Re: [Jessie-discuss] Re: RFC: merging GNU Crypto and Jessie

[Mark Wielaard]

Hi,

On Thu, 2005-12-08 at 20:07 -0800, Casey Marshall wrote:
> On Dec 8, 2005, at 11:25 AM, Anthony Green wrote:
> > My only concern is there be some trivial mechanism to generate a US
> > export-friendly version GNU Classpath, like..
> >
> > $ configure --disable-munitions
>
> Good point. We should have a switch for this in configure. Probably  
> adding the appropriate lines to standard.omit will do it?
> 
> Also, J2SE has the ExemptionMechanism class, which is currently not  
> much more than a stub in Classpath. I mean, it's trivially easy to  
> get around this restriction with free software -- you just change the  
> source -- but including a real implementation of that class may be  
> enough to satisfy these restrictions.
> 
> I wouldn't use --disable-munitions, though. The US Government spooks  
> believe crypto is a munition, but I don't.
> 
> > My understanding is that the US government has made it simpler to
> > distribute FOSS crypto code in recent years, but I have a situation
> > where I actually need to strip all export controlled crypto.  To be
> > honest, I'm not sure what specific algorithms this means.  It's  
> > possible that Classpath already contains some.
> >
> 
> Yes. RSA is export-controlled for key sizes larger than 40 bits, IIRC.
> 
> > In any case, it would be nice if the configury and build process could
> > automatically handle the absence of crypto algorithms.
> >
> Should this disable compiling the standard crypto library bits, too  
> (javax.crypto and javax.net.ssl), or just the algorithms?

As far as I know even the "hooks" fall under this. Although I am not
against having some configure options to put parts of the core library
into standards.omit I don't think it is really needed. When the first
parts of GNU Crypto was merged into GNU Classpath (and indirectly into
GCC and other projects) FSF legal made sure that all FSF distributed GNU
software would be able to be distributed (as source) from ftp.gnu.org
from mirrors. See the statement on savannah:
https://savannah.gnu.org/faq/?admin=&group_id=5802&question=Savannah_-_Is_there_any_restriction_on_cryptographic_software.txt
Similar notices have been placed on ftp.gnu.org and other distribution
sites (ftp://ftp.gnu.org/CRYPTO.README). We really don't need more then
that as long as we distribute GNU Classpath as Free Software.

Cheers,

Mark

signature.asc
Description: This is a digitally signed message part