RE: ECCN " SHELL AND BASH SCRIPTING LANGUAGES" Request

Hi Martin,

Thank you for your analysis and detailed explanation. I will take your comm=
ents into consideration as part of our ECCN determination process.

To clarify, we do not intend to sell, export, or transfer this software out=
side the United States. The product is currently located in the U.S. and wi=
ll be used exclusively within the U.S. Our review is strictly for internal =
trade compliance purposes to confirm whether the software is controlled und=
er the EAR and whether it incorporates encryption functionality that could =
require additional review.

We appreciate your insights regarding the potential EAR exemption and the o=
pen-source nature of Bash. Your feedback is very helpful in our assessment.


Thank you again for your time and support.


Best regards,

Carmen Rubio


From: Martin D Kealey <[email protected]>
Sent: Thursday, July 2, 2026 1:04 AM
To: Carmen Rubio (CW) <[email protected]>
Cc: Eduardo Bustamante <[email protected]>; bug-bash <[email protected]>; Ab=
raham Reynoso (CW) <[email protected]>
Subject: Re: ECCN " SHELL AND BASH SCRIPTING LANGUAGES" Request

You don't often get email from [email protected]<mailto:martin@kuraha=
upo.gen.nz>. Learn why this is important<https://aka.ms/LearnAboutSenderIde=
ntification>

Caution: External Email

I admit I had to ask around to find out what "ECCN" might mean. If by "ECCN=
" you mean an Export Control Classification Number<https://www.trade.gov/ho=
w-do-i-determine-my-export-control-classification-number-eccn>, then I beli=
eve (*1) that Bash is exempt.

Are you in the US? Are you planning to sell Bash to customers who are Parti=
es of Concern, or who are domiciled in Embargoed Countries? If so:

  *   Why can't you self-certify? (*2)
  *   Please make sure you have a plan to meet your licensing obligations u=
nder the GNU General Public Licence.
If not, then why do you believe you need an ECCN?

I believe Bash is not subject to EAR for 3 reasons:

  *   Firstly, Bash is a general-purpose software-only product, which one m=
ight tentatively categorise as EAR99.
The ECCN categories that apply to software are for software that controls o=
r designs some specific mechanism, and Bash by its general-purpose nature d=
oes not qualify for any of these.
The only categories needing special consideration are 5D002 & 5D992, but Ba=
sh does not implement any secure encryption algorithms.
All of this is obvious simply by reading the source code - you don't need t=
o take my word for it.
  *   Secondly, Bash is already installed in several hundred million device=
s around the world.
  *   Thirdly, Bash is open source, meaning it is strictly exempt under Tit=
le 15 Subtitle B Chapter VII Subchapter C Part 734 =A7734.3(b)(3)<https://w=
ww.ecfr.gov/current/title-15/subtitle-B/chapter-VII/subchapter-C/part-734/s=
ection-734.3> subject to the definition of "published" in =A7734.7(a)(4)<ht=
tps://www.ecfr.gov/current/title-15/subtitle-B/chapter-VII/subchapter-C/par=
t-734/section-734.7>.
Since Bash is not subject to EAR, it requires no categorisation, not even a=
s EAR99.

-Martin

(*1: I'm just a member of this mailing list; I do not speak for the Free So=
ftware Foundation<https://www.fsf.org/>, I am not a resident or citizen of =
the US, and I am not a lawyer. You should carefully read title Title 15 Sub=
title B Chapter VII Subchapter C Part 734 =A7734.3(b)(3)<https://www.ecfr.g=
ov/current/title-15/subtitle-B/chapter-VII/subchapter-C/part-734/section-73=
4.3> and =A7734.7(a)(4)<https://www.ecfr.gov/current/title-15/subtitle-B/ch=
apter-VII/subchapter-C/part-734/section-734.7> for yourself, and if you sti=
ll have any doubts, you can contact the Export Counselling Division of the =
Office of Exporter Services at [email protected]<mailto:[email protected]=
ov> who will be able to confirm (or maybe deny) what I've suggested here.)

(*2: It is the exporter's responsibility to provide an ECCN, not the softwa=
re "vendor"; in particular the Free Software Foundation has no obligation i=
n respect of other people's export activities. I'm answering this question =
only because trade.gov<https://www.trade.gov/how-do-i-determine-my-export-c=
ontrol-classification-number-eccn> is rather messed up at the moment: many =
internal links get redirected to bis.gov<http://www.bis.gov/>, and then its=
 onward links fail to load. That obviously makes it difficult to do your ow=
n research, but please be aware that you're asking a non-profit volunteer g=
roup (*3) to do legal leg-work without any recompense.)

(*3:  the description "non-profit volunteer group" applies both to this mai=
ling list and to the Free Software Foundation which owns the copyright in B=
ash.)

CONFIDENTIALITY NOTICE: This email and any files attached may contain confi=
dential information and may be restricted from disclosure by corporate conf=
identiality guidelines, or applicable state and federal law. It is intended=
 solely for the use of the person or entity to whom the email was addressed=
. If you are not the intended recipient of this message, be advised that an=
y dissemination, distribution, or use of the contents of this message is st=
rictly prohibited. Please delete this email from your system if you are not=
 the intended recipient.