From dev-return-46426-archive-asf-public=cust-asf.ponee.io@ignite.apache.org Tue Jun 25 20:54:57 2019 Return-Path: X-Original-To: archive-asf-public@cust-asf.ponee.io Delivered-To: archive-asf-public@cust-asf.ponee.io Received: from mail.apache.org (hermes.apache.org [207.244.88.153]) by mx-eu-01.ponee.io (Postfix) with SMTP id D9D8318062F for ; Tue, 25 Jun 2019 22:54:56 +0200 (CEST) Received: (qmail 90818 invoked by uid 500); 25 Jun 2019 20:54:56 -0000 Mailing-List: contact dev-help@ignite.apache.org; run by ezmlm Precedence: bulk List-Help: List-Unsubscribe: List-Post: List-Id: Reply-To: dev@ignite.apache.org Delivered-To: mailing list dev@ignite.apache.org Received: (qmail 90807 invoked by uid 99); 25 Jun 2019 20:54:55 -0000 Received: from Unknown (HELO mailrelay1-lw-us.apache.org) (10.10.3.159) by apache.org (qpsmtpd/0.29) with ESMTP; Tue, 25 Jun 2019 20:54:55 +0000 Received: from mail-io1-f42.google.com (mail-io1-f42.google.com [209.85.166.42]) by mailrelay1-lw-us.apache.org (ASF Mail Server at mailrelay1-lw-us.apache.org) with ESMTPSA id A22841C6F for ; Tue, 25 Jun 2019 20:54:55 +0000 (UTC) Received: by mail-io1-f42.google.com with SMTP id u19so131464ior.9 for ; Tue, 25 Jun 2019 13:54:55 -0700 (PDT) X-Gm-Message-State: APjAAAXmZl9I2MGShOvwLAdDw/RA1aJaCd6R0kGFratR6qqJQaSy59Pu CZrjOe99yX06bf5GOzyjdUk3FOkikAlZpk21m8HVnA== X-Google-Smtp-Source: APXvYqyBroQl9AznHf8GgzPFof4Sjd1BkgoLyStvtcNk5ZVeaIAxhPGoxfMT/2xLDzDlBml2nehzp3il96UDfkSSGdU= X-Received: by 2002:a5e:c24b:: with SMTP id w11mr778061iop.111.1561496094750; Tue, 25 Jun 2019 13:54:54 -0700 (PDT) MIME-Version: 1.0 References: <5d07a1ab.1c69fb81.cd774.da6d@mx.google.com> In-Reply-To: From: Denis Magda Date: Tue, 25 Jun 2019 13:54:24 -0700 X-Gmail-Original-Message-ID: Message-ID: Subject: Re: Signing off Ignite for export beyond the U.S. To: dev , dpavlov@apache.org Content-Type: multipart/alternative; boundary="0000000000000bd414058c2c2460" --0000000000000bd414058c2c2460 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Dmitry, I've updated the ASF website by including Ignite to the exports matrix [1]. Plus, notified the controlling U.S. entities on the matter. Could you please do one more favor and help to close these two items (flying on a plane and a poor Internet connection makes it impossible to check them off on my end)? - Update README.txt in Ignite master with the content prepared earlier by you - Copy content of this doc [2] to Ignite Wiki [1] http://www.apache.org/licenses/exports/ [2] https://docs.google.com/spreadsheets/d/1s15HnsE40hHl0QN2aX0hJ3atw9_LO19_mzh= gM96rcbo/edit?usp=3Dsharing - Denis On Wed, Jun 19, 2019 at 2:47 PM Dmitriy Pavlov wrote: > Pavel replied to me in private: encryption is available since 2.4 for .Ne= t > thin client. > > I've also modified source XML > > https://github.com/apache/ignite/pull/6616/files#diff-1995c8a78832996cb48= db91f7550479cR8 > > > =D1=87=D1=82, 20 =D0=B8=D1=8E=D0=BD. 2019 =D0=B3. =D0=B2 00:10, Denis Mag= da : > > > Pavel, > > > > I still have no info related to starting version of .NET encryption > > > support. So I supposed it was 1.5. > > > > > > Could you please help with this last open item? > > > > Dmitry, thanks for the final summary. I'll contact ASF folks trying to > find > > the ASF website dev instructions. > > > > > > -- > > Denis Magda > > > > > > On Wed, Jun 19, 2019 at 11:35 AM Dmitriy Pavlov > > wrote: > > > > > Hi Denis, > > > > > > I still have no info related to starting version of .NET encryption > > > support. So I supposed it was 1.5. > > > > > > I've started both XSTLs and added an example of both XLTs output to > > google > > > doc tabs. One transformer is for email template generation (requires > > > project name), another is for the site table. > > > > > > Only one TODO now left in the PR version of the update. All other stu= ff > > is > > > ready for publishing: > > > > > > > > > https://github.com/apache/ignite/pull/6616/files#diff-1995c8a78832996cb48= db91f7550479cR8 > > > > > > Sincerely, > > > Dmitriy Pavlov > > > > > > P.S. I'm not sure that dev. the list will keep formatting, but anyway > > here > > > is transformer output example as text. > > > > > > Apache Ignite Project > > > Product Name Versions ECCN > > > Controlled Source > > > Apache Ignite development 5D002 > > > ASF, Oracle, The OpenSSL Project, Microsoft, .NET Foundation, JCraft, > > Inc., > > > The Eclipse Foundation > > > 2.5.0 - latest 5D002 > > > ASF, Oracle, The OpenSSL Project, Microsoft, .NET Foundation, JCraft, > > Inc., > > > The Eclipse Foundation > > > 1.5.0.final - 2.4.0 5D002 > > > ASF, Oracle, Microsoft, .NET Foundation, JCraft, Inc., The Eclipse > > > Foundation > > > 1.0.0 - 1.5.0-b1 5D002 > > > ASF, Oracle, JCraft, Inc., The Eclipse Foundation > > > > > > =D1=81=D1=80, 19 =D0=B8=D1=8E=D0=BD. 2019 =D0=B3. =D0=B2 15:05, Dmitr= iy Pavlov : > > > > > > > Igniters, > > > > > > > > as for older versions, I've started to collect information of crypt= o > > > > providers usages in older versions, please help me to finalize this > doc > > > so > > > > I could prepare a declaration of older versions. > > > > > > > > > > > > > > > > > > https://docs.google.com/spreadsheets/d/1s15HnsE40hHl0QN2aX0hJ3atw9_LO19_m= zhgM96rcbo/edit?usp=3Dsharing > > > > > > > > I'm not sure if the time of Incubation counts, but, anyway, let' > > collect > > > > information about the history of modules. > > > > > > > > Sincerely, > > > > Dmitriy Pavlov > > > > > > > > =D1=81=D1=80, 19 =D0=B8=D1=8E=D0=BD. 2019 =D0=B3. =D0=B2 14:05, Dmi= triy Pavlov : > > > > > > > >> Hi Denis, > > > >> > > > >> Build process seems to be mentioned only here > > > >> https://www.apache.org/dev/crypto.html#sources It also mentions > some > > > >> bisnotice XSLT transformation, which is available at SVN here > > > >> > > > > > > https://svn.apache.org/repos/asf/infrastructure/site/trunk/content/licens= es/exports/ > > > >> > > > >> For XML I'm preparing at PR6616 it seems that eccnmatrix.xsl from > > > >> > > > > > > https://svn.apache.org/repos/asf/infrastructure/site/trunk/content/licens= es/exports/index.page/ > > > >> is more appropriate. I will test it locally. > > > >> > > > >> The only thing I've found for now is the following scripts at the > root > > > of > > > >> SVN here > https://svn.apache.org/repos/asf/infrastructure/site/trunk/ > > > >> bisnotice.cmd > > > >> bisnotice.sh > > > >> > > > >> Sincerely, > > > >> Dmitriy Pavlov > > > >> > > > >> =D1=81=D1=80, 19 =D0=B8=D1=8E=D0=BD. 2019 =D0=B3. =D0=B2 01:40, De= nis Magda : > > > >> > > > >>> Dmitriy, > > > >>> > > > >>> I think that it's required to enlist all of the publicly released > > > Ignite > > > >>> versions (available for download from the website). It means that > the > > > XML > > > >>> should