Crypto Compliance Review · License & Export Analysis

Status: IN REVIEW (legal sign-off pending) Date: 2026-01-20 Owners: Security Guild, Legal Unblocks: RU-CRYPTO-VAL-05, RU-CRYPTO-VAL-06

Overview

This document captures the licensing, export controls, and distribution guidance for cryptographic components in StellaOps, specifically:

1. GostCryptography Fork (src/__Libraries/StellaOps.Cryptography.Plugin.CryptoPro/third_party/AlexMAS.GostCryptography)
2. CryptoPro Plugin (StellaOps.Cryptography.Plugin.CryptoPro)
3. Regional Crypto Providers (GOST, SM2/SM3, eIDAS)

1. GostCryptography Fork

1.1 License

1.2 Attribution Requirements

The MIT license requires attribution in distributed software:

Copyright (c) 2014-2024 AlexMAS
See src/__Libraries/StellaOps.Cryptography.Plugin.CryptoPro/third_party/AlexMAS.GostCryptography/LICENSE

Required Actions:

• [x] Keep LICENSE file in fork directory
• [ ] Add attribution to NOTICE.md in repository root
• [ ] Include attribution in RootPack_RU bundle documentation

1.3 Distribution Guidance

2. CryptoPro CSP Plugin

2.1 License

2.2 Distribution Model

CryptoPro CSP is not redistributable by StellaOps. The distribution model is:

┌─────────────────────────────────────────────────────────────────┐
│                        Distribution Model                        │
├─────────────────────────────────────────────────────────────────┤
│                                                                  │
│  StellaOps ships:                                               │
│  ├── Plugin source code (BUSL-1.1)                           │
│  ├── Interface bindings to CryptoPro CSP                        │
│  └── Documentation for customer-provided CSP installation       │
│                                                                  │
│  Customer provides:                                              │
│  ├── CryptoPro CSP license                                      │
│  ├── CSP binaries installed on target system                    │
│  └── PKCS#11 module path configuration                          │
│                                                                  │
└─────────────────────────────────────────────────────────────────┘

2.3 Configuration for Customer-Provided CSP

# etc/authority.yaml - Customer configures CSP path
crypto:
  pkcs11:
    library_path: /opt/cprocsp/lib/amd64/libcapi20.so  # Customer-provided
    slot_id: 0
    pin_env: AUTHORITY_HSM_PIN

2.4 Documentation Requirements

• [x] Document that CSP is “customer-provided” in installation guide
• [x] Add EULA notice that CSP licensing is customer responsibility
• [x] Include CSP version compatibility matrix (CSP 4.0/5.0)
• [x] Provide license acceptance/test procedure for Linux CSP service and Windows runners

2.5 License Acceptance & Validation (customer-provided CSP)

Linux (native CSP, headless)

1. Place vendor .tgz/.deb bundles under <repo>/opt/cryptopro/downloads (mounted read-only into /opt/cryptopro/downloads).
2. Set CRYPTOPRO_ACCEPT_EULA=1 only if you hold a valid license and agree to the vendor terms.
3. Mount CSP packages under /opt/cryptopro/downloads; the Linux CSP wrapper installs only those local .deb files when CRYPTOPRO_ACCEPT_EULA=1.
4. Build the HTTP wrapper with the same EULA flag:

   docker build -t cryptopro-linux-csp \
     --build-arg CRYPTOPRO_ACCEPT_EULA=1 \
     -f devops/services/cryptopro/linux-csp-service/Dockerfile .
   docker run --rm -p 18080:8080 cryptopro-linux-csp
   

5. Validate license/keyset with the wrapper endpoints (fail closed if unlicensed):
   • GET /health (requires EULA accepted, customer packages mounted, and csptest present)
   • GET /license (mirrors csptest -keyset -info; surfaces license/keyset errors)
   • POST /keyset/init (optional; requires CRYPTOPRO_ALLOW_KEYSET_INIT=1)

Windows (native CSP)

1. Install licensed CryptoPro CSP on the runner/host.
2. Accept the EULA during installation; ensure the license is activated per vendor tooling (csptest -license -view).
3. Set STELLAOPS_CRYPTO_PRO_ENABLED=1 and configure StellaOps:Crypto:CryptoPro:Keys with certificate handle/thumbprint.
4. Run the guarded tests: ./ops/crypto/run-cryptopro-tests.ps1 (skips when the env flag or CSP is missing). No Windows HTTP wrapper/Wine path is shipped; only native CSP on Windows, and the Linux CSP service uses customer-provided .deb binaries.
5. Capture test output + csptest -keyset -info in sprint evidence for RU-CRYPTO-VAL-04/06 closure.

