Additional restriction in Photon 5.0 EULA

[vmackie]

Describe the bug

The Photon 5.0 EULA which applies to the Photon OVA and ISO includes a restriction which wasn't present in the Photon 4.0 EULA:

1.3. Restrictions. Customer may use the Offerings only for its internal use and for the benefit of its Affiliates. Affiliates may not use the Offerings. Customer may not resell or sublicense its rights to the Offerings. Customer may not use the Offerings in an application service provider, service bureau, hosted IT service, or similar capacity for third parties.

This appears to block the use case for the Photon OS OVA where a vSphere Remote Plugin has been packaged and distributed with the Photon OVA. This architecture is specifically recommended in VMWare's guide for developing remote plugins:

https://techdocs.broadcom.com/us/en/vmware-cis/vsphere/vsphere-sdks-tools/9-0/developing-remote-plug-ins-with-the-vsphere-client-sdk-8-0.html

Was the restriction erroneously added? If not, can you help me to understand the intention behind the update to the EULA and how we can continue to use the OVA.

Reproduction steps

Read the EULA

Expected behavior

Package and distribute a vSphere Remote Plugin with the Photon OS OVA

Additional context

No response

[dcasota]

+1 yes, the Photon OS 5.0 EULA is strict. It applies to any official download (iso, ova).

Goal	Compliant Path	Non-Compliant (Risky) Path
Let Affiliate use VMware	Affiliate benefits indirectly (e.g., Customer runs VMware, Affiliate consumes services via internal API)	Affiliate logs in directly → breach
Shared use across Broadcom units	Central IT (as Customer) runs VMware for all units; units access via internal tools only	Each division gets login → breach
Offer VMware-based hosting to clients	Impossible under this license	Use reseller/partner program or VMware Cloud Provider Program (separate agreement)

As consequence from the 5.0 EULA: Treat VMware Photon OS 5.0 official downloads as internal infrastructure only. Any cross-division or external access requires separate licenses or VMware-approved partner programs.

Group	Can They Use VMware Directly?	Can They Benefit Indirectly?	Can They Resell/Host for Others?
External Customers	❌ No	❌ No	❌ No
Customer’s Affiliates	❌ No (cannot log in/use)	✅ Yes (can benefit)	❌ No
Other Broadcom Divisions	Only if Affiliate of Customer → still no direct use	Yes, if Affiliate	❌ No

When you compile your own Photon OS builds, you are not using the offerings mentioned in the 5.0 EULA. In this case, a framework of multiple terms are kicking in.

• Repository license https://github.com/vmware/photon/blob/master/LICENSE.md
• Package manager tdnf license https://github.com/vmware/tdnf?tab=License-1-ov-file#readme
• Photon OS Security Advisories files are distributed under license of CC BY-SA 4.0, see https://github.com/vmware/photon/wiki/Security-Advisories.
• per package: see each license

Here an overview.

Aspect	Official Offerings (ISO/OVA)	Self-Compiled Build (from Source)
Governing License	Photon OS 5.0 EULA (proprietary)	GNU GPL v2 (core) + LGPL v2.1 (libtdnf) + Apache 2.0 (repo elements)
Restrictions	Internal use only; no resale/sublicense; VMware support optional	OSS freedoms (modify/distribute) but copyleft obligations (share source for GPL parts)
Security Advisories	Included under EULA	CC BY-SA 4.0
Warranty/Support	Limited per EULA	None (OSS "AS-IS")
Use Case Fit	Production/enterprise with VMware by Broadcom ecosystem	Custom/dev builds; avoids EULA but requires license compliance

Very important: The Photon OS team introduced source provenance information for ALL packages. This is outstanding. No other distribution has this feature. It allows to encompass in future releases a single build-driven, dynamic, SBOM-related EULA.

To the Photon OS team: Kindly review the information provided and advise if any corrections are necessary, if there are omissions, or if any important steps have been overlooked.