have the following controlled sources grouped by Ignite > > > versions' > > > >>> ranges. > > > >>> > > > >>> - Ignite 1.0.0 - Ignite 1.5.0-b1: ASF, Oracle, The Eclipse > > > Foundation > > > >>> - Ignite 1.5.0 and later: all of the controller versions liste= d > by > > > >>> you. > > > >>> > > > >>> Not sure about JCraft only. What was the first Ignite version the > lib > > > was > > > >>> added to? > > > >>> > > > >>> As for .NET versions declarations, I'm for the way it handled rig= ht > > now > > > >>> by > > > >>> you. Btw, do you know where ASF explains the website build proces= s? > > > >>> Failed > > > >>> to find it, it's not enough just to update the XML. > > > >>> > > > >>> Finally, looping in Garrett who can help with the editorial revie= w. > > > >>> Garrett, could you please review README.txt from this pull-reques= t? > > > >>> > > > >>> > > > > > > https://github.com/apache/ignite/pull/6616/files#diff-26fd799ea07494916e9= da9b91b2aac64R29 > > > >>> > > > >>> > > > >>> - > > > >>> Denis > > > >>> > > > >>> > > > >>> On Tue, Jun 18, 2019 at 5:06 AM Dmitriy Pavlov > > > > >>> wrote: > > > >>> > > > >>> > Igniters, > > > >>> > > > > >>> > please review crypto notice in > > > >>> > > > > >>> > > > > >>> > > > > > > https://github.com/apache/ignite/pull/6616/files#diff-26fd799ea07494916e9= da9b91b2aac64R29 > > > >>> > > > > >>> > Only 2 open questions: about declaring released versions, and > about > > > >>> > declaring .NET versions (.NET Core & . NET Classic). By default= , > I > > > >>> propose > > > >>> > to keep both. > > > >>> > > > > >>> > Sincerely, > > > >>> > Dmitriy Pavlov > > > >>> > > > > >>> > =D0=BF=D0=BD, 17 =D0=B8=D1=8E=D0=BD. 2019 =D0=B3. =D0=B2 19:24,= Dmitriy Pavlov >: > > > >>> > > > > >>> > > Pavel, > > > >>> > > > > > >>> > > we need to follow the process from > > > >>> > > https://www.apache.org/dev/crypto.html#classify > > > >>> > > > > > >>> > > Please see similar products in the draft export matrix, > > > >>> > > > > > >>> > > > > > >>> > > > > >>> > > > > > > https://github.com/apache/ignite/pull/6616/files#diff-1995c8a78832996cb48= db91f7550479cR7 > > > >>> > > > > > >>> > > > > > >>> > > We don't ship JDK, but we designed our product to use a > > > cryptographic > > > >>> > > feature from this 3rd party product, so we need to follow thi= s > > > >>> process > > > >>> > and > > > >>> > > provide matrix update, add CRYPTO notice (I'll draft it). > > > >>> > > > > > >>> > > Other products don't declare all possible JDKs - > > > >>> > > http://www.apache.org/licenses/exports/#matrix So, probably, > one > > > >>> > > declaration of .NET classic (Microsoft) would be enough. > > > >>> > > > > > >>> > > Sincerely, > > > >>> > > Dmitriy Pavlov > > > >>> > > > > > >>> > > =D0=BF=D0=BD, 17 =D0=B8=D1=8E=D0=BD. 2019 =D0=B3. =D0=B2 19:1= 1, Pavel Tupitsyn < > > ptupitsyn@apache.org > > > >: > > > >>> > > > > > >>> > >> >>Should it go instead of Microsoft? Should we mention .NET > code > > > in > > > >>> > >> addition > > > >>> > >> > > > >>> > >> >>to Microsoft? > > > >>> > >> > > > >>> > >> > > > >>> > >> > > > >>> > >> >Yes, I think we can do this. Ignite targets both of the the= m. > > And > > > >>> .NET > > > >>> > >> Core uses it=E2=80=99s own implementation of standard class = library[1] > > > >>> > >> > > > >>> > >> >Pavel may correct me. > > > >>> > >> > > > >>> > >> > > > >>> > >> We