Sun's file-scoped copyleft. It is the reason ZFS ships outside the Linux kernel: CDDL code does not combine with the GPL.
On this page
What it does
The Common Development and Distribution License is Sun's rework of MPL-1.1, and it inherits the file scope. Copyleft here means the license requires the covered files to stay available under the same license. Files carrying the CDDL header stay CDDL, and your own separate files do not. You will meet it on OpenZFS, on the JAXB and JavaMail reference implementations, on Jersey and Grizzly before the Jakarta move, and on the old javax.annotation artifacts. Section 3.1 keeps the Source Code of the covered files available under the CDDL, and section 3.5 makes an executable distribution say where to get it.
Details
The day-to-day duty is mild. Publish the source of the covered files when you ship them, keep the headers, and your own files stay closed. The expensive part is compatibility. CDDL and the GPL do not combine, which is why ZFS is not merged into the Linux kernel and why distributions ship OpenZFS as a separate module. If your product mixes CDDL and GPL code, you have a license question rather than a packaging question. Many Jakarta EE artifacts also moved from CDDL to EPL-2.0 when they went to the Eclipse Foundation, so the answer depends on the version you pinned.
Pros
- You can link the library from closed code in the way the license describes.
- File-level reciprocity is easier to isolate than GPL-style whole-work copyleft.
Cons
- Vendoring or statically linking can pull more of your tree into the covered set than a dynamic link would.
- The source-offer duty is real the moment you distribute binaries that include modified covered files.
What it allows and requires
Choose a category to see the full grant in one scannable list. Permissions show what the license allows, limits show what it withholds, and obligations show the conditions your release process must satisfy.
Permissions
Commercial use
You may ship the code inside a paid product. The license does not restrict commercial use.
Modify
You may change the code, including keeping those changes private, unless a later obligation says otherwise.
Distribute
You may give copies to others. Distribution is what usually turns notice and source duties into real work.
Private use
Use inside your company, including internal forks, does not by itself trigger distribution duties.
Patent use
These licenses typically include a patent grant covering the licensed files. Read the grant before relying on it in a high-stakes deal.
Limits
Hold liable
The authors disclaim warranty. Recipients cannot hold them liable for damages arising from the software, except where law forbids that disclaimer.
Use trademark
The license is not a trademark license. Names, logos and product marks stay with their owners unless a separate grant says otherwise.
Open your product
File- or library-scoped copyleft does not, on its face, force you to open your entire application. Reciprocity stays on the covered files.
Obligations
Include copyright
Keep copyright notices on the covered files you distribute.
Include license
Keep the license text with the covered files, and say that those files are under this license.
Disclose source
Modifications to covered files that you distribute have to be available in source form under this license.
Same license
Reciprocity stays on the covered modules. How far a 'module' reaches is the usual counsel question.
What CDDL-1.0 requires when you ship
When you distribute a binary that includes CDDL-1.0 code, notice still travels with the copy, and the corresponding source has to be available under the same license. Internal use without a copy leaving the company is a different situation. The list below is the shipping work: what a recipient of that binary can demand, and what you record so a buyer can see it.
You are meeting section 3.1 when the Source Code of every covered file you ship in executable form is available under the CDDL to whoever received it.
You have done the notice part when your executable distribution states that the source exists and points at where to get it, which is what section 3.5 asks.
You keep your own code out when your work lives in separate files rather than inside the CDDL-headered ones, because the license scopes by file.
You have answered the hard question when you know that no GPL-licensed code in the same product is combined with these CDDL files.
You are clear for a hosted product when nothing is distributed, because the CDDL has no clause that treats network access as distribution.
The duties named in CDDL-1.0
Notice still travels with the copy. On top of that, CDDL-1.0 names a source duty. These are the conditions in the text. The how-to above is when they become real work.
Include copyright
Keep copyright notices on the covered files you distribute.
Include license
Keep the license text with the covered files, and say that those files are under this license.
Disclose source
Modifications to covered files that you distribute have to be available in source form under this license.
Same license
Reciprocity stays on the covered modules. How far a 'module' reaches is the usual counsel question.
Things to be aware of
- A javax.* artifact is waved through as 'standard Java'. The package is licensed like anything else, so record its CDDL text and its source location.
- GPL and CDDL components sit in the same build and nobody raises it. Separate them, replace one, or take the combination to counsel before you ship.
- CDDL-1.0 and CDDL-1.1 are assumed to differ in substance. They barely do, so do not spend review time there; spend it on the GPL question.
- The source duty is read as applying only to files you edited. It follows the covered files you distribute, so publish that source either way.
What the Common Development and Distribution License 1.0 does not do
Search results often flatten Common Development and Distribution License 1.0 into a slogan. These are the usual misreads. CDDL-1.0 is a grant with conditions, not a permission to skip the paperwork below.
