Debian and Nexenta collide [LWN.net]

When Sun Microsystems decided to release Solaris under the CDDL license, it did so with the knowledge that this code could not be combined with GPL-licensed code. That incompatibility was pretty much guaranteed to create some interesting conflicts at some time. That time appears to have arrived, thanks to the release of Nexenta, a Debian-based system built on top of the Solaris kernel and runtime libraries. How this conflict is resolved may set the tone for how the GPL and CDDL worlds intersect in the future.

The Nexenta developers got off to a bit of a bad start by announcing its existence while putting its entire web site behind a password gate. Once general access was allowed, developers discovered that binaries of their software were being distributed without the associated source. The Nexenta developers responded in a rather unhelpful manner:

Also some stuff not committed yet, beca[u]se we are testing them. In 2-3 months we are hoping to sort out all these "starting" issues with code browsing, scripts availability, etc.

Anybody who has hung around anywhere near the Debian community for any period of time will know immediately that this sort of answer is unlikely to go over well. Various developers responded with requests to delete the binaries immediately, and some even pondered the use of a DMCA takedown notice. The Nexenta developers appear to have taken the hint, and source availability has improved, though the occasional glitch still comes to light.

The hardest issue, however, remains unresolved. The Nexenta project uses, along with the Solaris kernel, a number of user-space libraries (including the core C library) from Solaris. These libraries, being licensed under the CDDL, are not compatible with GPL-licensed applications. But much of Nexenta's user space is GPL licensed, and is linked against Sun's libc. And, in particular, much of the management infrastructure which makes Nexenta a Debian-derived distribution is built this way.

Several Debian developers are claiming that distributing GPL-licensed applications linked to a CDDL libc constitutes copyright infringement and should be stopped. The Nexenta developers, instead, justify this distribution by citing the "system software" exemption in section 3 of the GPL:

However, as a special exception, the source code distributed need not include anything that is normally distributed (in either source or binary form) with the major components (compiler, kernel, and so on) of the operating system on which the executable runs, unless that component itself accompanies the executable.

This exemption has allowed the distribution of, for example, binaries of GPL applications for Solaris for many years. The Debian folks respond that this situation is different: since the libraries and the GPL applications are all part of the Nexenta distribution, the CDDL-licensed libc does, indeed, accompany the executable, and the exemption does not apply.

The Nexenta developers do not appear to entirely buy this argument. They have suggested, however, that Nexenta could be split into two pieces: the CDDL-licensed core, and the GPL-licensed applications. Once the core is installed, the applications could be brought in from a repository somewhere. The only problem there is that bringing in those applications requires the use of (GPL-licensed) tools like dpkg, which would thus have to be distributed with the core system. Getting past this little bootstrap issue could be a challenge.

Once again, Nexenta has not helped itself here: project developers have suggested that the Debian community might want to help them out by relicensing dpkg under CDDL-compatible terms. Suffice to say that this idea was not received enthusiastically. The idea of rewriting dpkg as a CDDL application has also been raised, though that raises some issues of its own.

A more plausible solution to this problem might be to get Sun to relicense its libraries in a GPL-compatible way. Nobody has asked Sun (publicly, at least) whether it would be willing to take this step, but, once again, Sun was certainly aware of the consequences of its licensing decisions when it made them. This situation could also be resolved by porting the GNU C library to the Solaris kernel and shipping it with Nexenta. This is evidently a big task, and the Nexenta developers (who seem to be fairly small in number) are not thrilled about taking it on.

The licensing issues are real, and need to be worked out. But many of the people involved in the debate appear to have lost track of the fact that the Nexenta project, while perhaps being occasionally arrogant and ignorant of how Debian does things, is trying to make a contribution to the free software world. It is a free software project. Anthony Towns has been almost the lone voice in calling for a higher degree of cooperation with Nexenta:

I'm amazed at the level of intolerance that's greeting a pretty major contribution to the free software community. There are, what, five major OS/kernels for PCs/workstations these days -- Windows, OS X, Solaris, BSD and Linux. How does it make any sense at all to be hostile to the fact that now four out of those five are free at their core?

He also points out that Debian's hands have not always been 100% clean, and that there is more to gain by helping a project like this toward free-software purity than by threatening legal action against it. With luck, the community will hear this message. What Nexenta is doing is very much within the spirit of free software licensing; with patience and help, they should be able to get within the letter of those licenses as well.

The LWN site is currently under high scraper load, so comment display has been suppressed for anonymous users. If you are a human, you may read the comments by clicking the button below:

Note: you can avoid this step in the future by logging into your LWN account.