use crypto APIs from standard class library. We ship our > > > >>> binaries, > > > >>> > but > > > >>> > >> we don't ship the framework binaries. > > > >>> > >> > > > >>> > >> Our binaries can be executed with .NET Core (open-source, MI= T > > > >>> license), > > > >>> > >> Mono (open-source, MIT license), and .NET Classic (old > > framework, > > > >>> > >> Windows-only, Microsoft license). > > > >>> > >> > > > >>> > >> I'm still not sure what is the question we are trying to > answer, > > > >>> though. > > > >>> > >> > > > >>> > >> > > > >>> > >> Thanks, > > > >>> > >> > > > >>> > >> Pavel > > > >>> > >> > > > >>> > >> > > > >>> > >> > > > >>> > >> On Mon, Jun 17, 2019 at 5:20 PM Alexandr Shapkin < > > > lexwert@gmail.com > > > >>> > > > > >>> > >> wrote: > > > >>> > >> > > > >>> > >> > >1) Declaring older versions of Ignite. > > > >>> > >> > > > > >>> > >> > >2) Is it correct to mention that Ignite uses .NET core > > > >>> controlled by > > > >>> > >> .NET > > > >>> > >> > > > > >>> > >> > >Foundation? E.g. as follows: > > > >>> > >> > > > > >>> > >> > >(controlled by) > > > >>> > >> > > > > >>> > >> > >.NET Foundation > > > >>> > >> > > > > >>> > >> > >title=3DDesigned to use .NET Framework Cryptography Model > > > >>> > >> > > > > >>> > >> > >href=3Dhttps://dotnetfoundation.org/projects > > > >>> > >> > > > > >>> > >> > > > > >>> > >> > > > > >>> > >> > >Should it go instead of Microsoft? Should we mention .NET > > code > > > in > > > >>> > >> addition > > > >>> > >> > > > > >>> > >> > >to Microsoft? > > > >>> > >> > > > > >>> > >> > > > > >>> > >> > > > > >>> > >> > Yes, I think we can do this. Ignite targets both of the > them. > > > And > > > >>> .NET > > > >>> > >> > Core uses it=E2=80=99s own implementation of standard clas= s > library[1] > > > >>> > >> > > > > >>> > >> > Pavel may correct me. > > > >>> > >> > > > > >>> > >> > > > > >>> > >> > > > > >>> > >> > [1] https://github.com/dotnet/corefx > > > >>> > >> > > > > >>> > >> > > > > >>> > >> > > > > >>> > >> > *From: *Dmitriy Pavlov > > > >>> > >> > *Sent: *Monday, June 17, 2019 4:35 PM > > > >>> > >> > *To: *dev > > > >>> > >> > *Cc: *Denis Magda ; Igor Sapego < > > > >>> > isapego@apache.org>; > > > >>> > >> Pavel > > > >>> > >> > Petroshenko ; Nikolay Izhikov < > > > >>> nizhikov@apache.org> > > > >>> > >> > *Subject: *Re: Signing off Ignite for export beyond the U.= S. > > > >>> > >> > > > > >>> > >> > > > > >>> > >> > > > > >>> > >> > Thanks, Pavel! > > > >>> > >> > > > > >>> > >> > > > > >>> > >> > > > > >>> > >> > Denis, Pavel, Igniters, please review the following > proposal: > > > >>> > >> > > > > >>> > >> > > > > >>> > >> > > > > >>> > >> > - Python, Node JS, ODBC to be declared as OpenSSL usage. > > > >>> > >> > > > > >>> > >> > - AWS-S3 client-side encryption to be declared as JCA/JCE > > usage. > > > >>> > >> > > > > >>> > >> > - SSLContextFactory usage to be declared as JCA/JCE usage. > > > >>> > >> > > > > >>> > >> > - TDE to be declared as JCA/JCE > > > >>> > >> > > > > >>> > >> > > > > >>> > >> > > > > >>> > >> > Export matrix data to be published in ASF-level SVN: > > > >>> > >> > > > > >>> > >> > <<<<< > > > >>> > >> > > > > >>> > >> > Product Name > > > >>> > >> > > > > >>> > >> > Apache Ignite > > > >>> > >> > > > > >>> > >> > > > > >>> > >> > > > > >>> > >> > Versions > > > >>> > >> > > > > >>> > >> > development > > > >>> > >> > > > > >>> > >> > 2.7 and later > > > >>> > >> > > > > >>> > >> > > > > >>> > >> > > > > >>> > >> > ECCN > > > >>> > >> > > > > >>> > >> > 5D002 > > > >>> > >> > > > > >>> > >> > > > > >>> > >> > > > > >>> > >> > Controlled source > > > >>> > >> > > > > >>> > >> > ASF > > > >>> > >> > > > > >>> > >> > title=3DDesigned to use with built-in Java Cryptography > > > Architecture > > > >>> > (JCA) > > > >>> > >> > > > > >>> > >> > href=3Dhttps://gitbox.apache.org/repos/asf?p=3Dignite.git > > > >>> > >> > > > > >>> > >> > > > > >>> > >> > > > > >>> > >> > Oracle > > > >>> > >> > > > > >>> > >> > title=3DDesigned to use with built-in Java encryption > libraries > > > >>> (JCE) > > > >>> > >> > > > > >>> > >> > href=3D > > > >>> > >> > > > https://www.oracle.com/technetwork/java/javase/downloads/index.html > > > >>> > >> > > > > >>> > >> > > > > >>> > >> > > > > >>> > >> > The OpenSSL Project > > > >>> > >> > > > > >>> > >> > title=3DDesigned to use General Purpose cryptography libra= ry > > > >>> included > > > >>> > with > > > >>> > >> > > > > >>> > >> > OpenSSL > > > >>> > >> > > > > >>> > >> > href=3Dhttps://www.openssl.org/source/ > > > >>> > >> > > > > >>> > >> > > > > >>> > >> > > > > >>> > >> > Microsoft > > > >>> > >> > > > > >>> > >> > title=3DDesigned to use .NET Framework Cryptography Model > > > >>> > >> > > > > >>> > >> > href=3Dhttps://dotnet.microsoft.com/download > > > >>> > >> > > > > >>> > >> > >>>>>> > > > >>> > >> > > > > >>> > >> > > > > >>> > >> > > > > >>> > >> > Open questions: > > > >>> > >> > > > > >>> > >> > 1) Declaring older versions of Ignite. > > > >>> > >> > > > > >>> > >> > 2) Is it correct to mention that Ignite uses .NET core > > > controlled > > > >>> by > > > >>> > >> .NET > > > >>> > >> > > > > >>> > >> > Foundation? E.g. as follows: > > > >>> > >> > > > > >>> > >> > (controlled by) > > > >>> > >> > > > > >>> > >> > .NET Foundation > > > >>> > >> > > > > >>> > >> > title=3DDesigned to use .NET Framework Cryptography Model > > > >>> > >> > > > > >>> > >> > href=3Dhttps://dotnetfoundation.org/projects > > > >>> > >> > > > > >>> > >> > > > > >>> > >> > > > > >>> > >> > Should it go instead of Microsoft? Should we mention .NET > code > > > in > > > >>> > >> addition > > > >>> > >> > > > > >>> > >> > to Microsoft? > > > >>> > >> > > > > >>> > >> > > > > >>> > >> > > > > >>> > >> > Sincerely, > > > >>> > >> > > > > >>> > >> > Dmitriy Pavlov > > > >>> > >> > > > > >>> > >> > > > > >>> > >> > > > > >>> > >> > =D0=BF=D0=BD, 17 =D0=B8=D1=8E=D0=BD. 2019 =D0=B3. =D0=B2 1= 6:07, Pavel Tupitsyn < > > > ptupitsyn@apache.org > > > >>> >: > > > >>> > >> > > > > >>> > >> > > > > >>> > >> > > > > >>> > >> > > Hi Denis, > > > >>> > >> > > > > >>> > >> > > > > > >>> > >> > > > > >>> > >> > > Ignite.NET uses .NET Framework Standard Library for all > > > >>> security and > > > >>> > >> > > > > >>> > >> > > cryptographic related code. There are no dependencies on > > > >>> external > > > >>> > >> > > > > >>> > >> > > libraries. > > > >>> > >> > > > > >>> > >> > > > > > >>> > >> > > > > >>> > >> > > Thanks > > > >>> > >> > > > > >>> > >> > > > > > >>> > >> > > > > >>> > >> > > =D1=81=D1=80, 12 =D0=B8=D1=8E=D0=BD. 2019 =D0=B3., 21:07= Denis Magda >: > > > >>> > >> > > > > >>> > >> > > > > > >>> > >> > > > > >>> > >> > > > Igniters, > > > >>> > >> > > > > >>> > >> > > > > > > >>> > >> > > > > >>> > >> > > > Regardless