Welcome to Runtime! Today: A deep dive into a dispute between the backers of NATS and the CNCF, which is just the latest example of changing norms in open-source software, and the latest funding rounds in enterprise tech.

(Was this email forwarded to you? Sign up here to get Runtime each week.)

The fork not taken

The CNCF kicked over an open-source hornet's nest last week when it revealed that Synadia was attempting to retake ownership of NATS, an open-source communications infrastructure project that it donated to the CNCF back in 2018, by asserting control over its trademark and planning to re-release it under a less-permissive license. After taking quite a bit of flak over the weekend for those tactics, it sounds like Synadia is backing down.

Synadia CEO Derek Collison told Runtime Tuesday that the company intends to transfer the NATS trademark to the CNCF at some point in the future "because we just feel that the damage to the ecosystem and the ugliness is not worth it for anyone." While nothing will be official until the lawyers sort it out, Collison said "my hope is that [this dispute] forces some open dialog outside of the CNCF and outside of NATS about the state of open source. I think open source for companies like Synadia is at a crossroads."

A quick recap is probably necessary for everyone who had other things to do this weekend.

• In a lengthy blog post published last Thursday, the CNCF outlined how lawyers working for Synadia sent it a letter in March demanding "full control of the nats.io domain name and the nats-io GitHub repository within two weeks," both of which the CNCF manages on behalf of projects it takes under its wing.
• When a project is transferred to the CNCF, the foundation agrees to provide support and marketing services to the project but also requires that any trademarks related to the project be handed over along with the domain name and GitHub repository.
• However, Synadia never transferred the trademark to the CNCF after settling a dispute with Major League Baseball and the Washington Nationals over the mark in 2020 and accepting $10,000 in reimbursement for a portion of its legal fees from the CNCF.
• In an interview Tuesday, Collison confirmed that Synadia had accepted that money but said at time of the dispute with MLB the company was under the impression that it only had to transfer the trademark once the project had graduated from the CNCF, which was not the case.

It is not entirely clear why it took the CNCF five years to realize it didn't actually own the NATS trademark, during which time it conducted several security audits on behalf of the project (including one completed after Synadia kicked off the dispute) and promoted it at industry events. Chris Aniszczyk, CTO of the foundation, told Runtime that "we have 200-plus projects, and we've never had a case where this has happened. We just assume all of our companies and members, over 700 of them, who all have signed an agreement and know the IP rules very clearly, would eventually adhere to them."

• However, the trademark dispute is just a vehicle for Synadia's broader ambitions for the project, which is to re-license it under the Business Source License in order to prevent others from selling commercial products based around NATS.
• That strategy has become a popular one in recent years for companies that grew around open-source projects, such as HashiCorp, but it's not possible under the CNCF's charter.
• If a company has second thoughts about whether or not the CNCF is the right home for a project, they have the option to fork the project under a different name, Aniszczyk said, which is what Grafana did with the Mimir database in 2022.
• But Collison didn't want to throw out the NATS brand, which he suggested the CNCF urged him to do when Synadia faced the trademark dispute with MLB: "That brand has been my full commitment for the last 15 years of my life, I put my heart, sweat and tears into both the technology and the branding itself," he told Runtime.

However, after the last few days it appears Collison and Synadia are now willing to recognize that the original CNCF agreement requires a transfer of the trademark, which would make it impossible for Synadia to call any code relicensed under the BSL "NATS." Collison said Tuesday he was hopeful Synadia and the CNCF could find some middle ground between forking the project and archiving it, a stage in which the CNCF and the Linux Foundation still control the trademark but no longer provide support.

• The CNCF has become a powerful force in enterprise tech, influencing the decisions of thousands of end-user companies around the world by marketing a trusted and supported stack of enterprise-ready open-source software.
• However, its control over the projects that were voluntarily transferred to its stable limits the opportunities for venture-capital backed startups working on those projects to find new revenue streams.
• And given that those companies tend to contribute the vast majority of the code that makes up those projects — which is expensive to produce — Synadia's frustration is somewhat understandable.
• But an agreement is still an agreement, and Synadia appears to have damaged its credibility with those end-user companies with little to show for it.

Enterprise funding

Chainguard raised $356 million in Series D funding, which values the supply-chain security startup at $3.5 billion.

Veza scored $108 million in Series D funding for its identity management security technology.

Endor Labs landed $93 million in Series B funding as it continues to develop its application security software from "a safe position to continue to build, while weathering market volatility."

Lightrun raised $70 million in Series B funding for its observability software, which promises to automatically detect and fix issues in code.

Sentra scored $50 million in Series B funding as it looks to "grow its team of data security experts and continue to expand its platform," which helps companies secure their data.

Reducto landed $24.5 million in Series A funding for its document parsing technology, which helps companies manage unstructured data.

The Runtime roundup

Super Micro missed Wall Street's estimates for revenue and profit by a wide margin, sending shares of the server maker down 19% in after-hours trading.

Meta introduced an API for its Llama large-language models that will make it easier for developers to incorporate those models into their apps and services.

Oracle's Cerner Health division is just starting to recover from a five-day outage (!) "after engineers conducting maintenance work mistakenly deleted critical storage connected to a key database," according to CNBC.

Thanks for reading — see you Thursday!