You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@cloudberry.apache.org by "tuhaihe (via GitHub)" <gi...@apache.org> on 2026/09/15 09:59:31 UTC
[PR] Add export control notice for bundled cryptography [cloudberry]
tuhaihe opened a new pull request, #2004:
URL: https://github.com/apache/cloudberry/pull/2004
Justin Mclean noted during the 2.2.0-rc1 IPMC vote that the release has no crypto export notice despite shipping contrib/pgcrypto, and that Cloudberry does not appear on https://www.apache.org/licenses/exports/.
infra.apache.org/crypto.html requires the notice in the README of each distribution, so add it there, listing the components of the release that involve cryptography: OpenSSL for TLS and SCRAM-SHA-256, optional GSSAPI and LDAP over TLS, and the bundled pgcrypto extension. The build links against the operating system's OpenSSL and does not ship it, which the notice states because it determines who is named as manufacturer in the BIS notification.
This commit only covers the README. Two steps remain, and neither lives in the source tree:
- adding Cloudberry to https://www.apache.org/licenses/exports/, which is a pull request against apache/www-site, file data/eccn/eccnmatrix.yaml. Podlings do not get their own top-level entry there; sixteen of them sit as products under a single
- href: https://incubator.apache.org/
name: Apache Incubator Project
contact: Apache Incubator PMC <pr...@incubator.apache.org>
umbrella, so Cloudberry belongs under that one, with the contact inherited from the Incubator PMC rather than one of our own lists.
- sending the ECCN 5D002 notification to crypt@bis.doc.gov, enc@nsa.gov and web_site@bis.doc.gov. This is a named legal notification submitted on behalf of the ASF. The procedure describes it as coming from the PMC chair, and for a project in incubation the PMC is the Incubator PMC; infra.apache.org/crypto.html says nothing about podlings, so who sends it is a question for our mentors. The site build generates the text of this email from the matrix entry, so it does not have to be written by hand.
Per the same page those are supposed to happen before the code is posted publicly, so they are overdue rather than new; the notification names the product without a version and does not need repeating per release.
Assisted-by: Claude Code
Backpatch-through: REL_2_STABLE
<!-- Thank you for your contribution to Apache Cloudberry (Incubating)! -->
Fixes #ISSUE_Number
### What does this PR do?
<!-- Brief overview of the changes, including any major features or fixes -->
### Type of Change
- [ ] Bug fix (non-breaking change)
- [ ] New feature (non-breaking change)
- [ ] Breaking change (fix or feature with breaking changes)
- [ ] Documentation update
### Breaking Changes
<!-- Remove if not applicable. If yes, explain impact and migration path -->
### Test Plan
<!-- How did you test these changes? -->
- [ ] Unit tests added/updated
- [ ] Integration tests added/updated
- [ ] Passed `make installcheck`
- [ ] Passed `make -C src/test installcheck-cbdb-parallel`
### Impact
<!-- Remove sections that don't apply -->
**Performance:**
<!-- Any performance implications? -->
**User-facing changes:**
<!-- Any changes visible to users? -->
**Dependencies:**
<!-- New dependencies or version changes? -->
### Checklist
- [ ] Followed [contribution guide](https://cloudberry.apache.org/contribute/code)
- [ ] Added/updated documentation
- [ ] Reviewed code for security implications
- [ ] This PR contains AI-assisted code generation
- [ ] Requested review from [cloudberry committers](https://github.com/orgs/apache/teams/cloudberry-committers)
### Additional Context
<!-- Any other information that would help reviewers? Remove if none -->
### CI Skip Instructions
<!--
To skip CI builds, add the appropriate CI skip identifier to your PR title.
The identifier must:
- Be in square brackets []
- Include the word "ci" and either "skip" or "no"
- Only use for documentation-only changes or when absolutely necessary
-->
---
<!-- Join our community:
- Mailing list: [dev@cloudberry.apache.org](https://lists.apache.org/list.html?dev@cloudberry.apache.org) (subscribe: dev-subscribe@cloudberry.apache.org)
- Discussions: https://github.com/apache/cloudberry/discussions -->
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudberry.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@cloudberry.apache.org
For additional commands, e-mail: commits-help@cloudberry.apache.org
Re: [PR] Add export control notice for bundled cryptography [cloudberry]
Posted by "tuhaihe (via GitHub)" <gi...@apache.org>.
tuhaihe commented on PR #2004:
URL: https://github.com/apache/cloudberry/pull/2004#issuecomment-5712583558
Now it's ready for review. This change primarily takes this document as a reference: https://infra.apache.org/crypto.html#inform.
cc @leborchuk
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudberry.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@cloudberry.apache.org
For additional commands, e-mail: commits-help@cloudberry.apache.org
Re: [PR] Add export control notice for bundled cryptography [cloudberry]
Posted by "tuhaihe (via GitHub)" <gi...@apache.org>.
tuhaihe commented on PR #2004:
URL: https://github.com/apache/cloudberry/pull/2004#issuecomment-5723979349
Good catch, thanks — you are right, and I have added it in b23b9e6.
I checked it against a release-configuration build on Rocky 9 rather than
going by the source alone:
- `pg_config.h` carries `#define USE_OPENSSL 1`, so the `USE_SSL` blocks you
found are compiled in
- `bin/gpfdist` ships in the packages and links `libssl.so.3` and
`libcrypto.so.3`, with 14 SSL symbols in the binary
- its help text offers `--ssl dir : start HTTPS server. Use the certificates
from the specified directory`
- `gpfdist.c:4364` calls `SSL_CTX_use_certificate_chain_file()` to load the
chain
So it terminates TLS as a server using X.509 certificates, which is squarely
within 5D002.
