Somewhere in your infrastructure documentation there is a runbook for leaving. It names a tool, and the tool comes from a download page. Nobody has clicked that link in two years, because you only click it once, on the day you go. In late August, the link that a very large number of VMware estates quietly depend on started returning an error, and it has not come back.
Broadcom has removed the public download pages for the VMware Virtual Disk Development Kit, with no announcement and no stated route to obtain the library instead. If you are running vSphere, nothing about today changed. If you were planning to leave, quite a lot did.
TL;DR
- Broadcom removed the public download pages for the VMware Virtual Disk Development Kit (VDDK). Every documented URL now returns an error, with no announcement, deprecation notice or archive.
- VDDK is the library that lets software outside the hypervisor read VMware virtual disks. Image-level backup, Azure Migrate agentless replication, Red Hat’s Migration Toolkit for Virtualization, Nutanix Move, Apache CloudStack and virt-v2v all use it.
- The licence forbids redistribution, so no distribution, container image or third-party installer can legally mirror it. One URL, no community workaround.
- Exit tooling is a dependency class nobody inventories: no lockfile entry, no SBOM line, no monitoring, and access contingent on the contract you are trying to terminate.
- The EU Data Act mandates barrier-free switching, but only for data processing services, so software you licence and run on your own hardware sits outside Chapter VI. If you sell SaaS, you are on the other side of that line, and 12 January 2027 is a hard date.
What actually changed
VDDK lets software read and write VMware virtual disks from outside the hypervisor. If you have ever taken an image-level backup of a vSphere VM, something in that chain used it. More to the point, it is the transport underneath most of the tooling built to get workloads out of VMware.
The ShapeBlue engineering team documented the removal on 25 August 2026, after the VDDK page named in the Apache CloudStack administration guide started returning an error. They tested every variant of the path, including the version-specific locations for VDDK 8 and 9, from four continents. Same result everywhere. We checked the developer portal paths again while writing this, and they are still returning “The page you requested couldn’t be found.”
Two vendors have already amended their documentation around the gap. Red Hat published a support solution on 27 August 2026 confirming the images are unavailable through standard public downloads, stating that “Red Hat cannot host, distribute, or provide this image directly to customers” and telling customers to contact Broadcom instead. Microsoft’s Azure Migrate guidance now carries a caveat next to the download step: if you do not have access to a supported VDDK package, use agent-based migration. Customers posting Broadcom support responses report being told the kit is no longer available for general download.
The part with no workaround
Normally an ecosystem routes around this. Someone mirrors the files, someone packages them, and it becomes a footnote.
Not here. The VDDK licence does not permit general redistribution, which is why no distribution ships it, no container image bundles it, and every affected product’s install guide ends with the same instruction: fetch it yourself from the vendor’s portal. A single URL is a hard dependency for an entire ecosystem, and the licence that created the dependency also blocks the obvious remedy, because mirroring the binaries only moves the legal exposure onto whoever hosts them. Several projects still point their users at that link, so the documented, vendor-blessed path off the platform now terminates in a 404.
The dependency class nobody registers
We have spent two years getting rigorous about dependencies. Lockfiles, SBOMs, provenance attestation, pinned base images, renovation bots. All of it is pointed at the software you run. None of it is pointed at the software you would need in order to stop running it.
Exit tooling has two properties that make it uniquely easy to lose:
It is used exactly once, at the end. A dependency you exercise on every build fails loudly within a day. One you exercise years after writing it into the plan fails silently, and then fails at the worst possible moment.
Access is usually gated behind the relationship you are ending. The credential that gets you the migration tool is normally the support entitlement on the platform you are migrating away from. Your ability to leave depends on your account still being in good standing with the party you are leaving, at precisely the point where those interests diverge. That is simply how portals work, and it is why “what happens to my downloads when the contract lapses” belongs in a renewal conversation rather than a cutover meeting.
None of this is specific to virtualisation. The same shape appears in managed database export utilities, proprietary format converters, the bulk export endpoint with an undocumented rate limit that turns a weekend migration into a six-week one, and vaulted payment credentials that only move under a signed agreement, which is what caught our attention when GOV.UK moved from Stripe to Adyen. A migration plan is only as real as the artefacts it depends on, and most plans have never been tested for whether those artefacts are still obtainable.
The regulation that does not cover this
The EU Data Act, Regulation (EU) 2023/2854, contains an entire chapter designed to kill exactly this behaviour. Chapter VI obliges providers to remove the commercial, technical and contractual obstacles that stop customers switching, to support functional equivalence in the destination environment, and to stop charging for the privilege. Under Article 29, reduced switching charges are permitted only until 12 January 2027, after which providers “shall not impose any switching charges on the customer for the switching process”.
It does not apply here. Chapter VI governs data processing services, defined in Article 2(8) as a digital service enabling on-demand network access to a shared pool of configurable, scalable and elastic computing resources: IaaS, PaaS and SaaS. Software you licence and run on your own hardware is not that. The Data Act mentions your data centre only as a destination, in the Article 2(33) definition of on-premises ICT infrastructure, one of the places you are entitled to switch to. It is never the thing you are entitled to switch away from.
So the largest live lock-in event in enterprise infrastructure falls outside the regulation written to solve lock-in, and Ireland has still not enacted its own Data Bill, as we noted when the Data Act’s access-by-design obligations landed. For on-premises licensing, your exit rights are whatever your contract says they are.
Now flip it. If you build and sell a hosted product, you are on the other side of that definition. Functional equivalence, exportable data and digital assets, no switching charges after 12 January 2027: that is your roadmap, not your supplier’s. The behaviour making headlines this week is the behaviour the Regulation will prohibit in your business in four months. Any buyer who has watched this VMware story unfold will start asking about your export path during procurement, and “we’ll sort it out at the time” has stopped being an acceptable answer.
What to do about it this week
- Inventory the artefacts your exit depends on, and hold local copies. Every SDK, converter, export CLI and licence file named in a migration or disaster recovery runbook, kept under change control with the tested version and a hash you computed yourself.
- Rehearse the fallback route once, deliberately. Agent-based replication, storage copy offload and OVF export all work, and all cost staging capacity and wall-clock time you have not budgeted for.
- Monitor the URLs. A weekly automated request against every download link in your runbooks costs nothing and would have surfaced this in August, not in a cutover window.
- Move the question to renewal. Ask in writing what happens to download entitlements after termination, and negotiate archival or redistribution rights for migration tooling while you still have leverage.
- If you sell software, ship the export as a feature. A documented format, a supported path, and a date, for the reason set out above.
The door is still there
Nothing in this story broke a running system. Every vSphere estate on the planet booted normally this morning, which is what makes it instructive: lock-in is rarely announced, and it does not usually arrive as a price rise. It arrives as a page that used to exist.
You do not discover that your exit is gated until you try to use it, which is the one moment you cannot afford to find out. If you want a second pair of eyes on what your infrastructure would actually need in order to leave, a vSphere estate, a managed platform or a SaaS contract nobody has read since signature, our DevOps and platform team does this work. Get in touch.
📷 Photo by Sheldon Kennedy on Unsplash
