Back

04/03/2025

9. Considering Red Hat’s Decision to Withhold Source Code

In its blog post dated June 21, 2023, “
Furthering the evolution of CentOS Stream ,” Red Hat announced that it will limit the release of Red Hat Enterprise Linux (RHEL) source code to customers and partners only.

Since then, the topic has been covered by many news sites, and vendors and communities that develop RHEL clones, such as Oracle, AlmaLinux, and Rocky Linux, have reacted strongly to it.

What does Red Hat’s announcement mean? Why has it caused such a strong backlash? To understand it, you need to know the history of Linux, how distributions are developed, and what licensing is involved.

Here, we will take a simple look at this recent commotion, including the meaning of Red Hat’s announcement, the reactions of other companies, and predictions for future trends.

Understanding Red Hat’s announcement

To understand this announcement, you need to understand CentOS Stream. Let’s take a look at this announcement while introducing CentOS Stream.

CentOS-related Red Hat/IBM announcements

To understand the bigger picture, let’s take a look back at the CentOS situation.

  • 2004: First release of CentOS
  • 2014: Red Hat acquires CentOS
  • 2019: IBM acquires Red Hat
  • 2020: CentOS project to be discontinued
  • 2021: In response to the discontinuation of CentOS development, the community launches AlmaLinux and Rocky Linux
  • 2023: RHEL source code will be available only to customers and partners

CentOS has a surprisingly long history, dating back to version 2.0 in 2004. At the time, there were multiple RHEL-compatible distributions, and it was not as established as it is today. In particular, Scientific Linux was used for many years and existed until 2020. Oracle Linux was released in 2006.

In 2014, Red Hat acquired CentOS, which had been an independent project until then. There were pros and cons to this, but I recall that there were many voices welcoming it, especially since the release of CentOS was somewhat delayed at the time.

In 2019, IBM acquired Red Hat. As you all know, CentOS will undergo a major transformation from this point on.

The end of CentOS and the transition to CentOS Stream

The start of the big change was the announcement of the end of the CentOS project in 2020. As previously mentioned in ” Part 8: Switching from CentOS to Oracle Linux ,” the CentOS project has ended and been replaced by CentOS Stream (support for CentOS 7 will end on June 30, 2024, and CentOS 8 has already ended).

The reason it caused such a stir was that CentOS Stream was positioned as the upstream of RHEL.

Until now, CentOS was popular as a free RHEL-compatible distribution. However, with the arrival of CentOS Stream, it can no longer be called a RHEL-compatible distribution. In addition, CentOS Stream uses a rolling release method. Therefore, it is always required to be up to date, making it difficult to use in production environments.

This is what is known as the “CentOS shock.”

Red Hat’s announcement

Red Hat has published the following two blogs regarding the source code disclosure:

First, we will introduce the important parts of ” Furthering the evolution of CentOS Stream “. Since various news articles explain it in detail, we have shortened it here to prioritize clarity over accuracy of the translation.

As the CentOS Stream community grows and the enterprise software world tackles new dynamics, we want to sharpen our focus on CentOS Stream as the backbone of enterprise Linux innovation. We are continuing our investment in and increasing our commitment to CentOS Stream.

As the CentOS Stream community grows and enterprise software embraces new dynamics, we will continue to invest in and strengthen our efforts in CentOS Stream.

Red Hat has indicated its commitment to CentOS Stream, and in the preceding paragraph, it states that some people welcome the rapid release of upstream releases.

CentOS Stream has emerged as a dynamic and forward-thinking option. Some people may welcome it. However, it is important to remember that there is also downstream demand for it, with full compatibility with RHEL. Especially for enterprise use, stability is often more important than change and forward-thinking.

CentOS Stream will now be the sole repository for public RHEL-related source code releases. For Red Hat customers and partners, source code will remain available via the Red Hat Customer Portal.

CentOS Stream will be the only repository for RHEL-related public source code releases going forward, and Red Hat customers and partners will continue to have access to the source code through the Red Hat Customer Portal.

