UIMA is currently not classified as 5D002 software
(a classification for software, requiring "notification" due to issues
around crypto).
To keep this status, we have to
a) avoid including any 5D002 software in any distribution we do, and
b) avoid using interfaces for 5D002 components (that we do not
include in our distributions) that are specially designed
to access crypto functionality in these components
The page http://www.apache.org/licenses/exports
<http://www.apache.org/licenses/exports>
lists Apache distributed software that is classified as 5D002
(note: for APR, only APR-Util- "development" version).
ActiveMq and Derby are on the list.
In the proposed UIMA extension for asynchronous
scaleout, we use, but do not distribute, ActiveMq 4.1,
which, in turn, includes Derby.
In UIMA-CPP, we use APR, and
we distribute it. I think we don't use APR-Util (Eddie, please
confirm), which is 5D002 software.
If we include in our distribution any component
that is classified as 5D002 then
UIMA becomes 5D002, as well.
Additionally, even if we don't distribute these components,
if our UIMA software uses interfaces for these components
that are specially designed to access crypto functionality in
these components, then UIMA becomes 5D002 and
we need to follow the procedures
outlined in http://www.apache.org/dev/crypto.html.
-Marshall
