Common use of DEFINITION OF THE SERVICE PROVIDED Clause in Contracts

DEFINITION OF THE SERVICE PROVIDED. The money collected from the Customer by FREEXIAN SARL is converted into work hours according to the rate of 85 EUR per work hour. Those work hours are then distributed to “Paid Debian Contributors” (PDC) who will provide security updates for Debian releases which are no longer maintained by Debian’s official security team. Those security updates will be made available to the Customer through the repositories of the Debian LTS team (xxxxx://xxxx.xxxxxx.xxx/LTS). XXXXXXXX XXXX ensures of the reality of the work done by PDC by reviewing the public monthly report that they have to provide. FREEXIAN SARL ensures that PDC prioritize packages used by the Customer. The work assignment mechanism provides a list of packages sorted by the amount of associated sponsorship (summed across all Debian LTS sponsors). The most popular packages among Debian LTS sponsors will thus be handled first. FREEXIAN SARL does not guarantee that all security issues will be fixed. Each issue will be reviewed and triaged by the PDC, some may be classified as not worthy of being fixed. Some might not be fixable at all, in which cases the security announce will try to provide mitigation techniques. FREEXIAN SARL does not guarantee any timeline for the publication of a security fix. There are too many factors that can delay the release of a security fix (availability of an upstream patch, requirement to backport said patch, lack of sponsored time for a low-priority package, availability of a PDC with the required skills, etc.). The Customer recognizes that this contract is a best-effort contract. FREEXIAN SARL and the PDC will do their best to collectively serve the Debian LTS sponsors by providing timely security updates for the packages that they are using. The Customer acknowledges that the list of packages covered by security support evolves over time. The “debian- security-support” package contains the list of packages excluded from security support and can be updated following the usual Debian procedures.

DEFINITION OF THE SERVICE PROVIDED. The money collected from the Customer by FREEXIAN SARL is converted into work hours according to the rate of 85 EUR per work hourhours. Those work hours are then distributed to “Paid Debian Contributors” (PDC) who will provide security updates for Debian releases which are no longer maintained by Debian’s official security team. Those security updates will be made available to the Customer through the repositories of the Debian LTS team (xxxxx://xxxx.xxxxxx.xxx/LTS). XXXXXXXX XXXX ensures of the reality of the work done by PDC by reviewing the public monthly report that they have to provide. FREEXIAN SARL ensures that PDC prioritize packages used by the Customer. The work assignment mechanism provides a list of packages sorted by the amount of associated sponsorship (summed across all Debian LTS sponsors). The most popular packages among Debian LTS sponsors will thus be handled first. FREEXIAN SARL does not guarantee that all security issues will be fixed. Each issue will be reviewed and triaged by the PDC, some may be classified as not worthy of being fixed. Some might not be fixable at all, in which cases the security announce will try to provide mitigation techniques. FREEXIAN SARL does not guarantee any timeline for the publication of a security fix. There are too many factors that can delay the release of a security fix (availability of an upstream patch, requirement to backport said patch, lack of sponsored time for a low-priority package, availability of a PDC with the required skills, etc.). The Customer recognizes that this contract is a best-effort contract. FREEXIAN SARL and the PDC will do their best to collectively serve the Debian LTS sponsors by providing timely security updates for the packages that they are using. The Customer acknowledges that the list of packages covered by security support evolves over time. The “debian- security-support” package contains the list of packages excluded from security support and can be updated following the usual Debian procedures.

