There is a discussion over at the incubator general mailing list (e.g. [1]), amongst other places, about the redistribution of BouncyCastle code from ASF machines.
The crux is that we can't redistribute BC's IDEA implementation as it is subject to a known patent for which we don't have a grant/license. We'll have to change our current practice of publishing binaries that include BC unmodified. The resolution seems to be maintaining a local copy of the BC JAR without the offending algorithm. I expect we would have to unsign the JAR too when modified. Do we have any dependencies upon IDEA? I see some references in the JSSE cipher suite code, but likely we don't attempt use it if we don't have it. [1] http://mail-archives.apache.org/mod_mbox/incubator-general/200709.mbox/[EMAIL PROTECTED] Regards, Tim