I listed it on its own line rather than folding it into the first entry, for
two reasons: it is a standalone executable that people often deploy on hosts
away from the database, and it acts as a TLS server loading certificates
rather than just encrypting a client connection.
My first pass covered the server process and pgcrypto and missed the separate
binaries, so this was a real gap.
One related note: the eccnmatrix entry in apache/www-site#749 does not need a
change for this. Its controlled-source link points at the whole cloudberry
repository, so gpfdist is already covered.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudberry.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@cloudberry.apache.org
For additional commands, e-mail: commits-help@cloudberry.apache.org
Re: [PR] Add export control notice for bundled cryptography [cloudberry]
Posted by "leborchuk (via GitHub)" <gi...@apache.org>.
leborchuk commented on code in PR #2004:
URL: https://github.com/apache/cloudberry/pull/2004#discussion_r4035989655
##########
README.md:
##########
@@ -132,6 +132,38 @@ Apache Cloudberry has a sound foundation.
Cloudberry is licensed under the Apache License, Version 2.0. For details, see
the [LICENSE](./LICENSE).
+## Crypto Export Notice
+
+This distribution includes cryptographic software. The country in
+which you currently reside may have restrictions on the import,
+possession, use, and/or re-export to another country, of
+encryption software. BEFORE using any encryption software, please
+check your country's laws, regulations and policies concerning the
+import, possession, or use, and re-export of encryption software, to
+see if this is permitted. See http://www.wassenaar.org for
+more information.
+
+The Apache Software Foundation has classified this software as Export Commodity
+Control Number (ECCN) 5D002, which includes information security
+software using or performing cryptographic functions with asymmetric
+algorithms. The form and manner of this Apache Software Foundation
+distribution makes it eligible for export under the "publicly available"
+Section 742.15(b) exemption (see the BIS Export Administration Regulations,
+Section 742.15(b)) for both object code and source code.
+
+The following provides more details on the included cryptographic
+software:
+
+- Apache Cloudberry uses OpenSSL for TLS support on client and server
+ connections, and for the SCRAM-SHA-256 authentication method.
+- Apache Cloudberry optionally uses GSSAPI (Kerberos) for authentication and
+ connection encryption, and LDAP over TLS for authentication.
+- The bundled `pgcrypto` extension provides cryptographic functions to SQL,
+ using either OpenSSL or its own built-in implementations.
Review Comment:
Also I've found in `src/bin/gpfdist/gpfdist.c` definition:
```
#ifdef USE_SSL
#include <openssl/ssl.h>
#include <openssl/rand.h>
#include <openssl/err.h>
#endif
```
Also gpfdist could use ssl certificates. It means it also use asymmetric cryptohraphy. I do not now if we should include gpfdist too, just pointed out
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudberry.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@cloudberry.apache.org
For additional commands, e-mail: commits-help@cloudberry.apache.org
Re: [PR] Add export control notice for bundled cryptography [cloudberry]
Posted by "tuhaihe (via GitHub)" <gi...@apache.org>.
tuhaihe commented on code in PR #2004:
URL: https://github.com/apache/cloudberry/pull/2004#discussion_r4043163341
##########
README.md:
##########
@@ -132,6 +132,38 @@ Apache Cloudberry has a sound foundation.
Cloudberry is licensed under the Apache License, Version 2.0. For details, see
the [LICENSE](./LICENSE).
+## Crypto Export Notice
+
+This distribution includes cryptographic software. The country in
+which you currently reside may have restrictions on the import,
+possession, use, and/or re-export to another country, of
+encryption software. BEFORE using any encryption software, please
+check your country's laws, regulations and policies concerning the
+import, possession, or use, and re-export of encryption software, to
+see if this is permitted. See http://www.wassenaar.org for
+more information.
+
+The Apache Software Foundation has classified this software as Export Commodity
+Control Number (ECCN) 5D002, which includes information security
+software using or performing cryptographic functions with asymmetric
+algorithms. The form and manner of this Apache Software Foundation
+distribution makes it eligible for export under the "publicly available"
+Section 742.15(b) exemption (see the BIS Export Administration Regulations,
+Section 742.15(b)) for both object code and source code.
+
+The following provides more details on the included cryptographic
+software:
+
+- Apache Cloudberry uses OpenSSL for TLS support on client and server
+ connections, and for the SCRAM-SHA-256 authentication method.
+- Apache Cloudberry optionally uses GSSAPI (Kerberos) for authentication and
+ connection encryption, and LDAP over TLS for authentication.
+- The bundled `pgcrypto` extension provides cryptographic functions to SQL,
+ using either OpenSSL or its own built-in implementations.
Review Comment:
added it in https://github.com/apache/cloudberry/commit/b23b9e6c7ac6fd87d50e8b43a4df597e10d4b715
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudberry.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@cloudberry.apache.org
For additional commands, e-mail: commits-help@cloudberry.apache.org
Re: [PR] Add export control notice for bundled cryptography [cloudberry]
Posted by "tuhaihe (via GitHub)" <gi...@apache.org>.
tuhaihe merged PR #2004:
URL: https://github.com/apache/cloudberry/pull/2004
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudberry.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@cloudberry.apache.org
For additional commands, e-mail: commits-help@cloudberry.apache.org