The original text also has this in bold. It’s a roundabout way of saying things, but in simple terms, it’s saying that “CentOS Stream source code will be made public, but RHEL source code will not be made public.”

Next is ” Red Hat’s commitment to open source: A response to the git.centos.org changes .”

This is a summary of the first half of the article. The original text is long, so it has been omitted.

Red Hat adopts an open source development model, and new feature development, bug fixes, backporting patches, and various tests incur a lot of costs. In addition, it is a painstaking task to always manage 3 to 4 major releases and backport patches to code that is 5 to 10 years old. Furthermore, it is necessary to reflect upstream projects such as Fedora and the Linux Kernel project.

I feel that much of the anger from our recent decision around the downstream sources comes from either those who do not want to pay for the time, effort and resources going into RHEL or those who want to repackage it for their own profit. This demand for RHEL code is disingenuous.

I am infuriated by the dishonesty of RHEL-compatible distributions who simply rebuild the RHEL source code and make no contribution to it.

There is a denunciation of free riding here.

Open source software has developed for a variety of reasons. The biggest reason for its development is probably the benefits for users, such as the fact that it can be used free of charge or at low cost, and that there is no vendor lock-in because the source code is publicly available. However, there are also benefits for developers. Quality improves as more users report bugs, development progresses as the number of development members increases, and the number of users increases as documentation and technical information is made available in multiple languages.

In recent years, free riding has become an issue on mega clouds such as Amazon Web Services. Redis, Elasticsearch, MongoDB, and other services have changed their licenses in opposition to free riding on mega clouds.

We also provide no-cost Red Hat Developer subscriptions and Red Hat Enterprise Linux (RHEL) for Open Source Infrastructure. The developer subscription provides no-cost RHEL to developers and enables usage for up to 16 systems, again, at no-cost. This can be used by individuals for their own work and by RHEL customers for the work of their employees.

We offer Red Hat Developer Subscriptions and Red Hat Enterprise Linux for Open Source Infrastructure (services for the open source development community) at no cost.

Although the terms of use make it quite limited, RHEL does offer a free program for some users.

Why did it receive such strong backlash?

The cause of this uproar is that “CentOS, which can be used for free as RHEL compatible, will no longer exist” and “RHEL-related source code other than CentOS Stream will not be made public .” Let’s dig a little deeper into this. We will explain how to create a RHEL-compatible distribution and the GPL.

How to create a RHEL-compatible distribution

The diagram below shows how to create a RHEL-compatible distribution. RHEL-compatible distributions were developed based on the source code (SRPM) of RHEL or CentOS. Many distributions were based on CentOS, which is free of copyright restrictions and easy to modify.

The problem is how to create it in the future. The source code of RHEL is limited to limited users such as customers and partners. Only CentOS Stream has become a source code repository that is accessible to everyone. However, CentOS Stream is the upstream of RHEL. Rebuilding the CentOS Stream source will not make it compatible with RHEL.

GPL and RED HAT Enterprise Agreement

The Linux kernel is a program licensed under GPL v2. Some people may think that it is strange not to release the source code because Linux is GPL. Here is a brief explanation of the GPL and the RED HAT Enterprise Agreement, which are important for understanding the RHEL license.

The GPL is a very powerful license with the following characteristics: The GPL clauses have been translated into Japanese by volunteers, but some parts are difficult to understand and subject to differing interpretations, so please think of it as roughly as follows.

  • Commercial use allowed
  • The author does not assume any responsibility
  • Include copyright notices and no warranty.
  • The source code must be made public when distributed
  • If you create software that uses all or part of a program licensed under the GPL, you must distribute it under the GPL as well.

The important part to note is the part that says “There is an obligation to make the source code public at the time of distribution .” The general interpretation of this is that “anyone who has the object code (binary code) has the right to obtain the source code.” However, it can also be said that “anyone who does not have the object code does not have the right to obtain the source code.”

To give a specific example, say a company develops a program that uses modified GPL software only within the company. Although this software is GPL, it is not open to the public, so there is no need to release the source code, including the modified parts, to the public.

