[CentOS-devel] Export licensing for crypto

Wed Aug 9 04:05:48 UTC 2017
Karsten Wade <kwade at redhat.com>

On 08/08/2017 04:30 PM, Thomas F Herbert wrote:
> Vpp package includes an accelerated software IPSecusing the multi-buffer
> library.
> 
> My understanding is that due to US law, since this is a separate
> implementation from OpenSSL, It requires an export license.
> 
> We are covered upstream through Linux foundation.
> 
> Does Centos.org hold an export license for crypto?
> 
> Is this a question for the Centos board?

Perhaps, but it depends on a bit more clarity. I'd have to know a bit
more about this specific case & can ask our friendly export compliance
folks.

That said, the distro is distributed with the Export Control
Classification Number (ECCN) for/from RHEL:

https://wiki.centos.org/ECCN

The gray area we might be in here is if the Vpp package is not in the
upstream distro. Can you give more background on where it's derived from?

- Karsten
-- 
Karsten Wade
Community Infrastructure Team : https://osci.io
Red Hat Open Source and Standards (OSAS) : @redhatopen
@quaid gpg: AD0E0C41

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 198 bytes
Desc: OpenPGP digital signature
URL: <http://lists.centos.org/pipermail/centos-devel/attachments/20170808/73b07d7c/attachment-0008.sig>