Bug 1126

Causing lost time and effort for people, who can't have their authentication
secure.


From:
http://freedesktop.org/pipermail/release-wranglers/2004-August/000884.html

I've put in the mail the crypto letters required by the U.S. Government
for exporting cryptography, for xdm, as a member of X.org's BOD.
I notified them both of ftp.x.org and www.freedesktop.org, since we do
our development on fd.o and often release software there as well (not to
mention the CVS repository).

See: http://www.debian.org/legal/cryptoinmain for lots of useful
information and the legal opinion given to the Debian project. I've
gotten the same information internally in HP that matches the opinion
that Debian paid to have done.  Note that this situation is for open
source work; if you work for a company that does products containing
crypto, you still have to follow the commercial rules on the topic.

For this X.org release:
  1) we need to commit the wraphelp.c file of whatever version is
appropriate for xdm.
  2) Notification is needed.
	o We need to add the notice below to the website 
	o with our release itself in the FTP directory. 
	o I'd put it in the top of any tarball we generate that 
	contains crypto.
	o I'd also add it to a readme file next to wraphelp.c just to
	 be complete,
	o have a pointer from any fd.o project containing crypto 
	to the notice.
I think that will cover all the bases.

For the future: if we add *additional* programs/libraries to the
distribution/web site/archive, we are supposed to draft and send in new
letters the first time we distribute them.  See the above link for
details.

Note that this is true for freedesktop.org as well; letters should be
sent in whenever new crypto appears.  The letters are reasonably
painless to deal with.

We do not have to notify for every release or change, nor do we have to
wait until we hear from the government having sent in the letters. 
Binaries compiled from the source can also be redistributed freely.

If the notice is put into the wiki, it should be locked somehow so that
it can't be trivially changed, I suspect.

And if you think this is a bit silly, you aren't alone.  But at least we
can integrate/export the code and binaries these days without too much
trouble.