Hi all,
During the 2.2.0-rc1 IPMC vote [1], Justin Mclean listed this under "should
fix":
No crypto export notice despite contrib/pgcrypto, and Cloudberry is
absent from apache.org/licenses/exports/.
Both points check out. I have worked through the procedure and would like to
start on it. Below is the background. I can take most of them.
## Why this applies to us
This is a US legal obligation, not an ASF house rule. The ASF is a US entity
and has to comply with the Export Administration Regulations (EAR),
administered by the Bureau of Industry and Security (BIS). Software that
performs cryptographic functions is a controlled item even when it is open
source.
Open source projects do not need an export licence. We qualify under the
"publicly available" route in EAR section 742.15(b), and the whole obligation
is to notify BIS and the NSA of where the source lives, before the code is
published. The ASF documents the procedure at [2].
Cloudberry is in scope because we ship:
- contrib/pgcrypto, which exposes cryptographic functions to SQL
- TLS for client and server connections, and SCRAM-SHA-256 authentication,
both through OpenSSL
- optional GSSAPI (Kerberos) authentication and connection encryption, and
LDAP over TLS
The classification is ECCN 5D002, "information security software using or
performing cryptographic functions with asymmetric algorithms".
One detail that matters later: we link against the OpenSSL provided by the
operating system and do not ship OpenSSL ourselves, so the notification names
the ASF alone as manufacturer rather than also naming the OpenSSL Project.
## Where we stand
I checked the YAML matrix behind https://www.apache.org/licenses/exports/ and
Cloudberry is not in it. As far as I can tell no notification has been sent
either.
The procedure expects the notification before the code is published, so this
is a backlog item rather than something 2.2.0 introduced: it has been
outstanding since 2.0.0. I would rather close it now than carry it into
another release.
It is also a one-time action. A notification covers a product without a
version number, so we do not repeat it per release unless the submitted
information stops being accurate.
## Steps
We can follow the process described here: https://infra.apache.org/crypto.html.
If anyone sees a problem with this plan, love to have your feedback.
[1] https://lists.apache.org/thread/yyz57l860ktsx7txqyqrdkomz40pobcw
[2] https://infra.apache.org/crypto.html
Best,
Dianjin Wang
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
