This is an automated email from the ASF dual-hosted git repository. leborchuk pushed a commit to branch REL_2_STABLE in repository https://gitbox.apache.org/repos/asf/cloudberry.git
commit 2edf63eec038e29a11a73e5d15b676c19f7e6ce1 Author: Dianjin Wang <[email protected]> AuthorDate: Fri Sep 18 13:47:39 2026 +0800 Add export control notice for bundled cryptography (#2004) Justin Mclean noted during the 2.2.0-rc1 IPMC vote that the release has no crypto export notice despite shipping contrib/pgcrypto, and that Cloudberry does not appear on https://www.apache.org/licenses/exports/. infra.apache.org/crypto.html requires the notice in the README of each distribution, so add it there, listing the components of the release that involve cryptography: OpenSSL for TLS and SCRAM-SHA-256, optional GSSAPI and LDAP over TLS, and the bundled pgcrypto extension. The build links against the operating system's OpenSSL and does not ship it, which the notice states because it determines who is named as manufacturer in the BIS notification. This commit only covers the README. Two steps remain, and neither lives in the source tree: - adding Cloudberry to https://www.apache.org/licenses/exports/, which is a pull request against apache/www-site, file data/eccn/eccnmatrix.yaml. Podlings do not get their own top-level entry there; sixteen of them sit as products under a single - href: https://incubator.apache.org/ name: Apache Incubator Project contact: Apache Incubator PMC <[email protected]> umbrella, so Cloudberry belongs under that one, with the contact inherited from the Incubator PMC rather than one of our own lists. - sending the ECCN 5D002 notification to [email protected], [email protected] and [email protected]. This is a named legal notification submitted on behalf of the ASF. The procedure describes it as coming from the PMC chair, and for a project in incubation the PMC is the Incubator PMC; infra.apache.org/crypto.html says nothing about podlings, so who sends it is a question for our mentors. The site build generates the text of this email from the matrix entry, so it does not have to be written by hand. Per the same page those are supposed to happen before the code is posted publicly, so they are overdue rather than new; the notification names the product without a version and does not need repeating per release. Assisted-by: Claude Code Backpatch-through: REL_2_STABLE --- README.md | 35 +++++++++++++++++++++++++++++++++++ 1 file changed, 35 insertions(+) diff --git a/README.md b/README.md index e332b06b309..938367b8669 100644 --- a/README.md +++ b/README.md @@ -132,6 +132,41 @@ Apache Cloudberry has a sound foundation. Cloudberry is licensed under the Apache License, Version 2.0. For details, see the [LICENSE](./LICENSE). +## Crypto Export Notice + +This distribution includes cryptographic software. The country in +which you currently reside may have restrictions on the import, +possession, use, and/or re-export to another country, of +encryption software. BEFORE using any encryption software, please +check your country's laws, regulations and policies concerning the +import, possession, or use, and re-export of encryption software, to +see if this is permitted. See http://www.wassenaar.org for +more information. + +The Apache Software Foundation has classified this software as Export Commodity +Control Number (ECCN) 5D002, which includes information security +software using or performing cryptographic functions with asymmetric +algorithms. The form and manner of this Apache Software Foundation +distribution makes it eligible for export under the "publicly available" +Section 742.15(b) exemption (see the BIS Export Administration Regulations, +Section 742.15(b)) for both object code and source code. + +The following provides more details on the included cryptographic +software: + +- Apache Cloudberry uses OpenSSL for TLS support on client and server + connections, and for the SCRAM-SHA-256 authentication method. +- Apache Cloudberry optionally uses GSSAPI (Kerberos) for authentication and + connection encryption, and LDAP over TLS for authentication. +- The bundled `pgcrypto` extension provides cryptographic functions to SQL, + using either OpenSSL or its own built-in implementations. +- The `gpfdist` external table file server can serve over HTTPS, using OpenSSL + and X.509 certificates supplied through its `--ssl <certificates_directory>` + option. + +Apache Cloudberry does not ship OpenSSL itself; it links against the OpenSSL +provided by the operating system. + ## ASF Incubator disclaimer Apache Cloudberry is an effort undergoing incubation at The Apache Software --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
