You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tomcat.apache.org by "William A. Rowe, Jr." <wr...@rowe-clan.net> on 2007/09/26 04:36:50 UTC
Tomcat Export Notification Requirements
Hey folks,
as you provide the bindings to the JSSE, even though you don't
ship the JSSE .jars - we still need Tomcat in compliance with the
federal export notification policies. I know you did some work on
this in the past, but please see
http://www.apache.org/dev/crypto.html
for ASF policies, requirements, guidelines and help on getting things
in sync, and note that presently Tomcat/mod_jk are missing below;
http://www.apache.org/licenses/exports/#matrix
I'm about to start an audit across the foundation, I'd appreciate that
this was already in sync at Tomcat :) Note that ECCN numbers, etc are
very frequently asked questions about tomcat etc in all the wrong
forums, and it would be good to point them at the one correct place.
Many thanks,
Bill
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
Re: Tomcat Export Notification Requirements
Posted by "William A. Rowe, Jr." <wr...@rowe-clan.net>.
Mladen Turk wrote:
> William A. Rowe, Jr. wrote:
>> Mladen Turk wrote:
>>> William A. Rowe, Jr. wrote:
>>>> it's sort of a closed loop problem. Update the info, allow the usual
>>>> one hour after updating from minotaur to sync, and then shoot out the
>>>> notice referencing the list of notices sent :)
>>>>
>>> Can we get an example email that needs to be send and an email
>>> address? The page you referred looks pretty confusing with lots
>>> of links ;)
>>> Think wee need to have both JSSE and OpenSSL referenced.
>>
>> Please review the section "Notify the U.S. Government of the Release"
>> and let me know of any suggested changes, or ask about the confusing
>> paragraph so I can rewrite it.
>
> Argh. I was looking at the wrong location.
> I'll try running the tool.
>
> However, not sure what to do with JSSE and how to reference those.
>
> Is http://java.sun.com/javase/technologies/security/
> enough? They tend to change the uri often ;)
It must be a link from which bis can get to the source code of the open
source crypto provider.
They provide a link on that page; "Archived JAAS, JCE, and JSSE Optional
packages" - however following that link reveals version 1.0.3 of the JSSE
alone, so this doesn't satisfy the requirements since there is no way to
get to the specific sources.
But *wait* - we don't ship the JSSE, we incorporate it but the user must
obtain it themselves. The crypto code *we* ship is strictly at openssl
or in our own svn repositories.
So - incorporate by reference that it leverages JSSE (that link is fine)
but since we don't ship it, we don't point them to that 'source code'.
Only our own. c.f. derby and geronimo.
So follow the geronimo example and the httpd example of openssl notice and
I think that covers Tomcat.
Now in the case of a few others where they've leveraged BouncyCastle (an
IP minefield in it's own right), they have actually shipped those .jar's
as I understand it. So their form of notice was correct.
Bill
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
Re: Tomcat Export Notification Requirements
Posted by Mladen Turk <mt...@apache.org>.
William A. Rowe, Jr. wrote:
> Mladen Turk wrote:
>> William A. Rowe, Jr. wrote:
>>> it's sort of a closed loop problem. Update the info, allow the usual
>>> one hour after updating from minotaur to sync, and then shoot out the
>>> notice referencing the list of notices sent :)
>>>
>> Can we get an example email that needs to be send and an email
>> address? The page you referred looks pretty confusing with lots
>> of links ;)
>> Think wee need to have both JSSE and OpenSSL referenced.
>
> Please review the section "Notify the U.S. Government of the Release"
> and let me know of any suggested changes, or ask about the confusing
> paragraph so I can rewrite it.
Argh. I was looking at the wrong location.
I'll try running the tool.
However, not sure what to do with JSSE and how to reference those.
Is http://java.sun.com/javase/technologies/security/
enough? They tend to change the uri often ;)
Regards,
Mladen
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
Re: Tomcat Export Notification Requirements
Posted by "William A. Rowe, Jr." <wr...@rowe-clan.net>.
Mladen Turk wrote:
> William A. Rowe, Jr. wrote:
>>
>> it's sort of a closed loop problem. Update the info, allow the usual
>> one hour after updating from minotaur to sync, and then shoot out the
>> notice referencing the list of notices sent :)
>>
>
> Can we get an example email that needs to be send and an email
> address? The page you referred looks pretty confusing with lots
> of links ;)
> Think wee need to have both JSSE and OpenSSL referenced.
Please review the section "Notify the U.S. Government of the Release"
and let me know of any suggested changes, or ask about the confusing
paragraph so I can rewrite it.
These sorts of things never get fixed if everyone is walked through it
one by one :-)
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
Re: Tomcat Export Notification Requirements
Posted by Mladen Turk <mt...@apache.org>.
