fix(web-security): stop installing unlicensed surf at sandbox boot (ADM-447) - #154
Merged
Merged
Conversation
…DM-447) assetnote/surf has no upstream licence, so there is no right to use or redistribute it. Remove its install from the boot script and the reference Dockerfile, and point the two skills that named it at naabu/httpx instead. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Customer-side half of ADM-447. The platform PR (dreadnode-tiger #2590) stopped shipping
surfin the images we build; this stops the capability from fetching it on the customer's sandbox at boot.Why
assetnote/surfhas no upstream licence. Code with no licence grants no right to use or redistribute it, so a customer sandbox that installs and runs it is a problem even though we don't redistribute the binary. The manifest also declareslicense: MITwhile installing an unlicensed tool.Changes (
capabilities/web-security/)scripts/install_tools.sh: drop thesurfinstall, its version pin, and its entry in the missing-tools probe.docker/Dockerfile.runtime: drop thesurfbuild step and its line in the header (local-dev/CI reference image).skills/timing-attack-recon/SKILL.md: the one skill that invokedsurf -lnow probes the internal range withnaabu/httpx, which the capability already installs.capability.yaml: version 1.15.0 → 1.15.1 (required for the sync workflow to pick up the change).Not changed
kiterunner(AGPL-3.0) stays. Here the customer sandbox builds it from upstream source; we don't distribute it, so the notice-and-source obligation that the platform image now carries doesn't apply to this path.Verification
bash -n scripts/install_tools.sh: ok.pre-commit run --files <changed>: pass.grep -w surfacross the capability: only the two "not installed" comments remain.🤖 Generated with Claude Code