www-legal-discuss mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Stian Soiland-Reyes (JIRA)" <j...@apache.org>
Subject [jira] [Commented] (LEGAL-250) US Export declaration of transitive dependencies?
Date Fri, 29 Apr 2016 18:14:13 GMT

    [ https://issues.apache.org/jira/browse/LEGAL-250?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15264467#comment-15264467

Stian Soiland-Reyes commented on LEGAL-250:

Any feedback on this? In short:

Do any reliance on a a dependency that itself is classified mean you are then classified?
  If so, then I think there are quite a few ASF projects using say Apache Ant, Derby, CXF,
HttpComponents or Hadoop who should also be on the list.  If not (which I hope) - what is
the criteria for being added? E.g. is indirectly allowing usage of https:// connections enough?

I tried to find out more about ECCN 5D002, but the link http://www.access.gpo.gov/bis/ear/txt/ccl5-pt2.txt
now takes me to a generic page http://www.bis.doc.gov/index.php/regulations 

> US Export declaration of transitive dependencies?
> -------------------------------------------------
>                 Key: LEGAL-250
>                 URL: https://issues.apache.org/jira/browse/LEGAL-250
>             Project: Legal Discuss
>          Issue Type: Question
>            Reporter: Stian Soiland-Reyes
> Hi,
> I'm preparing the changes to eccnmatrix.xml for Apache Taverna (TAVERNA-959) - my current
draft is at
> https://cwiki.apache.org/confluence/display/TAVERNADEV/Taverna+Crypto+draft+XML
> Would you be able to help me review this? I was hoping to make it a bit shorter..
> I assume formally it would need to be the Incubator PMC who sends the email registration?
> At first we thought we would only need to declare our use of the Bouncy Castle encryption
library (as used by Taverna Engine's Credential Manager to store a keychain) - however now
I wonder if we need to also list any Apache dependencies that themselves are also listed on
http://www.apache.org/licenses/exports/ (e.g. CXF, HTTP Components, WSS4J, XML Security) -
or if they are exempt if you are not specifically using the encryption functionality?
> That is - a dependency like Apache HTTP Components have code to deal with SSL and JSSE
- and is therefore classified. We use Apache Jena which rely on JSONLD-JAva which rely on
HTTP Component just for network access (potentially loading from https://) - but we don't
use that network access from Taverna code. Do we still list HTTP Component (and potentially
Jena and JSONLD-Java) as classified?
> Does it make a difference if a classified item is used as a <dependency> in a source
release, or if the JAR of the classified item is included in a binary distribution for dist?
> This would affect loads of projects - e.g. Jena binaries redistribute Apache HTTP Components
(JENA-1169) - but doesn't do anything particular with encryption (except supporting RDF files
hosted at https://) -- 
> Complicating matters is that Taverna have multiple git repositories - so if interpreted
strictly all Taverna components that somehow depend on the classified Taverna component also
become affected (even if they don't actually import taverna-credential-manager-impl) - do
we need to list them all?   There is a lot of repetition - so I added just a single <Version>
for all the "development" - even though each git repository has a different versioning scheme.
> But do I still need to transitively expand the <Why> from its dependencies' dependencies,
or is it enough to list what the item directly uses?  (e.g. taverna-plugin-bioinformatics
just needs to list "use with Apache Taverna Engine" which then implies the other Taverna modules
and JSSE, JCE, BouncyCastle  and HTTP Components?)
> I assume an indirection to http://taverna.incubator.apache.org/download/code/ is not
valid and I need to list each of our git repositories? 
> I see for dist it's common practice to just link to the top-level tree which simplifies
the release <Version> - however I was unable to give it a single version number so I
just called it "All releases" - see https://archive.apache.org/dist/incubator/taverna/source/
> Sorry for the long email.. I've been pondering on this all night long :)
> It sounds to me like we need some kind of Maven support for this.. 

This message was sent by Atlassian JIRA

To unsubscribe, e-mail: legal-discuss-unsubscribe@apache.org
For additional commands, e-mail: legal-discuss-help@apache.org

View raw message