Mailing-List: contact dev-help@apr.apache.org; run by ezmlm
Precedence: bulk
Received-SPF: pass (asf.osuosl.org: domain of justin.erenkrantz@gmail.com
 designates 66.249.92.168 as permitted sender)
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
        s=beta; d=gmail.com;
        h=received:message-id:date:from:sender:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references:x-google-sender-auth;
        b=NGIA+pjL3xb76l9/8Bm283UV6cSqYyiMXPban8vIhLlPt1/v4W2j2s0gQ9kBEufH+TElBrev0g/argKDsMumSbH9S1roXPSrUER61luA6J8aIz0F84xSjcvKdCMlDutz3rxhvoBk5+JvuuiJ58dOHFm6kq1h45FIzYayb2v+C0M=
Message-ID: <5c902b9e0606300409p1457b3e3w124bfa89aaa39c2e@mail.gmail.com>
Date: Fri, 30 Jun 2006 12:09:06 +0100
From: "Justin Erenkrantz" <justin@erenkrantz.com>
Sender: justin.erenkrantz@gmail.com
To: colm@stdlib.net
Subject: Re: Proposed Crypto Notification process
Cc: "William A. Rowe, Jr." <wrowe@rowe-clan.net>, dev@apr.apache.org,
	"Cliff Schmidt" <cliffschmidt@gmail.com>
In-Reply-To: <20060630081212.GA7308@dochas.stdlib.net>
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
References: <44A4C4EC.7080101@rowe-clan.net>
	 <20060630081212.GA7308@dochas.stdlib.net>

On 6/30/06, Colm MacCarthaigh <colm@stdlib.net> wrote:
> On Fri, Jun 30, 2006 at 07:30:04AM +0100, William A. Rowe, Jr. wrote:
> > Notification solution;
> >
> > Post the following notice on our project-specific crypto notice page;
> >
> >   http://apr.apache.org/crypto.html
>
> My impression of our outcome at the BoF was that it would probably be
> easier and preferred, if we maintained an ASF-wide list at;
>
>         http://www.apache.org/crypto.html
>
> or similar. Then once that's up, we send two BIS's, one for our
> subversion repos, and one for all current and future releases of the
> product, and that's it, we're done.

Yes.

We do not *need* to do a notice in the distribution - although that's
a reasonable thing if we chose to do so.

The only thing Garrett should do is send the following email to BIS:

---
SUBMISSION TYPE: TSU
SUBMITTED BY: Garrett
SUBMITTED FOR: Apache Software Foundation
POINT OF CONTACT: Garrett
PHONE and/or FAX: {Colm's phone number *duck*}
MANUFACTURER: The Apache Software Foundation
PRODUCT NAME/MODEL #: Apache Portable Run-time Utility Library (APR-util)
ECCN: 5D002
NOTIFICATION: http://www.apache.org/crypto.html

SUBMISSION TYPE: TSU
SUBMITTED BY: Garrett
SUBMITTED FOR: Apache Software Foundation
POINT OF CONTACT: Garrett
PHONE and/or FAX: {Colm's phone number *duck*}
MANUFACTURER: The OpenSSL Project
PRODUCT NAME/MODEL #: OpenSSL
ECCN: 5D002
NOTIFICATION: http://www.apache.org/crypto.html
---

That's it.

The crypto.html page would have the list of projects in alphabetical
order as well as OpenSSL.  For APR-util, it'd note and link to:

  http://svn.apache.org/repos/asf/apr/apr-util/ (source)
  http://www.apache.org/dist/apr/ (binaries)

For OpenSSL, it'd note and link to:

  http://www.openssl.org/source/ (source)

If we chose to go David's solution with an RDF format, that tool would
generate the crypto.html page for us with the following links.

> It doesn't really matter, but we shouldn't fragment so early if there's
> going to be an ASF-wide page/policy.

Correct.  -- justin