Open source licenses, IP, and CDDL

Although I've been trying to stay out of the open source license controversy (being generally more interested in code and developers than in legal nuances and ideology), a few recent statements have prompted me to correct some misconceptions. I'm not a lawyer, but as one of the drafters of the CDDL I can at least comment on what the license says, and on our intentions in creating it. In an opinion piece in eWeek, Steven Vaughan-Nichols states that:

The CDDL model [...] puts IP control under the company - in the CDDL's case, the company is Sun.

Now, if you read through the text of the CDDL, you'll note that Sun is mentioned exactly once, in section 4.1:

Sun Microsystems, Inc. is the initial license steward and may publish revised and/or new versions of this License from time to time.

That means that Sun is allowed to create new versions of the license, and others cannot (without renaming it). This is simply to avoid confusion - we don't want 3 different "CDDL version 1.1" licenses out there. The GPL has a similar provision, with the FSF allowed to revise the license. The stewardship provision in no way gives Sun control over intellectual property released under this license. In fact, Sun may not even be a licensor or licensee - the CDDL is reusable, and can be used by parties other than Sun, just as the GPL can be used for non-FSF projects.

It's important to note that someone licensing code under CDDL can specify a specific version of the license. For example, I can release the code for the Xyzzy tool under CDDL version 1.0 only. If I do that, then any subsequent versions of the license will have no effect on the terms of under which the code was released. This is significant in contrast with licenses like the MPL and CPL, which allow the license steward to revise the license and automatically allow licensees to choose between the original license and the revised license, regardless of the wishes of the licensor or overall community. In addition, the CDDL allows the venue, jurisdiction, and choice of law to be configured by the licensor; this allows use by people and companies in different geographical areas.

Now, rather than the license itself, perhaps Mr. Vaughan-Nichols is referring to Sun having control over the release of OpenSolaris code under CDDL. I'll agree that, at least initially, Sun will have greater rights to the OpenSolaris code than other people. But that's true no matter what license is used. Under any license (open source or proprietary), the licensor has more rights than the licensee, since they have full rights to the code (assuming that the licensor is a full copyright holder). Even under very permissive licenses like the BSD license, the licensee is required to preserve the licensor's copyright notice, while the licensor can change or remove that notice. The licensor can even release code they "own" under multiple licenses that would otherwise be incompatible; MySQL (which is dual licensed under GPL and a GPL-incompatible proprietary license) is a notable example of this.

Does the choice of license mean that the creators of Solaris wanted to have some degree of control over what happens to the code? Yes, I think that's a fair statement - just as the creators of Linux or MySQL wanted some control over their code. In the case of OpenSolaris, we wanted to allow people to make independent changes to the code, but promote the sharing of those changes - hence the "copyleft" requirement that anyone distributing binaries must also make the corresponding source available. But we also wanted to let people extend and improve the code with code available under different licenses (whether open source or proprietary), so the requirement extends only to the files released under CDDL (not files they may be linked with). Although I realize that not everyone sees this as a good thing (since it allows open source code to be embedded within a proprietary system), it's hardly an example of Sun controlling the IP - in this respect, the CDDL is more permissive than the GPL.

I've also seen concerns about the distinction the CDDL makes between Initial Developer and Contributor. The former refers to the person or company that initially releases the code under the license, while the latter refers to others who develop and distribute modifications to the code. The language and definitions are a holdover from the MPL. If you read the license, you'll see that the grants in each case mirror each other; that is, the Initial Developer grants the same rights as other Contributors. The primary distinction is that the Initial Developer can determine the license version for the code (and whether any revisions to the license should automatically be available as an option to licensees), as well as the choice of venue and jurisdiction.

I also find it interesting that those deriding CDDL and Sun, and stating that Sun won't be able to attract a community to OpenSolaris because of the license choice, seem to be overlooking another prominent corporate-sponsored community with an MPL-flavored license: Eclipse.


[Trackback] There's been a lot of FUD this week around CDDL , MPL, and OSI licensing changes in general. Andy Tucker's blog explains and counters the FUD quite nicely, but if you really want to know what's going on, read the licenses yourself ! They real...

Posted by The Alethiometer on April 14, 2005 at 07:15 AM PDT #

Post a Comment:
Comments are closed for this entry.



« September 2016