From d5c282db6effc2ed2af5bbd0e3671a3eaebdd8d7 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Fri, 16 Jan 2026 07:13:42 +0000
Subject: [PATCH] Fix: Improve firewall configuration based on code review

- Remove redundant subdomain entries (www.gnu.org, ftp.gnu.org) already covered by *.gnu.org wildcard
- Improve error handling in setup-firewall.sh - fail explicitly on JSON parse errors instead of silently continuing
- Better error messages for troubleshooting configuration issues

Co-authored-by: jmiller-moko <230051081+jmiller-moko@users.noreply.github.com>
---
 .github/copilot/firewall-allowlist.json | 2 --
 .github/copilot/setup-firewall.sh       | 5 ++++-
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/.github/copilot/firewall-allowlist.json b/.github/copilot/firewall-allowlist.json
index 13b1cb6..89d2dc3 100644
--- a/.github/copilot/firewall-allowlist.json
+++ b/.github/copilot/firewall-allowlist.json
@@ -5,8 +5,6 @@
   "allowlist": {
     "domains": [
       "*.gnu.org",
-      "www.gnu.org",
-      "ftp.gnu.org",
       "fsf.org",
       "www.fsf.org",
       "spdx.org",
diff --git a/.github/copilot/setup-firewall.sh b/.github/copilot/setup-firewall.sh
index e64e04c..ca381ff 100755
--- a/.github/copilot/setup-firewall.sh
+++ b/.github/copilot/setup-firewall.sh
@@ -19,7 +19,10 @@ if [ ! -f "$ALLOWLIST_FILE" ]; then
 fi
 
 # Read domains from the allowlist configuration
-DOMAINS=$(jq -r '.allowlist.domains[]' "$ALLOWLIST_FILE" 2>/dev/null || echo "")
+if ! DOMAINS=$(jq -r '.allowlist.domains[]' "$ALLOWLIST_FILE" 2>&1); then
+    echo "ERROR: Failed to parse allowlist configuration: $DOMAINS"
+    exit 1
+fi
 
 if [ -z "$DOMAINS" ]; then
     echo "WARNING: No domains found in allowlist configuration"