DEFINITION OF THE SERVICE PROVIDED. The money collected from Debian releases are supported by the Debian project for 5 years after their publication. Freexian’s Extended Long Term Support (ELTS) enables the Customer to benefit from 5 additional years of security support on a subset of packages of Debian release(s) of their choice. The Customer provides, for each Debian release that they are using, the list of source packages that they are using and that they would like to see supported by FREEXIAN SARL. In return, FREEXIAN SARL provides for each requested Debian release : • the price of the service for the next half-year, as well as expected prices for future periods ; • the list of source packages that FREEXIAN SARL will not support but that were mentioned in the Customer’s package list. The price of the ELTS service is converted into work hours according to based on the rate of 85 EUR per work hour. Those work hours are then distributed to “Paid Debian Contributors” (PDC) who will provide security updates for Debian releases which are no longer maintained package list provided by Debian’s official security team. Those security updates will be made available to the Customer through and based on the repositories estimated work-load generated for the selected packages. The price increases after each half-year period to compensate for the loss of customers which stopped using the given Debian LTS team (xxxxx://xxxx.xxxxxx.xxx/LTS). XXXXXXXX XXXX ensures release and the increased complexity of the reality of the work done by PDC by reviewing the public monthly report that they have to providemaintaining very old software. FREEXIAN SARL ensures that PDC prioritize packages used by will monitor the Customer. The work assignment mechanism provides a list publication of packages sorted by security issues in the amount of associated sponsorship (summed across all Debian LTS sponsors). The most popular packages among Debian LTS sponsors will thus be handled firstCVE database. FREEXIAN SARL does not guarantee that all security issues will be fixed. Each issue will be reviewed and triaged by the PDCtriaged, some may be classified as not worthy of being fixed. Some might not be fixable at allfixable, in which cases the security announce FREEXIAN SARL will try to provide mitigation techniques. The Customer agrees that FREEXIAN SARL may work with sub-contractors to prepare security updates. Security updates will be made available to the Customer through the repositories on infrastructure managed by FREEXIAN SARL. All sub-contractors will be required to execute a non-disclosure agreement, with terms and conditions that align with the Customer/Freexian non-disclosure agreement, prior to having access to Customer’s data, with terms and conditions that align with the confidentiality terms set forth herein. FREEXIAN SARL does not guarantee any timeline for the publication of a security fix. There are too many factors that can delay the release of a security fix (availability of the vulnerability details, availability of an upstream patch, requirement to backport said patch, lack of sponsored time for a low-priority package, availability of a PDC with the required skills, etc.). The Customer recognizes that this contract Contract is a “best-effort effort” contract. FREEXIAN SARL and the PDC will do their its best to collectively serve the Debian LTS sponsors ELTS customers by providing timely security updates for the packages that they are using. The Customer acknowledges that the list of packages covered by security support evolves over time. If FREEXIAN SARL stops supporting a package that was requested by the Customer, this information will be communicated either through a proper security announcement or with a direct email to the Customer’s technical contacts. The “debian- security-support” package contains Customer acknowledges that the list packages maintained by Freexian are the packages which were in the Debian Release. Backports (with the exceptions of those documented on Freexian’s ELTS website) or external packages excluded from security support not included in the Debian release are not supported and can be updated following the usual Debian proceduresare not updated.

DEFINITION OF THE SERVICE PROVIDED. The money collected from Debian releases are supported by the Debian project for 5 years after their publication. Freexian’s Extended Long Term Support (ELTS) enables the Customer to benefit from 5 additional years of security support on a subset of packages of Debian release(s) of their choice. The Customer provides, for each Debian release that they are using, the list of source packages that they are using and that they would like to see supported by FREEXIAN SARL. In return, FREEXIAN SARL provides for each requested Debian release : • the price of the service for the next half-year, as well as expected prices for future periods ; • the list of source packages that FREEXIAN SARL will not support but that were mentioned in the Customer’s package list. The price of the ELTS service is converted into work hours according to based on the rate of 85 EUR per work hour. Those work hours are then distributed to “Paid Debian Contributors” (PDC) who will provide security updates for Debian releases which are no longer maintained package list provided by Debian’s official security team. Those security updates will be made available to the Customer through and based on the repositories estimated work-load generated for the selected packages. The price increases each semester : it compensates the loss of customers which stopped using the given Debian LTS team (xxxxx://xxxx.xxxxxx.xxx/LTS). XXXXXXXX XXXX ensures release and the increased complexity of the reality of the work done by PDC by reviewing the public monthly report that they have to providemaintaining very old software. FREEXIAN SARL ensures that PDC prioritize packages used by will monitor the Customer. The work assignment mechanism provides a list publication of packages sorted by security issues in the amount of associated sponsorship (summed across all Debian LTS sponsors). The most popular packages among Debian LTS sponsors will thus be handled firstCVE database. FREEXIAN SARL does not guarantee that all security issues will be fixed. Each issue will be reviewed and triaged by the PDCtriaged, some may be classified as not worthy of being fixed. Some might not be fixable at allfixable, in which cases the security announce will try to provide mitigation techniques. The Customer agrees that FREEXIAN SARL might work with sub-contractors to prepare the security updates. Those security updates will be made available to the Customer through the repositories on infrastructure managed by FREEXIAN SARL. All sub-contractors will be required to execute a non-disclosure agreement, with terms and conditions that align with the Customer/Freexian non-disclosure agreement, prior to having access to Customer’s data. FREEXIAN SARL does not guarantee any timeline for the publication of a security fix. There are too many factors that can delay the release of a security fix (availability of the vulnerability details, availability of an upstream patch, requirement to backport said patch, lack of sponsored time for a low-priority package, availability of a PDC with the required skills, etc.). The Customer recognizes that this contract is a best-effort contract. FREEXIAN SARL and the PDC will do their best to collectively serve the Debian LTS sponsors ELTS customers by providing timely security updates for the packages that they are using. The Customer acknowledges that the list of packages covered by security support evolves over time. If FREEXIAN SARL stops supporting a package that was requested by the Customer, this information will be communicated either through a proper security announce or with a direct email to the Customer’s technical contacts. The “debian- security-support” package contains customer acknowledges that the list packages maintained by Freexian are the packages which were in the Debian Release. Backports (with the exceptions of those documented on Freexian’s ELTS website) or external packages excluded from security support not included in the Debian release are not supported and can be updated following the usual Debian proceduresnot updated.