•

A Comprehensive Analysis of the GPL Issues With the Red Hat Enterprise Linux (RHEL) Business Model | Software Freedom Conservancy

A Comprehensive Analysis of the GPL Issues With the Red Hat Enterprise Linux (RHEL) Business Model

https://sfconservancy.org/blog/2023/jun/23/rhel-gpl-analysis/

This article was originally published primarily as a response to IBM's Red Hat's change to no longer publish complete, corresponding source (CCS) for RHEL and the prior discontinuation of CentOS Linux (which are related events, as described below). We hope that this will serve as a comprehensive document that discusses the history of Red Hat's RHEL business model, the related source code provisioning, and the GPL compliance issues with RHEL.

A Comprehensive Analysis of the GPL Issues With the Red Hat Enterprise Linux (RHEL) Business Model

...this completes what appears to be a decade-long plan by Red Hat to maximize the level of difficulty of those in the community who wish to “trust but verify” that RHEL complies with the GPL agreements. Namely, Red Hat has badly thwarted efforts by entities such as Rocky Linux and Alma Linux. These entities are de-facto the intellectual successors to CentOS Linux project that Red Hat carefully dismantled over the last decade

12 comments

Gobbel2000

•

In essence, Red Hat requires their customers to choose between (a) their software freedom and rights, and (b) remaining a Red Hat customer.

A very good writeup, made me better understand the way Red Hat is creatively interpreting the GPL. I hope they won't just get away with this and go back to better cooperating with the FOSS community.

pete

•

Honestly, while I agree, I'd assume that the people with enough money to sue IBM also have enough money to just buy license. Seems like a no win for us.

tumulus_scrolls

•

Context just before that quote:

As we understand it, this contract clearly states that the terms do not intend to contradict any rights to copy, modify, redistribute and/or reinstall the software as many times and as many places as the customer likes (see §1.4). Additionally, though, the contract indicates that if the customer engages in these activities, that Red Hat reserves the right to cancel that contract and make no further contracts with the customer for support and update services.

This is rich, don't know how many people are aware of that.

jeebus

•

I wonder why SFC doesn't sue Redhat. Are they afraid of the GPL losing power? I'm not a Redhat user, but I respect the history (before 2014).

Parodper

•

There's nothing to sue for. They have only «broken» the spirit of the GPL, not the letter.

phase_change

•

I suspect what Red Hat is doing is compatible with GPLv2, which is how the Linux kernel is licensed. I’m certain what they are doing is inimical to the Intent of GPLv2.

That raises some questions and possibilities. It looks like the Linux kernel still has the GPLv2 or later clause, despite not moving to GPLv3. See https://www.kernel.org/doc/html/v4.18/process/license-rules.html

How possible is it to create a GPLv4 that addresses this? Building a new license that does shouldn’t be difficult. However, I’d assume the Linux kernel isn’t released under a GPLv3 or later because of some objections with those changes. I’d imagine creating a GPLv4 that addresses the Red Hat issue but leaves out the changes in GPLv3 is likely a non-starter because those that have chosen a GPLv3 or later license will object.

Given the thousands of contributors to the Linux kernel, is an upgrade to a GPL version higher than v2 even possible? I’ve got no idea, but I’m curious of any insights.

meteokr

•

Given the thousands of contributors to the Linux kernel, is an upgrade to a GPL version higher than v2 even possible? I’ve got no idea, but I’m curious of any insights.

This is functionally impossible, because all current and prior contributors have to agree to the relicense. Should they not, an utterly massive legal and logistical headache will occur that I don't think anyone would attempt. As any and all code from anyone who does not agree must be removed/replaced. The mother of all Forks.

I am not a lawyer, but I have been a follower of FLOSS projects for a long time.

phase_change

•

I am not a lawyer, but I have been a follower of FLOSS projects for a long time.

Me too. I know what I’m suggesting is functionally impossible. I’m wondering if it could be done in compliance with the GPL.

All of those contributors have done so using language that says GPLv2 or higher. Specifically says you can modify or redistribute under GPLv2 or later versions. So nothing stops the Linux Foundation from asking new contributors to contribute under the GPLv4 and then releasing the combined work of the new kernel under GPLv4.

The old code would still be available under the GPLv2, but I suspect subsequent releases could be released under a later version and still comply with original contributions.

Again, I know it won’t happen, just like I believe Red Hat’s behavior is within the rules of the GPL. I’d love to hear arguments as to how Red Hat is violating the GPL or reasons why the kernel couldn’t be released under GPLv3 or higher.

reddit_sux

•

What will happen to an enterprise customer who does decide to share the source code that Red Hat shares with them?

nobloat

•

Well, they have the right to terminate your account if you do so. They are just doing some legal gymnastics to get around the true spirit of the GPL

Laser

•

First off, I have never used RHEL or a derivative for more than 5 minutes, and I found it... not very pleasant because you don't need that level of stability (read: ancient packages) if you're not in an enterprise environment.

However, saying they're working around the spirit of the GPL is a stretch I'd say. All the sources for their applications are still available, either on fedora or Stream. Outside a RHEL subscription, it's not very hard to get a big-compatible distro out of the sources. But the sources are out there. The bigger offender is grsecurity, doing the same thing without any sources whatsoever for non-customers, and morning has happened to them in over 5 years.

If Red Hat adds nothing of value with their distribution, I wonder why people are so eager to have distributions like Alma and Rocky. As I said, I don't really care about RHEL, but if they're essential to your operation, consider not only licensing the bare minimum... or make your stack work reliably on other systems (I guess containerization helps a lot with that nowadays)

Screw IBM but I feel like the loudest complainers right now got themselves in a kind of predictable situation. Especially after the acquisition. But my guess is RH is fully in the clear legally. Is it a wise business decision long term? I don't know. If that loses them money in the longer run, the decision night get reversed.