- the Common Development and Distribution License 1.0 does not force you to open your whole application. The reciprocal duty stays on the covered files.
- It is not "permissive with extra paperwork." Change a covered file and ship it, and that file's source has to be available under the same license.
How CDDL-1.0 differs from nearby licenses
These licenses are often confused with CDDL-1.0, but their release duties differ. Each row summarizes what the license requires when you ship. Open the linked page for the full checklist.
- CDDL-1.0
- Sun's file-scoped copyleft. It is the reason ZFS ships outside the Linux kernel: CDDL code does not combine with the GPL.
- MPL-1.1
- The 1998 Mozilla license. Its source duty attaches to the files you modified, not to every MPL file you ship, and it has no GPL bridge.
- EPL-1.0
- The older Eclipse license. Same Contribution-scoped duty as EPL-2.0, but with no GPL bridge, so mixing with GPL code is a real problem.
- GPL-2.0-or-later
- GPL-2.0 asks for source when you hand someone a binary. Running it on your own servers triggers nothing. The trigger is shipping a copy, not merely using it.
Common questions about Common Development and Distribution License 1.0
Answers to common questions about what Common Development and Distribution License 1.0 requires, when its duties apply, and what evidence belongs with a release.
What is the Common Development and Distribution License 1.0?
The Common Development and Distribution License is Sun's rework of MPL-1.1, and it inherits the file scope. Copyleft here means the license requires the covered files to stay available under the same license. Files carrying the CDDL header stay CDDL, and your own separate files do not. You will meet it on OpenZFS, on the JAXB and JavaMail reference implementations, on Jersey and Grizzly before the Jakarta move, and on the old javax.annotation artifacts. Section 3.1 keeps the Source Code of the covered files available under the CDDL, and section 3.5 makes an executable distribution say where to get it.
What does CDDL-1.0 require when you ship a product?
You are meeting section 3.1 when the Source Code of every covered file you ship in executable form is available under the CDDL to whoever received it. You have done the notice part when your executable distribution states that the source exists and points at where to get it, which is what section 3.5 asks. You keep your own code out when your work lives in separate files rather than inside the CDDL-headered ones, because the license scopes by file. You have answered the hard question when you know that no GPL-licensed code in the same product is combined with these CDDL files. You are clear for a hosted product when nothing is distributed, because the CDDL has no clause that treats network access as distribution.
Does hosting a product that uses CDDL-1.0 trigger extra duties?
Hosting alone usually does not trigger the source duty for CDDL-1.0. Shipping a binary, a container, or an on-prem build does. Notice still travels with any copy you hand over.
Can I keep my application closed if I use CDDL-1.0?
CDDL-1.0 is library-scoped copyleft. Your application can stay closed if recipients can replace the library with their own build. Static linking makes that expensive. The library itself still ships with corresponding source and notices. Confirm the linking story on the component, then record it.
What is corresponding source for CDDL-1.0?
Corresponding source is the source a recipient needs to build and run the same binary, including scripts and interface files the license names. Hosting a repository URL can be an offer. The offer has to match what you actually shipped. SourceTrust records that a person on your team confirmed the offer. It does not publish your source and does not host a mirror.
How is CDDL-1.0 different from Mozilla Public License 1.1?
CDDL-1.0 asks this: Sun's file-scoped copyleft. It is the reason ZFS ships outside the Linux kernel: CDDL code does not combine with the GPL. Mozilla Public License 1.1 asks this: The 1998 Mozilla license. Its source duty attaches to the files you modified, not to every MPL file you ship, and it has no GPL bridge. Open the Mozilla Public License 1.1 page for what that license requires when you ship. Do not treat the SPDX ids as interchangeable because the short names look similar.
Where do I record CDDL-1.0 for a buyer?
CDDL-1.0 and CDDL-1.1 both have catalog rows marked copyleft, so a source offer item appears on the project checklist in the Distributed binary and Mixed contexts, and never for a SaaS-only project. The item waits for a person, and publishing is blocked until someone confirms it. SourceTrust does not tell you whether a CDDL component and a GPL component in the same build can live together. That reading is yours.
Where do I record CDDL-1.0 for a buyer?
CDDL-1.0 and CDDL-1.1 both have catalog rows marked copyleft, so a source offer item appears on the project checklist in the Distributed binary and Mixed contexts, and never for a SaaS-only project. The item waits for a person, and publishing is blocked until someone confirms it.
SourceTrust does not tell you whether a CDDL component and a GPL component in the same build can live together. That reading is yours.
Read /docs/inventory-compliance for the view that shows every project a component appears in.
See also
The hub is the pillar for this cluster. Sibling licenses are the other spokes. Product FAQ links explain how SourceTrust records the duty, not the license text itself.
Practical guidance for procurement review, not legal advice. Confirm high-stakes use with counsel.