An issue was recently raised on https://forums.centos.org/viewtopic.php?f=47&t=78866 asking if changes would be made to https://www.centos.org/legal/ to comply with recent changes to US export regulations as per http://www.federalregister.gov/documents/2022/03/03/2022-04300/implementation-of-sanctions-against-russia-under-the-export-administration-regulations-ear
I would suggest that this issue be revisited by the board and the position clarified. I would like to see changes made to the mirrorlist/mirrormanager set up to stop users from Russia being pointed to valid mirrors. I'd also suggest that the top level mirror network deny connections from ip addresses geo-located in Russia to stop current mirrors from getting new updates. Yes, I realise that the mirror maintainers in Russia could point to other mirrors other than the directly CentOS controlled ones but we could also issue a notice on the mirror communication channels asking other mirror maintainers to also restrict access.
I do not consider the current CentOS reponse to this to be adequate and I would like the board to make changes to better reflect US export regulations ASAP.
The response I gave is from Red Hat's export compliance team, and reflects only what Red Hat believes we are obligated to do. If the board would like to take further action, I can talk to legal and infra folks to see what's possible.
I will add this to the agenda for the next Board meeting. I think it's important to discuss on a few different levels, legal and Code of Conduct wise among them.
This issue was discussed during the April board meeting. At this time, the CentOS board decided to take no action based on the legal assessment and the belief that removing access to the CentOS community would have little impact. If there are any issues within the Community itself any reports made will be addressed via the Code of Conduct.
Metadata Update from @spotz: - Issue status updated to: Closed (was: Open)
Log in to comment on this ticket.