This is an automated email from the ASF dual-hosted git repository.
tuhaihe pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/cloudberry.git
The following commit(s) were added to refs/heads/main by this push:
new 2b46a45fe06 Add export control notice for bundled cryptography (#2004)
2b46a45fe06 is described below
commit 2b46a45fe06456314fed15178306a8100f028db7
Author: Dianjin Wang <[email protected]>
AuthorDate: Fri Sep 18 13:47:39 2026 +0800
Add export control notice for bundled cryptography (#2004)
Justin Mclean noted during the 2.2.0-rc1 IPMC vote that the release has no
crypto export notice despite shipping contrib/pgcrypto, and that Cloudberry
does not appear on https://www.apache.org/licenses/exports/.
infra.apache.org/crypto.html requires the notice in the README of each
distribution, so add it there, listing the components of the release that
involve cryptography: OpenSSL for TLS and SCRAM-SHA-256, optional GSSAPI
and LDAP over TLS, and the bundled pgcrypto extension. The build links
against the operating system's OpenSSL and does not ship it, which the
notice states because it determines who is named as manufacturer in the
BIS notification.
This commit only covers the README. Two steps remain, and neither lives
in the source tree:
- adding Cloudberry to https://www.apache.org/licenses/exports/, which
is a pull request against apache/www-site, file
data/eccn/eccnmatrix.yaml. Podlings do not get their own top-level
entry there; sixteen of them sit as products under a single
- href: https://incubator.apache.org/
name: Apache Incubator Project
contact: Apache Incubator PMC <[email protected]>
umbrella, so Cloudberry belongs under that one, with the contact
inherited from the Incubator PMC rather than one of our own lists.
- sending the ECCN 5D002 notification to [email protected],
[email protected] and [email protected]. This is a named legal
notification submitted on behalf of the ASF. The procedure describes
it as coming from the PMC chair, and for a project in incubation the
PMC is the Incubator PMC; infra.apache.org/crypto.html says nothing
about podlings, so who sends it is a question for our mentors. The
site build generates the text of this email from the matrix entry, so
it does not have to be written by hand.
Per the same page those are supposed to happen before the code is posted
publicly, so they are overdue rather than new; the notification names the
product without a version and does not need repeating per release.
Assisted-by: Claude Code
Backpatch-through: REL_2_STABLE
---
README.md | 35 +++++++++++++++++++++++++++++++++++
1 file changed, 35 insertions(+)
diff --git a/README.md b/README.md
index e332b06b309..938367b8669 100644
--- a/README.md
+++ b/README.md
@@ -132,6 +132,41 @@ Apache Cloudberry has a sound foundation.
Cloudberry is licensed under the Apache License, Version 2.0. For details, see
the [LICENSE](./LICENSE).
+## Crypto Export Notice
+
+This distribution includes cryptographic software. The country in
+which you currently reside may have restrictions on the import,
+possession, use, and/or re-export to another country, of
+encryption software. BEFORE using any encryption software, please
+check your country's laws, regulations and policies concerning the
+import, possession, or use, and re-export of encryption software, to
+see if this is permitted. See http://www.wassenaar.org for
+more information.
+
+The Apache Software Foundation has classified this software as Export
Commodity
+Control Number (ECCN) 5D002, which includes information security
+software using or performing cryptographic functions with asymmetric
+algorithms. The form and manner of this Apache Software Foundation
+distribution makes it eligible for export under the "publicly available"
+Section 742.15(b) exemption (see the BIS Export Administration Regulations,
+Section 742.15(b)) for both object code and source code.
+
+The following provides more details on the included cryptographic
+software:
+
+- Apache Cloudberry uses OpenSSL for TLS support on client and server
+ connections, and for the SCRAM-SHA-256 authentication method.
+- Apache Cloudberry optionally uses GSSAPI (Kerberos) for authentication and
+ connection encryption, and LDAP over TLS for authentication.
+- The bundled `pgcrypto` extension provides cryptographic functions to SQL,
+ using either OpenSSL or its own built-in implementations.
+- The `gpfdist` external table file server can serve over HTTPS, using OpenSSL
+ and X.509 certificates supplied through its `--ssl <certificates_directory>`
+ option.
+
+Apache Cloudberry does not ship OpenSSL itself; it links against the OpenSSL
+provided by the operating system.
+
## ASF Incubator disclaimer
Apache Cloudberry is an effort undergoing incubation at The Apache Software
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
