CDDL-1.1 is Sun/Oracle file-level copyleft, the 1.1 maintenance of CDDL-1.0. Reciprocity stays on covered files, not the whole application.
On this page
What it does
CDDL 1.1 is the same file-scoped copyleft as CDDL 1.0 with later project notice updates. You may combine covered files with closed code. Changes to those files that you distribute must be available under the CDDL. It remains GPL-incompatible in the FSF's reading. GlassFish and older Java EE pieces still ship it.
Pros
- The grant is public and the reciprocity is written down. Buyers know what they are looking at.
- Internal use without distribution stays ordinary. The hard work starts when a copy leaves the company.
Cons
- The source-offer duty is real the moment you distribute binaries that include covered files.
- How far copyleft reaches in a mixed stack is a counsel question. Do not guess from a blog post.
What it allows and requires
Choose a category to see the full grant in one scannable list. Permissions show what the license allows, limits show what it withholds, and obligations show the conditions your release process must satisfy.
Permissions
Commercial use
You may ship the code inside a paid product. The license does not restrict commercial use.
Modify
You may change the code, including keeping those changes private, unless a later obligation says otherwise.
Distribute
You may give copies to others. Distribution is what usually turns notice and source duties into real work.
Private use
Use inside your company, including internal forks, does not by itself trigger distribution duties.
Patent use
These licenses typically include a patent grant covering the licensed files. Read the grant before relying on it in a high-stakes deal.
Limits
Hold liable
The authors disclaim warranty. Recipients cannot hold them liable for damages arising from the software, except where law forbids that disclaimer.
Use trademark
The license is not a trademark license. Names, logos and product marks stay with their owners unless a separate grant says otherwise.
Open your product
File- or library-scoped copyleft does not, on its face, force you to open your entire application. Reciprocity stays on the covered files.
Obligations
Include copyright
Keep copyright notices on the covered files you distribute.
Include license
Keep the license text with the covered files, and say that those files are under this license.
Disclose source
Modifications to covered files that you distribute have to be available in source form under this license.
Same license
Reciprocity stays on the covered modules. How far a 'module' reaches is the usual counsel question.
What CDDL-1.1 requires when you ship
When you distribute a binary that includes CDDL-1.1 code, notice still travels with the copy, and the corresponding source has to be available under the same license. Internal use without a copy leaving the company is a different situation. The list below is the shipping work: what a recipient of that binary can demand, and what you record so a buyer can see it.
You meet CDDL-1.1 on a shipped binary when every recipient can get the corresponding source the license describes.
You meet the notice terms when the original copyright lines and the license text travel with the copy.
You keep internal use inside the terms when no copy leaves your company. Distribution is what usually turns the source duty into real work.
The duties named in CDDL-1.1
Notice still travels with the copy. On top of that, CDDL-1.1 names a source duty. These are the conditions in the text. The how-to above is when they become real work.
Include copyright
Keep copyright notices on the covered files you distribute.
Include license
Keep the license text with the covered files, and say that those files are under this license.
Disclose source
Modifications to covered files that you distribute have to be available in source form under this license.
Same license
Reciprocity stays on the covered modules. How far a 'module' reaches is the usual counsel question.
Things to be aware of
- Saying you only use CDDL-1.1 on the server, then shipping a Docker image or an on-prem build. Ask the question per artifact you hand out.
- Offering source for the covered package alone when the license asks for corresponding source of the work you shipped.
What the Common Development and Distribution License 1.1 does not do
Search results often flatten Common Development and Distribution License 1.1 into a slogan. These are the usual misreads. CDDL-1.1 is a grant with conditions, not a permission to skip the paperwork below.
- CDDL-1.1 is not "permissive with extra paperwork." Change covered files and ship them, and that source has to be available under the same license.
- CDDL-1.1 does not erase notice duties. Copyright lines and the license text still travel with the copies you hand over.
How CDDL-1.1 differs from nearby licenses
These licenses are often confused with CDDL-1.1, but their release duties differ. Each row summarizes what the license requires when you ship. Open the linked page for the full checklist.
