Red Hat Source Restrictions: Impact on Distros

Red Hat’s decision to restrict public access to its source code, announced in 2023, directly affects downstream distributions like CentOS Stream, AlmaLinux, and Rocky Linux by forcing them to find alternative ways to obtain and rebuild Red Hat Enterprise Linux (RHEL) sources. This article explains the mechanics of those restrictions, their practical consequences for derivative distros and their users, and the strategies being used to adapt.

Background: What Changed and Why

For decades, Red Hat made the complete source code for RHEL available to anyone through a public git repository. This allowed community projects like CentOS, Rocky Linux, and AlmaLinux to rebuild RHEL from source, strip out Red Hat trademarks, and release a free, binary-compatible clone. In June 2023, Red Hat announced that the complete RHEL source would only be available to paying customers through the Red Hat Customer Portal, and that the public source repository would be discontinued. Red Hat stated the move was intended to focus on CentOS Stream as the public collaboration point and to protect its commercial interests by making it harder for others to repackage RHEL essentially unchanged.

The change was met with significant backlash from the Linux community, as it threatened the long-standing model of free RHEL rebuilds. However, Red Hat clarified that the source is still available under the GPL to customers, and that the GPL requires them to provide source to those who receive the binaries. This subtle distinction became the key for downstream distros.

How the Restrictions Work in Practice

The restriction means that the complete RHEL source tarballs are no longer publicly downloadable. Instead, Red Hat publishes the source for CentOS Stream, which is a rolling preview of the next minor release of RHEL. While CentOS Stream is very close to RHEL, it is not identical: it contains features that may not make it into the final RHEL release, and it lacks some of the specific patches and build configurations that Red Hat applies to the final product.

For downstream distros, the practical effect is that they must now obtain RHEL source code by becoming Red Hat customers (which involves a subscription) or by using the source code that Red Hat provides to its customers under the GPL. This creates a legal and logistical hurdle: they must either pay for a subscription or rely on sources that are not officially public. Additionally, Red Hat’s customer agreement may place restrictions on how the source can be redistributed, though the GPL itself allows redistribution.

Impact on Major Downstream Distros

Each major downstream distro has responded differently to the restrictions:

• CentOS – The original CentOS project was discontinued in favor of CentOS Stream, which is now the only free Red Hat–related distro directly from Red Hat. CentOS Stream is not a direct rebuild; it sits between Fedora and RHEL, so users who want a stable RHEL clone no longer have a free option directly from Red Hat.
• Rocky Linux – The project announced it would obtain RHEL source code by using the GPL’s source provision requirement: it would take the binary RPMs from a RHEL subscription and request the corresponding source code from Red Hat, as any GPL recipient can. Rocky also uses a separate build system that can rebuild from the source RPMs.
• AlmaLinux – Initially, AlmaLinux said it would continue to provide a binary-compatible RHEL clone by using sources from CentOS Stream and other public sources. Later, the project shifted its focus to being an ABI-compatible (Application Binary Interface) distro rather than a clone, meaning it aims to be compatible at the binary level but may not use the exact same source code.

Common Problems and Misconceptions

One common misconception is that Red Hat’s move violates the GPL. In fact, the GPL requires that source code be provided to those who receive the binaries, but it does not require that the source be publicly accessible to everyone. Red Hat is complying with the GPL by providing source to its customers. Another misconception is that CentOS Stream is a direct replacement for the old CentOS Linux; it is not, as it has a faster update cadence and may have features that are not in RHEL.

A practical problem for downstream users is that they may face delays in getting security patches. When a RHEL security update is released, the source is only available to customers. Downstream rebuilds must then obtain that source, which can take days or weeks, leaving users of those distros exposed to known vulnerabilities for longer than RHEL customers.

Alternatives for Users and Organizations

For organizations that need a free, RHEL-compatible system, there are several options:

• CentOS Stream – Free, directly from Red Hat, but with a rolling release model that may be less stable than a point release.
• Rocky Linux – Aims to be a bug-for-bug compatible rebuild, but users should be aware of potential delays in security updates.
• AlmaLinux – Now focuses on ABI compatibility, which means it may not use the exact same source code but guarantees that software built for RHEL will run on AlmaLinux.
• Oracle Linux – Another RHEL-compatible distro that offers both free and paid support options.
• Fedora – The upstream community distro that serves as the basis for RHEL; it is free but has a shorter support cycle and is not binary-compatible with RHEL.

Cost and Support Considerations

The restrictions have made it more difficult for distros to offer free, long-term support. Previously, CentOS Linux offered up to 10 years of support for free. Now, CentOS Stream only receives updates until the next minor release, and the support window is effectively shorter. For organizations that need long-term stability, the cost of a RHEL subscription may be justified by the assurance of timely security updates and direct support. However, for those who cannot afford a subscription, the alternatives come with trade-offs in terms of update speed and support longevity.

Frequently Asked Questions

Is Red Hat’s source code still open source?

Yes, the source code is still available under the GPL, but only to customers who receive the binaries. The GPL does not require public distribution, so Red Hat’s restriction is legal. However, the source is no longer freely accessible to everyone, which is a significant change from the previous policy.

Can I still get a free RHEL clone?

Yes, but with caveats. Rocky Linux and AlmaLinux continue to provide RHEL-compatible distributions, but they may not be as timely with security updates as they were before. AlmaLinux has shifted to ABI compatibility, which means it may not use the exact same source code but ensures binary compatibility.

What is the difference between CentOS Stream and the old CentOS?

CentOS Stream is a rolling release that sits between Fedora and RHEL. It gets updates more frequently and may include features that are not in the current RHEL release. The old CentOS was a point release that mirrored RHEL exactly. CentOS Stream is not a direct clone; it is a preview of what will be in the next RHEL.

Does the GPL require Red Hat to make source public?

No. The GPL requires that source code be provided to anyone who receives a copy of the binary. It does not require that the source be made available to the general public. Red Hat complies by providing source to its customers, and those customers can redistribute it under the GPL, but they are not obligated to do so.

Will Rocky Linux and AlmaLinux survive?

Yes, both projects are actively maintained and have adapted to the changes. Rocky Linux uses the GPL’s source provision to obtain sources, while AlmaLinux has changed its goal to ABI compatibility. Both continue to provide free RHEL-compatible options, though they face challenges in keeping up with security updates.

Related

• Pihole Unsecured: Browsing History Exposure Risk?
• Can Athletes Rest With Apple Watch? Yes, Here’s How
• Apple Fitness+ Guide: Make the Most of It