[bug-gnulib] Re: Crypto modules

[Simon Josefsson]

Bruno Haible <address@hidden> writes:

> Simon Josefsson wrote:
>> Savannah has a FAQ regarding crypto code:
>> https://savannah.gnu.org/faq/?question=Is_there_any_restriction_on_cryptographic_software.txt
>>  I'm not sure how problematic the code would be in
>> practice.
>>
>> What do you think of this?
>
> When you look at "License Exception: TSU" in
>   http://www.bxa.doc.gov/Encryption/lechart1_Sec508.htm
> you see that code under this regulation must not be copied from the US to
> Iran and a few other countries. Furthermore the US government can add other
> countries to this list arbitrarily.
>
> It is illogical to work on free software, and promote it with the argument
> "it's good for poor countries, because they can deploy it widely without
> needing to pay royalties to anyone", while at the same time refusing to
> let Iranian people in Iran use it.

I agree.

> Since the code you are talking about originates from a non-US site
> (http://www.lysator.liu.se/~nisse/nettle, as you pointed out), and since
> from your name I guess you are in a European country, not in the US,
> the code is currently not subject to US Export regulations, but would
> be if you put it into a CVS server located in the US.
>
> Therefore I would suggest to put it into a CVS server outside the US.
> Of course you are welcome to use the same structure as gnulib, or
> maybe even make it an extension of gnulib.

Perhaps I should rename lessergnulib to gneulib. ;-)

> For the choice of the facility, maybe you can ask the FSF Europe
> (fsfeurope.org) or Werner Koch (he certainly knows about these issues
> since he works on GPG from Germany).

I recall discussing this with Werner some time ago, but I don't recall
the resolution.  I have removed all my projects from Savannah, though,
so I suspect the crypto issue was one argument.

OTOH, I recall adding some encryption code to Emacs, which is also
hosted on Savannah.  I think RMS objected initially, but later changed
his mind.  I didn't participate in the discussion to change his mind,
though, so I don't know the details...

Better safe than sorry, though, so I'll revive lessergnulib.
Supporting more than one gnulib repository in gnulib-tool --import is
another thing that would be nice...

Thanks.