- CDDL-1.1
- CDDL-1.1 is Sun/Oracle file-level copyleft, the 1.1 maintenance of CDDL-1.0. Reciprocity stays on covered files, not the whole application.
- CDDL-1.0
- Sun's file-scoped copyleft. It is the reason ZFS ships outside the Linux kernel: CDDL code does not combine with the GPL.
- MPL-2.0
- File-scoped copyleft. The MPL files stay open when you ship a binary, modified or not. Your own separate files stay yours.
- EPL-2.0
- Eclipse-family copyleft scoped to each Contribution. It reaches GPL compatibility only when the project designates a Secondary License.
Common questions about Common Development and Distribution License 1.1
Answers to common questions about what Common Development and Distribution License 1.1 requires, when its duties apply, and what evidence belongs with a release.
What is the Common Development and Distribution License 1.1?
CDDL 1.1 is the same file-scoped copyleft as CDDL 1.0 with later project notice updates. You may combine covered files with closed code. Changes to those files that you distribute must be available under the CDDL. It remains GPL-incompatible in the FSF's reading. GlassFish and older Java EE pieces still ship it.
What does CDDL-1.1 require when you ship a product?
You meet CDDL-1.1 on a shipped binary when every recipient can get the corresponding source the license describes. You meet the notice terms when the original copyright lines and the license text travel with the copy. You keep internal use inside the terms when no copy leaves your company. Distribution is what usually turns the source duty into real work.
Does hosting a product that uses CDDL-1.1 trigger extra duties?
Hosting alone usually does not trigger the source duty for CDDL-1.1. Shipping a binary, a container, or an on-prem build does. Notice still travels with any copy you hand over.
Can I keep my application closed if I use CDDL-1.1?
CDDL-1.1 is library-scoped copyleft. Your application can stay closed if recipients can replace the library with their own build. Static linking makes that expensive. The library itself still ships with corresponding source and notices. Confirm the linking story on the component, then record it.
What is corresponding source for CDDL-1.1?
Corresponding source is the source a recipient needs to build and run the same binary, including scripts and interface files the license names. Hosting a repository URL can be an offer. The offer has to match what you actually shipped. SourceTrust records that a person on your team confirmed the offer. It does not publish your source and does not host a mirror.
How is CDDL-1.1 different from Common Development and Distribution License 1.0?
CDDL-1.1 asks this: CDDL-1.1 is Sun/Oracle file-level copyleft, the 1.1 maintenance of CDDL-1.0. Reciprocity stays on covered files, not the whole application. Common Development and Distribution License 1.0 asks this: Sun's file-scoped copyleft. It is the reason ZFS ships outside the Linux kernel: CDDL code does not combine with the GPL. Open the Common Development and Distribution License 1.0 page for what that license requires when you ship. Do not treat the SPDX ids as interchangeable because the short names look similar.
Where do I record CDDL-1.1 for a buyer?
The catalog marks CDDL-1.1 as copyleft, so a source offer item appears on the project checklist when the project's distribution context is Distributed binary or Mixed. A SaaS-only project sees no item for it unless the row also carries a network trigger. Nobody ticks the item for you: a person on your team confirms it, and publishing stays blocked until every applicable item is confirmed. SourceTrust does not publish your source and does not host a mirror.
Where do I record CDDL-1.1 for a buyer?
The catalog marks CDDL-1.1 as copyleft, so a source offer item appears on the project checklist when the project's distribution context is Distributed binary or Mixed. A SaaS-only project sees no item for it unless the row also carries a network trigger.
Nobody ticks the item for you: a person on your team confirms it, and publishing stays blocked until every applicable item is confirmed. SourceTrust does not publish your source and does not host a mirror.
See also
The hub is the pillar for this cluster. Sibling licenses are the other spokes. Product FAQ links explain how SourceTrust records the duty, not the license text itself.
Practical guidance for procurement review, not legal advice. Confirm high-stakes use with counsel.