[lsb-discuss] LSB conf call notes for 2008-05-21

[Jeff Licquia]

Attendees: Jeff Licquia, Ron Hale-Evans, Carlos Duclos (TrollTech), 
Thiago Macieira (TrollTech), Stew Benedict, Kay Tate, George Kraft, 
Marvin Heffler, Mats Wichmann, Alexey Khoroshilov, Darren Davis, Alan 
Clark, Ted Tso.

3.2 refresh status.  Jeff: repositories and bundles created for all 
architectures except s390, due to a glitch in the builders; s390 in 
progress.  Those with an inclination are encouraged to test.  Everything 
is in the "beta" subdirectories on the FTP site; will be moved to the 
release areas soon.

SI status.  Fix for su bug in progress; s390 and s390x issues still 
outstanding.

NSS and legal issues.  Carlos: Thiago Maceiera is a developer on crypto 
issues for TrollTech.  TrollTech is concerned about linking with 
US-created crypto code.  Thiago: Qt does not expose any details of 
OpenSSL.  Provide own API.  Only implementation is OpenSSL.  Dynamically 
load OpenSSL as needed, so no direct link to it.  Only used when 
encryption is needed.  Only support encrypted sockets; no advanced 
features from OpenSSL.  Can technically write a different implementation 
that is based on something else.

Jeff: summary of NSS crypto legal discussion on list.  Thiago: the 
underlying implementation is not exposed at all.  Decision to use Qt's 
SSL code in the LSB is not related to NSS use in the LSB at all.  Not 
willing to port to NSS at this time.  Ted: not really our problem.

Thiago: as to whether LSB should support NSS, not really their issue, 
but LSB should think carefully about the legal issues.  Ted: most 
companies assume that they have to deal with the US Commerce Department 
if they do any crypto at all, however they do it.  If TrollTech has an 
ISV that feels otherwise, we'd like to hear from them.  Carlos: using US 
code seems to put people under US jurisdiction.  Ted: dispute about 
that, but not something we can solve here.  TrollTech may be more 
sensitive about this, as a toolkit; don't want to introduce a crypto dep 
for apps that don't use crypto.  This doesn't apply to NSS, since you 
definitely ship it or link to it.

Jeff: can Qt apps use NSS directly?  Thiago: yes, should work. for 
whatever reason they would want to do that.

Jeff: Qt 4.3 issues with LSB 4.  Thiago: should be orthogonal.  When Qt 
4.3 gets integrated, the SSL symbols should land.

Ted: what's the advantage to QtSSL?  Thiago: integration with the rest 
of Qt.  Could not use QtNetwork socket support with NSS or something else.

Thiago: GNU TLS?  Jeff: not enough resources, rigor, etc.  Ted: they 
don't in fact have the resources.  Carlos: and OpenSSL can't do the API 
compatibility thing?  Ted: yes.  NSS is interesting because they do have 
a stable ABI and support.

Mats: Qt3Support?  Carlos: we seemed to reach consensus on the list. 
Qt3Support is a library that mimics Qt 3, is a porting aid to Qt 4. 
Some of those interfaces got into LSB 3.2, but incomplete.  Should we 
keep them, or not?  Consensus seemed to be to do a correct import for 
LSB 4, drop them for 3.2.  Jeff: Mats's objection: maybe shouldn't drop 
in 3.2 if we're adding them back in for 4.0.  Mats: not a big deal. 
Jeff: will add the bugs, project pages, etc. so the task isn't dropped.

Jeff: bug ballot.  Could we use Bugzilla voting?  Mats: a little bit of 
a pain, some setup required.  Should probably just be diligent in 
triage.  Jeff: Friday as Bug Day again?  Ted: IRC-only, maybe every 
other week on the call.  Alan: time?  Discussion, Friday may be bad. 
Thursday, starting at 8 am Pacific time, is better.  Ron: Google 
Calendar?  Jeff will do it.  Next bug day will be tommorow, IRC-only; 
discussion will start at 8 am US Pacific, 11 am USEastern.