William A. Rowe, Jr. wrote:
>
> it's sort of a closed loop problem. Update the info, allow the usual
> one hour after updating from minotaur to sync, and then shoot out the
> notice referencing the list of notices sent :)
>
Can we get an example email that needs to be send and an email
address? The page you referred looks pretty confusing with lots
of links ;)
Think wee need to have both JSSE and OpenSSL referenced.
Regards,
Mladen
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
Re: Tomcat Export Notification Requirements
Posted by "William A. Rowe, Jr." <wr...@rowe-clan.net>.
Yoav Shapira wrote:
> Hey,
>
> On 9/26/07, William A. Rowe, Jr. <wr...@rowe-clan.net> wrote:
>>> Please advice what's needed to be done to get the ECCN numbers.
>> Read that page, please raise any questions that you have after you've
>> covered it. You'll be glad to know once these notices are sent, you'll
>> never need to check in again about openssl for mod_jk, the native jni
>> connector or Tomcat+JSSE ever again. Think of the summary page
>>
>> http://www.apache.org/licenses/exports/
>
> So we should NOT add Tomcat to the exports matrix UNTIL the
> notifications are sent to the government, right?
I hit send too fast.
You do them concurrently. Add the notice to exports, and send out the
notification email. Because the notice includes;
NOTIFICATION: http://www.apache.org/licenses/exports/
it's sort of a closed loop problem. Update the info, allow the usual
one hour after updating from minotaur to sync, and then shoot out the
notice referencing the list of notices sent :)
Bill
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
Re: Tomcat Export Notification Requirements
Posted by "William A. Rowe, Jr." <wr...@rowe-clan.net>.
Yoav Shapira wrote:
> Hey,
>
> On 9/26/07, William A. Rowe, Jr. <wr...@rowe-clan.net> wrote:
>>> Please advice what's needed to be done to get the ECCN numbers.
>> Read that page, please raise any questions that you have after you've
>> covered it. You'll be glad to know once these notices are sent, you'll
>> never need to check in again about openssl for mod_jk, the native jni
>> connector or Tomcat+JSSE ever again. Think of the summary page
>>
>> http://www.apache.org/licenses/exports/
>
> So we should NOT add Tomcat to the exports matrix UNTIL the
> notifications are sent to the government, right?
Correct.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
Re: Tomcat Export Notification Requirements
Posted by Yoav Shapira <yo...@apache.org>.
Hey,
On 9/26/07, William A. Rowe, Jr. <wr...@rowe-clan.net> wrote:
> > Please advice what's needed to be done to get the ECCN numbers.
>
> Read that page, please raise any questions that you have after you've
> covered it. You'll be glad to know once these notices are sent, you'll
> never need to check in again about openssl for mod_jk, the native jni
> connector or Tomcat+JSSE ever again. Think of the summary page
>
> http://www.apache.org/licenses/exports/
So we should NOT add Tomcat to the exports matrix UNTIL the
notifications are sent to the government, right?
Yoav
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
Re: Tomcat Export Notification Requirements
Posted by "William A. Rowe, Jr." <wr...@rowe-clan.net>.
Mladen Turk wrote:
> William A. Rowe, Jr. wrote:
>> Hey folks,
>>
>> as you provide the bindings to the JSSE, even though you don't
>> ship the JSSE .jars - we still need Tomcat in compliance with the
>> federal export notification policies. I know you did some work on
>> this in the past, but please see
>>
>> http://www.apache.org/dev/crypto.html
>
> I suppose we would need the same for Native connectors
> that uses OpenSSL. Up till now we are using Irelands
> Heanet to host the binaries.
>
> Please advice what's needed to be done to get the ECCN numbers.
Read that page, please raise any questions that you have after you've
covered it. You'll be glad to know once these notices are sent, you'll
never need to check in again about openssl for mod_jk, the native jni
connector or Tomcat+JSSE ever again. Think of the summary page
http://www.apache.org/licenses/exports/
as documentation that all the steps are done for a specific software
component, never to be repeated (whew!)
The document is obviously evolving (only a half-dozen committers have
followed the process yet, so we want to work out any wrinkles). Please
point out problems :)
Bill
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
Re: Tomcat Export Notification Requirements
Posted by Mladen Turk <mt...@apache.org>.
William A. Rowe, Jr. wrote:
> Hey folks,
>
> as you provide the bindings to the JSSE, even though you don't
> ship the JSSE .jars - we still need Tomcat in compliance with the
> federal export notification policies. I know you did some work on
> this in the past, but please see
>
> http://www.apache.org/dev/crypto.html
>
I suppose we would need the same for Native connectors
that uses OpenSSL. Up till now we are using Irelands
Heanet to host the binaries.
Please advice what's needed to be done to get the ECCN numbers.
Regards,
Mladen
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org