What this license is
The Common Development and Distribution License is Sun's rework of MPL-1.1, and it inherits the file scope. Copyleft here means the license requires the covered files to stay available under the same license. Files carrying the CDDL header stay CDDL, and your own separate files do not. You will meet it on OpenZFS, on the JAXB and JavaMail reference implementations, on Jersey and Grizzly before the Jakarta move, and on the old javax.annotation artifacts. Section 3.1 keeps the Source Code of the covered files available under the CDDL, and section 3.5 makes an executable distribution say where to get it.
Why it matters for your product
The day-to-day duty is mild. Publish the source of the covered files when you ship them, keep the headers, and your own files stay closed. The expensive part is compatibility. CDDL and the GPL do not combine, which is why ZFS is not merged into the Linux kernel and why distributions ship OpenZFS as a separate module. If your product mixes CDDL and GPL code, you have a license question rather than a packaging question. Many Jakarta EE artifacts also moved from CDDL to EPL-2.0 when they went to the Eclipse Foundation, so the answer depends on the version you pinned.
You are meeting the terms when
- You are meeting section 3.1 when the Source Code of every covered file you ship in executable form is available under the CDDL to whoever received it.
- You have done the notice part when your executable distribution states that the source exists and points at where to get it, which is what section 3.5 asks.
- You keep your own code out when your work lives in separate files rather than inside the CDDL-headered ones, because the license scopes by file.
- You have answered the hard question when you know that no GPL-licensed code in the same product is combined with these CDDL files.
- You are clear for a hosted product when nothing is distributed, because the CDDL has no clause that treats network access as distribution.
Where teams get it wrong
- A javax.* artifact is waved through as 'standard Java'. The package is licensed like anything else, so record its CDDL text and its source location.
- GPL and CDDL components sit in the same build and nobody raises it. Separate them, replace one, or take the combination to counsel before you ship.
- CDDL-1.0 and CDDL-1.1 are assumed to differ in substance. They barely do, so do not spend review time there; spend it on the GPL question.
- The source duty is read as applying only to files you edited. It follows the covered files you distribute, so publish that source either way.
How SourceTrust handles this license
CDDL-1.0 and CDDL-1.1 both have catalog rows marked copyleft, so a source offer item appears on the project checklist in the Distributed binary and Mixed contexts, and never for a SaaS-only project. The item waits for a person, and publishing is blocked until someone confirms it. SourceTrust does not tell you whether a CDDL component and a GPL component in the same build can live together. That reading is yours. Read Inventory and compliance overview for the view that shows every project a component appears in.
Related guides
- Source code offer (copyleft)
- Mozilla Public License 1.1
- Eclipse Public License 1.0
- GNU GPL v2.0 or later