EULA reminder: StellaOps never distributes CSP binaries or license keys; operators must provide and accept the vendor EULA explicitly via the flags above. If licensing review is deferred, note explicitly in sprint records that licensing remains customer responsibility.

3. Export Control Analysis

3.1 Applicable Regulations

3.2 Algorithm Classification

3.3 GOST Algorithm Guidance

GOST algorithms (GOST R 34.10-2012, GOST R 34.11-2012) are:

• Not export-controlled from Russia when used in commercial software
• May be restricted for import into certain jurisdictions
• Recommended for use only in RootPack_RU deployments targeting Russian customers

Guidance:

1. Default StellaOps distribution does NOT include GOST algorithms enabled
2. RootPack_RU is a separate distribution with GOST opt-in
3. Document that customers are responsible for compliance with local crypto regulations

3.4 Distribution Matrix

4. EULA and Notice Requirements

4.1 NOTICE.md Addition

Add to repository NOTICE.md:

## Third-Party Cryptographic Components

### GostCryptography (MIT License)
Copyright (c) 2014-2024 AlexMAS
https://github.com/AlexMAS/GostCryptography

This software includes a forked version of the GostCryptography library
for GOST algorithm support. The fork is located at:
third_party/forks/AlexMAS.GostCryptography/

### CryptoPro CSP Integration
The CryptoPro CSP plugin provides integration with CryptoPro CSP software.
CryptoPro CSP is commercial software and must be licensed separately by
the end user. StellaOps does not distribute CryptoPro CSP binaries.

4.2 Installation Guide Addition

Add to installation documentation:

## Regional Crypto Support (Optional)

### Russian Federation (RootPack_RU)

StellaOps supports GOST R 34.10-2012 signing through integration with
CryptoPro CSP. This integration requires:

1. A valid CryptoPro CSP license (obtained separately from crypto-pro.ru)
2. CryptoPro CSP 4.0 or 5.0 installed on the target system
3. Configuration of the PKCS#11 module path

**Note:** CryptoPro CSP is commercial software. StellaOps provides only
the integration plugin; the CSP runtime must be licensed and installed
by the customer.

5. CI/Testing Implications

5.1 Test Environment Requirements

5.2 CI Guard Implementation

Tests are guarded by environment variable:

[Fact]
[SkipUnless("STELLAOPS_CRYPTO_PRO_ENABLED", "1")]
public async Task CryptoProSigner_SignsWithGost()
{
    // Test only runs when CSP is available and licensed
}

5.3 Wine Loader Experiment (RU-CRYPTO-VAL-05)

Status: BLOCKED pending legal review

Running CryptoPro CSP DLLs under Wine for cross-platform testing:

Decision: Do not pursue Wine loader approach until/unless CryptoPro explicitly permits this use case in their EULA.

6. Action Items

Immediate (unblocks RU-CRYPTO-VAL-06)

• [x] Document fork licensing (MIT) ← This document
• [x] Document CryptoPro distribution model ← This document
• [x] Add attribution to NOTICE.md
• [x] Update installation guide with CSP requirements and license acceptance steps
• [x] Document CSP license validation flow (Linux wrapper + Windows runner)

Short-term

• [ ] Review CryptoPro EULA for Wine usage (if needed)
• [ ] Create regional distribution manifests for RootPack_RU
• [ ] Add compliance checkboxes to RootPack_RU installation

For Legal Sign-off

• [ ] Confirm MIT + BUSL-1.1 compatibility statement
• [ ] Confirm customer-provided model for CSP is acceptable
• [ ] Review export control applicability for GOST distribution

7. Sign-off Log

Document Version: 1.0.1 Last Updated: 2026-01-20