Subject: Re: xntp: Is it an `export' version?

From: [email-masked] (Andrew Howell)
Date: Tue, 2 Jul 1996 14:24:34 +0800 (WST)

Kazuhiro Sasayama writes:
> 
> >>>>> "Andrew" == Andrew Howell <[email-masked]> writes:
> 
>     Andrew> I hadn't really noticed the export version before. It's
>     Andrew> cause of the DES code isn't it? Does this mean I need to package
>     Andrew> the normal version and the export version?
> 
> Yes, it is the DES code that I'm concerned about.  It might be OK if
> the DES code could be replaced with any non-US one and if the package
> could be available primarily at any ftp site outside the US.

Well I guess I'll just package the xntp export version from now on. I
can't package the normal version myself as I'm not in the US. Someone
else will have to do that if it's wanted.

Andrew

-- 
Of course...lager...the only thing that can kill a vindaloo.
     -- Lister, fighting the vindaloo monster in Red Dwarf `DNA'

Andrew Howell				      [email-masked]
Perth, Western Australia	     [email-masked] [email-masked]

---

From: Michael Shields <[email-masked]>
Date: Tue, 2 Jul 1996 15:14:28 +0000

>else will have to do that if it's wanted.

No, since you are outside the US, you have more freedom than a US
maintainer.  You can package up the full version, and it can then be
imported into the US, giving the entire world access to it.

There are really three categories of packages:

1. Packages free of "munitions", to be found on any normal Debian mirror.
These are mastered on master.debian.org and distributed to all the other
sites through the existing mirror infrastructure.

2. Packages with crypto that have maintainers in the US.  These will have
to be mastered on a US-only Debian archive site, which I can donate
resources for.

3. Packages with crypto that have maintainers outside the US.  Mirrors in
the US can legally carry these packages but may not want to deal with the
hassle.  Mirrors outside the US can carry these packages but will not be
able to get them through the existing mirror infrastructure (since
master.debian.org is in the US).  These will have to be mastered on a site
outside the US.

I think what will need to be done is to create `crypto' and `crypto-us'
trees.  Proper configuration of mirror(1) will let a US site carry all
trees seemlessly, if they choose.

It seems that the crypto and packages ought to be available in both stable
and unstable versions, but this is a seperate issue that also applies to
the non-free tree.

--
Shields, CrossLink.

---

From: Marek Michalkiewicz <[email-masked]>
Date: Tue, 2 Jul 1996 19:35:28 +0200 (MET DST)

> else will have to do that if it's wanted.

If you are not in the US, what is the problem?  You can get the full
non-export version (without even exporting it from the US) from

ftp://ftp.funet.fi/pub/mirrors/louie.udel.edu/

We already have DES encryption code in every copy of libc anyway :-).

Regards,

Marek

---

From: [email-masked] (Andrew Howell)
Date: Wed, 3 Jul 1996 10:10:08 +0800 (WST)

> ftp://ftp.funet.fi/pub/mirrors/louie.udel.edu/

Ah not a problem then :) I really hate all this legal bullshit

Andrew

---

From: [email-masked] (Andrew Howell)
Date: Wed, 3 Jul 1996 10:18:13 +0800 (WST)

> and unstable versions, but this is a seperate issue that also applies to

So should the xntp package be moved into the non-free tree like pgp?

Should we be excluding the pgp-us package from our mirrors at present
and the xntp package as well I guess?

Who's willing to run the non-US site? My site is a little limited in
bandwidth so it would probably be better for someone else to do it.

Andrew

---

From: Dominik Kubla <[email-masked]>
Date: Wed, 03 Jul 1996 19:34:53 +0200

> imported into the US, giving the entire world access to it.

Nope: You may not "re-export" any of those packages!  We discussed
that before and this is the reason why my crypto-stuff is not being
uploaded to master.debian.org, but ftp.uni-mainz.de.

Ciao,
  Dominik

---

From: Michael Shields <[email-masked]>
Date: Wed, 3 Jul 1996 17:53:18 +0000

>uploaded to master.debian.org, but ftp.uni-mainz.de.

What I meant was that anyone would have access to it, through one means or
another.

A US-only site is needed for developers in the US to be able to make their
packages available.  These packages cannot legally be exported, but at
least they could be made available for Debian users within the US and
Canada.  Kerberos is a notable example of a suite that is developed and
packaged in the US, but currently has nowhere to be made available.

An overseas site is needed so that developers outside the US can upload
their packages somewhere that all mirrors can download it.  They can
legally put it on master, but master will not be able to legally send it
out to the other mirrors.

Does this make sense?

--
Shields, CrossLink.

---

From: Dominik Kubla <[email-masked]>
Date: Wed, 03 Jul 1996 20:11:38 +0200

>>>>> Michael Shields writes:

[...explanation deleted...]

> Does this make sense?

Ahm ... yes it does.

Dominik