of the fact that Ignite is an open source > > > >>> software, ASF > > > >>> > >> as > > > >>> > >> > an > > > >>> > >> > > > > >>> > >> > > > entity based in the U.S. has to comply with certain > > > exporting > > > >>> > >> > regulations > > > >>> > >> > > > > >>> > >> > > > [1]. > > > >>> > >> > > > > >>> > >> > > > > > > >>> > >> > > > > >>> > >> > > > Dmitry Pavlov and I are working on adding Ignite to th= e > > > table > > > >>> [2] > > > >>> > of > > > >>> > >> > > > > >>> > >> > > > projects allowed for export and might need the > assistance > > of > > > >>> some > > > >>> > of > > > >>> > >> > you. > > > >>> > >> > > > > >>> > >> > > > > > > >>> > >> > > > > >>> > >> > > > Here is a list of cryptographic functions used by Igni= te > > > (and > > > >>> > >> provided > > > >>> > >> > by > > > >>> > >> > > > > >>> > >> > > > a 3rd party vendor): > > > >>> > >> > > > > >>> > >> > > > > > > >>> > >> > > > > >>> > >> > > > 1. JDK SSL/TLS libraries if a user wishes to enable > > > secured > > > >>> > >> > > > > >>> > >> > > > connectivity between cluster nodes. Manufacturer - > > > >>> > >> Oracle/OpenJDK ( > > > >>> > >> > > > > >>> > >> > > > https://apacheignite.readme.io/docs/ssltls) > > > >>> > >> > > > > >>> > >> > > > 2. JDK AES/CBC/PKCS5Padding encryption from the Jav= a > > > >>> libraries > > > >>> > >> for > > > >>> > >> > > > > >>> > >> > > > transparent data encryption of data on disk ( > > > >>> > >> > > > > >>> > >> > > > > > > >>> > https://apacheignite.readme.io/docs/transparent-data-encryption= ) > > > >>> > >> > > > > >>> > >> > > > 3. Libraries/vendors for .NET nodes security?* Pave= l > > > >>> Tupitsyn*, > > > >>> > >> > could > > > >>> > >> > > > > >>> > >> > > > you check? > > > >>> > >> > > > > >>> > >> > > > 4. Libraries/vendors for C++ clients security (SSL, > > TLS, > > > >>> > anything > > > >>> > >> > > > > >>> > >> > > > else?). *Igor Sapego*, could you please check? > > > >>> > >> > > > > >>> > >> > > > 5. Libraries/vendors for Python, PHP, Node.JS > SSL/TLS? > > > >>> *Dear > > > >>> > thin > > > >>> > >> > > > > >>> > >> > > > client contributors*, please facilitate. > > > >>> > >> > > > > >>> > >> > > > 6. Anything else missing from the list? We don't ha= ve > > any > > > >>> > custom > > > >>> > >> > > > > >>> > >> > > > crypto features, right? > > > >>> > >> > > > > >>> > >> > > > > > > >>> > >> > > > > >>> > >> > > > All of these usages/integrations have to comply with t= he > > > >>> following > > > >>> > >> > > > > >>> > >> > > > checklist [3] before I, as a PMC Chair, submit a notic= e > to > > > >>> Export > > > >>> > >> > > > > >>> > >> > > > Administration Regulations of the U.S.A. > > > >>> > >> > > > > >>> > >> > > > > > > >>> > >> > > > > >>> > >> > > > [1] http://www.apache.org/licenses/exports/ > > > >>> > >> > > > > >>> > >> > > > [2] http://www.apache.org/licenses/exports/#matrix > > > >>> > >> > > > > >>> > >> > > > [3] https://www.apache.org/dev/crypto.html#classify > > > >>> > >> > > > > >>> > >> > > > > > > >>> > >> > > > > >>> > >> > > > > > > >>> > >> > > > > >>> > >> > > > - > > > >>> > >> > > > > >>> > >> > > > Denis > > > >>> > >> > > > > >>> > >> > > > > > > >>> > >> > > > > >>> > >> > > > > > >>> > >> > > > > >>> > >> > > > > >>> > >> > > > > >>> > >> > > > >>> > > > > > >>> > > > > >>> > > > >> > > > > > > --0000000000000bd414058c2c2460--