www-legal-discuss mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Stefan Bodewig <bode...@apache.org>
Subject ECCN questions, again, this time Ant
Date Wed, 10 Oct 2007 04:30:25 GMT

I guess I'm the umpteenth person to ask questions.  It seems that Ant
will need an ECCN, so I don't really ask whether it needs one, but
have a few comments and questions on the
<http://www.apache.org/dev/crypto.html> document.

Ant is a build tool that contains tasks that perform steps of the
build process.  Ant ships with tasks that ssh out to different
machines or copy files over SSH.  These tasks use the jsch library[1]
but we do not distribute the library itself.  jsch is produced in
Japan and as such doesn't seem to have a ECCN, but it would require a
ECCN if distributed from the US.

So much for the background of why we think we need an ECCN.  Now my
comments and questions on the crypto doc.

First of all, the doc quite clearly talks about getting an ECCN before
doing a release.  Well, we've already had several releases that
contained the tasks (the first one was Ant 1.6.0 released in December
2003).  We are probably not the first project that didn't know about
the ECCN requirement back then (four years ago).  So what do we do
about those older releases?  Simply pretend they never happened?

The other point is that "What are examples of when a crypto item is
publicly accessible through ASF servers?" still really didn't help us.
Apart from the ssh task we might have other tasks that need to be

For example Ant contains tasks that deploy to different application
servers and as such do compile against some BEA WebLogic libraries for
example.  We are pretty sure that the WebLogic application server
itself must be a 5D002 item, but we are certainly not using it for its
crypto features.  Would a direct dependency on the application server
be enough for us to require an ECCN?  If so, any release of Ant
starting with 1.2 release seven years ago would be affected.



[1]  http://www.jcraft.com/jsch/index.html

DISCLAIMER: Discussions on this list are informational and educational
only.  Statements made on this list are not privileged, do not
constitute legal advice, and do not necessarily reflect the opinions
and policies of the ASF.  See <http://www.apache.org/licenses/> for
official ASF policies and documents.
To unsubscribe, e-mail: legal-discuss-unsubscribe@apache.org
For additional commands, e-mail: legal-discuss-help@apache.org

View raw message