I wrote this a couple days ago, sums it up: https://www.jeffgeerling.com/blog/2023/gplv2-red-hat-and-you

tl;dr - GPLv2 requires no restriction on free/paid recipients of binaries to also freely redistribute source code. Red Hat EULA says your subscription will be canceled if you redistribute the source code. Is that a restriction?

A couple OSS laywers I spoke to said no. Common sense says it feels an awful lot like intimidation to effectively keep their product proprietary (what Fortune 500 company would like to have their Red Hat servers all go dead because some employee downloaded sources and uploaded them somewhere?)

But they do make all of that source code available under CentOS Stream. GPL does not require an SLA for providing source code of all bugfixes and security patches free of charge in under 24h. Just embargoing security patches for 1-2 weeks from Stream would be a good enough move for RH to signal to enterprise customers that Rocky/Alma are not a drop-in gratis replacement for RHEL in production systems.

I think what RH did is ethically questionable but is a great development for the use of GPL in the enterprise (for releasing SW under GPL that would otherwise remain closed-source): there is now a path for respecting GPL freedoms (in a slightly round-about way) without necessarily making the product gratis.

The GPL requires all source code be available including the scripts and glue code required to build the binary alongside the source. You can't pull a Stream and offer "most" of the source, but not the source required to rebuild the latest stable release. That's counter to the spirit and the letter of GPLv2.

Legally speaking, the contract vs copyright issue is the only ground Red Hat has to stand on here.

The last time I recall a company doing the 'we will follow our GPL obligations and give you - specifically you, the recipients of the binaries from us - the source but if you exercise your right to redistribute don't expect to be able to renew your contract' thing I believe the eventual conclusion amongst the people who seriously knew what they were talking about* was 'this is obnoxious but legal.'

* I do not consider myself to be one of those people

I am amazed that multiple OSS lawyers gave you the same answer and you still don't believe them.

> (what Fortune 500 company would like to have their Red Hat servers all go dead because some employee downloaded sources and uploaded them somewhere?)

What does this mean? Are you implying that RHEL has some sort of kill switch per customer embedded in it's source code that someone could exploit? I am not following this train of thought at all.

Losing access to Redhat services won't immediately bring down your servers, but if you are unable to install security updates or new software without switching to a different distro they might be as good as dead.