold, active exploitation, or incident-reportability determination was made.

<b>Decision records requiring human review</b>
Decision Evidence for Evidence against / gap Status / reviewer
Product with digital elements in CRA scope Installable software/components, network connectivity, public release channels. Topic: Arts. 2-3, regulation URL above. EU market placement and exclusions not established. HUMAN_REVIEW_REQUIRED — product counsel.
Non-commercial FOSS treatment MIT license, source public, community contributions. Topic: Art. 3 definitions and Arts. 24-26, regulation URL above. GitHub authorship, organised releases, product-support relationship, and possible commercial context; no commercial-activity record. HUMAN_REVIEW_REQUIRED — product counsel/business owner.
Economic-operator role GitHub controls repository and release workflow. Topic: Arts. 13, 18-24, regulation URL above. No legal-entity or supply-chain role record. HUMAN_REVIEW_REQUIRED — product counsel.
Default vs important Class II Product identifies as a firewall. Topic: Arts. 7, 32 and Annex III; implementing-act URL above. Technical category description and product boundary not verified. HUMAN_REVIEW_REQUIRED — security product owner + counsel.
Important Class I / critical product No affirmative repository evidence observed. Topic: Arts. 7-8; Annexes III-IV. Absence of repository evidence is not exclusion; implementing text unavailable. NOT_ASSESSED — same reviewers.
Conformity route / market-release eligibility none known. Topic: Art. 32. Depends on resolved scope, role, class, standards/scheme evidence. NOT_ASSESSED — conformity owner + counsel.
Substantial modification Active releases and many runtime components. Topic: Arts. 20-21. No modification-role analysis. HUMAN_REVIEW_REQUIRED — maintainer + counsel.
<b>Prioritized evidence requests</b>
  1. P0: Legal entity and accountable product counsel; EU offering/use; consideration, contracts, monetisation, and product-support relationship.
  2. P0: Signed scope/role/FOSS-commercial-activity and Annex III technical-description decision, including product boundary and remote-processing components.
  3. P0: Declared support period and lifecycle/version retirement policy.
  4. P1: Current Official Journal check for CRA harmonised-standard references; record exact citation and scope or none verified.
  5. P1: Applicable delegated/implementing acts and certification-scheme consequences; do not infer them from technical relevance.
  6. P1: Substantial-modification and downstream integrator/operator mapping.
Human Acceptance

A non-bot reviewer should add a thumbs-up reaction only after reviewing the complete scope, role, FOSS-treatment, distribution, classification, provenance, gap, and human-decision record. The reaction records review, not a legal or release approval.

cao: githubnext/gh-cao, correlation: 39900760283-891

Generated by 🔍 EU CRA / Scope · pi · gpt56 · ~56 AIC · ⌖ ~22 AIC · ⊞ 13.5K · ◷

  • expires on Nov 22, 2026, 4:43 AM UTC
Ngôn ngữ chính
JavaScript
Star
14
Fork
5
Merge trung bình
4 giờ 16 phút
Pull request đã merge (30 ngày)
688

Chuẩn bị môi trường

Bắt đầu từ đâu

  1. Đọc hết issue, rồi đọc hướng dẫn đóng góp của dự án.
  2. Bình luận trên issue rằng bạn sẽ nhận — tránh hai người làm cùng một việc.
  3. Fork repository và làm thay đổi trên một nhánh.
  4. Mở pull request có tham chiếu số hiệu của issue.

Issue khác của githubnext/gh-cao

Tất cả issue của githubnext/gh-cao

Issue tương tự

Thêm issue về JavaScript

Nhận issue mới trong hộp thư của bạn

Bản tóm tắt ngắn những issue GitHub phù hợp với người mới.