Intel permission to use Intel confidential data in the Arch dependency about loggregator-release

[cf-gitbot]

We have created an issue in Pivotal Tracker to manage this:

https://www.pivotaltracker.com/story/show/166062614

The labels on this github issue will be updated when the story is started.

[MasslessParticle]

Hi there,

Thanks for the heads up on this. Looking through the source code, I don't see any reference go golang/arch. It's not in our src directory and grep isn't turning up anything either.

Would you mind linking to the dependency? Thanks!

[luisapace]

Hi Travis, thanks a lot for your quick follow-up. From the data I have, Arch is coming from the file: loggregator-release-v102.0/loggregator-release/blobs/golang/go1.9.4.linux-amd64/go/src/cmd/internal/objfile/disasm.go I've asked Michele (our technical specialist, here in .cc) to do some verifications; MIchele, could you please verify and add any other details in the #392 ? Thanks. Best Regards/Cordiali saluti Luisa Pace Ing. Luisa Pace IBM Italy IBM Cloud Legal Project Manager Via Luigi Stipa, 150 - 00148 ROMA - ITALY Mob. [phone] e-mail: [email protected] From: Travis Patterson <[email protected]> To: cloudfoundry/loggregator-release <[email protected]> Cc: luisapace <[email protected]>, Author <[email protected]> Date: 16/05/2019 19.38 Subject: Re: [cloudfoundry/loggregator-release] Intel permission to use Intel confidential data in the Arch dependency (#392) Hi there, Thanks for the heads up on this. Looking through the source code, I don't see any reference go golang/arch. It's not in our src directory and grep isn't turning up anything either. Would you mind linking to the dependency? Thanks! ? You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub, or mute the thread. IBM Italia S.p.A. Sede Legale: Circonvallazione Idroscalo - 20090 Segrate (MI) Cap. Soc. euro 347.256.998,80 C. F. e Reg. Imprese MI 01442240030 - Partita IVA 10914660153 Societa' con unico azionista Societa' soggetta all'attivita' di direzione e coordinamento di International Business Machines Corporation (Salvo che sia diversamente indicato sopra / Unless stated otherwise above)

[mlicursi]

Let me explain shortly how we get to that .

The all-dec-instructions.txt which contains the INTEL CONFIDENTIAL label comes from this chain:

1. loggregator references golang/go1.9.4.linux-amd64.tar.gz in blobs.yml

2. running the following commands you get the blob:
   git clone https://github.com/cloudfoundry/loggregator-release
   git checkout tags/v102.0
   git submodule update --recursive --init
   bosh sync-blobs

3. un-tarring the go1.9.4.linux-amd64.tar.gz you get ./loggregator-release-v102.0/loggregator-release/blobs/golang/go1.9.4.linux-amd64/go/src/cmd/internal/objfile/disasm.go

4. in disasm.go there is the import "golang.org/x/arch/x86/x86asm"

5. cloning it with
   git clone ssh://[email protected]/golang/arch
   you obtain the sources that include ./x86/x86avxgen/testdata/xedpath/all-dec-instructions.txt

So the issue seems with arch package that is an external dependency of go1.9.4.linux-amd64 rather than loggregator code itself

[MasslessParticle]

Hello @mlicursi @luisapace

We've looked into this and discovered a couple of things. The library you found is only linked and distributed when built against ARM architecture. We're shipping source rather than binaries and we don't compile against ARM. As a result, we're not distributing any proprietary code.

[erdmenger]

@luisapace @mlicursi +1 to the statement from @MasslessParticle above.
We're not distributing any proprietary code, as we don't compile against ARM architecture either.