Is VIPerl export controlled?

[znmeb]

The Windows version of the VI Perl Toolkit contains ActiveState Perl and some packages from CPAN. Some of the ActiveState products contain crypto technology. They are export-controlled and can only be sent to the US and Canada. Is that the case for the VI Perl Toolkit?

[Texiwill]

Hello,

Moved to the Developers forum Management APIs (VI Perl, VI SDK, CIM SDK)

Note that the VIPerl Appliance may be export controlled. However, you can have the users download and install from the VMware Site the perl modules for their version of perl. You need to also find out if you can 'ship' the perl modules independently.

Best regards,

Edward L. Haletky

VMware Communities User Moderator

====

Author of the book 'VMWare ESX Server in the Enterprise: Planning and Securing Virtualization Servers', Copyright 2008 Pearson Education.

CIO Virtualization Blog: http://www.cio.com/blog/index/topic/168354

As well as the Virtualization Wiki at http://www.astroarch.com/wiki/index.php/Virtualization

[znmeb]

This isn't the "appliance" -- it's the Windows installer at http://www.vmware.com/downloads/download.do?downloadGroup=VI-PT-U2. VI Perl Toolkit - Windows Installer (.exe)

Installer for Microsoft Windows includes ActiveState Perl (Please see the release notes for supported versions)

I don't see anything in the EULA about export controls for any of the versions. But I'm only interested in the ActiveState version at the moment.

[Texiwill]

Hello,

If ActiveState has controls then yes you are bound by them. I also think including ActiveState may be an issue with VI Perl for windows. But they could also have removed the encryption modules as well. I would fall back on what ActiveState says.

Best regards,

Edward L. Haletky

VMware Communities User Moderator

====

Author of the book 'VMWare ESX Server in the Enterprise: Planning and Securing Virtualization Servers', Copyright 2008 Pearson Education.

CIO Virtualization Blog: http://www.cio.com/blog/index/topic/168354

As well as the Virtualization Wiki at http://www.astroarch.com/wiki/index.php/Virtualization

[znmeb]

I just spent about 20 minutes on the ActiveState site. I couldn't find anything on export controls for ActivePerl. What's worse, I know Komodo used to be export controlled, but I can't find anything on that either now! I guess I need to go ask questions on their forum again.

[znmeb]

Well ... according to the FAQ, there may be a problem with VIPerl but not with ActiveState Perl itself:

http://aspn.activestate.com/ASPN/docs/ActivePerl/5.8/faq/ActivePerl-faq2.html

In the PPM section, the following appears:

Cryptographic Packages Unlike the United States, the Export Control List of Canada places no significant restriction on the export of cryptographic software; however, the Canadian Federal Government does require that companies, organizations or individuals that wish to distribute cryptographic software get a permit in order to do so. ActiveState does not currently have this permission, so you must currently access other repositories for the following modules:

Crypt-Blowfish, Crypt-Blowfish_PP

Crypt-CAST5, Crypt-CAST5_PP

Crypt-DH

Crypt-DSA, Crypt-RSA

Crypt-GPG

Crypt-GOST, Crypt-GOST_PP

Crypt-IDEA

Crypt-OpenPGP, Crypt-PGP2, Crypt-PGP5, Crypt-PGPSimple

Crypt-OpenSSL-DSA, Crypt-OpenSSL-RSA, Crypt-OpenSSL-SMIME

Crypt-RC4, Crypt-RC5, Crypt-RC6

Crypt-RIPEMD160

Crypt-Rijndael, Crypt-Rijndael_PP

Crypt-Serpent

Crypt-Twofish, Crypt-Twofish2, TwoFish

Crypt-SSLeay, Net_SSLeay

IIRC Net_SSLeay is bundled in the kit, so there may be an issue. As the saying goes, I am not a lawyer.

[admin]

The Windows version of the VI Perl Toolkit contains ActiveState Perl and some packages from CPAN. Some of the ActiveState products contain crypto technology. They are export-controlled and can only be sent to the US and Canada. Is that the case for the VI Perl Toolkit?

The VI Perl Toolkit license doesn't allow redistribution by 3rd parties, based on the licenses all users, regardless of location, would have to download it from VMware.

[Texiwill]

Hello,

Thank you for clarifying. However, should it not allow for redistribution given that there are now third party tools being written using it? That way they can keep to a specific version of the toolkit and not always get the latest?

Best regards,

Edward L. Haletky

VMware Communities User Moderator

====

Author of the book 'VMWare ESX Server in the Enterprise: Planning and Securing Virtualization Servers', Copyright 2008 Pearson Education.

CIO Virtualization Blog: http://www.cio.com/blog/index/topic/168354

As well as the Virtualization Wiki at http://www.astroarch.com/wiki/index.php/Virtualization

[znmeb]

Also, wasn't the VIPerl Toolkit originally hosted on SourceForge and licensed GPL? The 1.5 release had a source tarball available, but the 1.6 release doesn't.

[admin]

The original VI Perl toolkit was (and is in fact) on sourceforge, licensed under something called the "common development and distribution license".

True, 1.6 doesn't have a source tarball. You can get the source from within the Linux package, I believe the files under lib/VMware are the ones you want.