Although the GPL has strong characteristics regarding the disclosure of source code, it has the above characteristics. Therefore, Red Hat imposes certain restrictions on its customers by entering into a Red Hat Enterprise Agreement with them. Although we will not go into the contents of the Red Hat Enterprise Agreement, it contains many restrictive clauses.

Reactions from vendors and projects

In response to Red Hat’s announcement, vendors and projects developing RHEL-compatible distributions have published various statements. Here are some of them.

AlmaLinux

AlmaLinux is a project launched by CloudLinux, a company with a track record as a Linux OS for hosting. It was the first release of the After CentOS project. Three blog posts have been published in quick succession.

The outline is as follows:

  • RHEL-compatible source RPMs are harder to obtain, but security updates are available more quickly.
  • Maintain downstream RHEL stance, but abandon 1:1 compatibility with RHEL, and aim for binary compatibility
  • Contribute to the entire Enterprise Linux ecosystem, including the open source community and upstream platforms such as Fedora and CentOS Stream.

The second blog explains how to keep up with security updates using OpenSSL as an example. Cybertrust (MIRACLE LINUX), which develops RHEL-compatible distributions in Japan, has announced a partnership with CloudLinux, the main sponsor of AlmaLinux.

Rocky Linux

Rocky Linux is a project founded by Gregory Kurtzer, the founder of the CentOS project. Support is provided by CiQ, a company founded by Gregory Kurtzer. This project also publishes three blogs.

The outline is as follows:

  • 100% RHEL compatibility down to the bug level
  • Fulfilling our mission to provide a stable, long-lasting RHEL-compatible distribution
  • Contribute to the entire Enterprise Linux ecosystem, including the open source community and upstream platforms such as Fedora and CentOS Stream.
  • Although Red Hat’s Terms of Service and End User License Agreements restrict the rights granted by the GPL, the site provides legal ways to obtain the source code (using the Red Hat Universal Base Image container image and using pay-as-you-go instances on public clouds).
  • Launched OpenELA , a project to promote Enterprise Linux, with Oracle and SUSE.

Oracle

Oracle, the developer of Oracle Linux, has released the following news:

Some of the content is a bit sarcastic compared to AlmaLinux and Rocky Linux, but the gist is as follows:

  • He has been involved in the Linux community for 25 years, with the goal of making it the best free server OS for everyone.
  • Oracle released Oracle Linux in 2006, choosing RHEL compatibility to avoid splitting the Linux community.
  • We have adhered to the GPL and made our binaries and source code open. Unlike IBM (Red Hat), we do not interfere with users’ rights through subscription contracts.
  • Is the intention of not disclosing the source code this time aimed at eliminating competitors?
  • Continue to maintain compatibility with RHEL where possible
  • Oracle will continue to contribute to the Linux community and will release binaries and source code. Downstream distributions are welcome.

SUSE

Finally, there is SUSE. Although it was an RPM-based distribution, it was not compatible with RHEL, but it has announced that it will enter the RHEL-compatible distribution market.

Conclusion

Red Hat has undoubtedly been the leader in the enterprise Linux market. In addition, the company’s contributions to the open source community, not just Linux, are immeasurable. That’s why this announcement came as a surprise.

Although only three months have passed since Red Hat’s announcement, other companies have been responding quickly. Not only have all major RHEL-compatible distribution vendors announced their countermeasures, but even SUSE, which has a high market share in Europe, has announced its participation. Therefore, it is unlikely that RHEL-compatible distributions will disappear, or that security patches will be significantly delayed.

This case reminds me of the “SCO Linux Lawsuit” that lasted from 2003 to 2010. Starting with SCO, the owner of the Linux copyright, suing IBM, it went on to sue Novell and Red Hat, and even hinted at suing general Linux users. In addition to being heavily criticized around the world, SCO was unable to win a single case and ended up paying a huge amount of legal fees.

This time, there is no SCO’s patent troll-like maliciousness. However, it is unlikely that something that will have many opponents in the open source world will be successful. However, there is also a need for CentOS Stream as an upstream, so coexistence with the RHEL-compatible downstream camp may be attempted.