GPL-2.0 asks for source when you hand someone a binary. Running it on your own servers triggers nothing. The trigger is shipping a copy, not merely using it.
On this page
What it does
You can run GPL-2.0 code on your own servers, change it, and keep your own source private. The duty starts when you convey a binary, which means handing a copy of the software to somebody outside your own organization. From that point every recipient may ask for the complete corresponding source of the whole combined program, under the same license, build scripts included. That is what copyleft means: the license requires that what you pass on stays as open as what you received. WordPress, Drupal and MediaWiki are the best-known examples.
Details
The GPL question in your inventory is rarely 'do we use GPL code'. It is 'do we ever hand a copy to anyone'. A hosted service that never ships an artifact answers no, and that answer is genuinely reassuring. A Docker image a customer pulls, an on-prem appliance, a mobile build or a firmware image answers yes. Then the whole program you shipped is in scope, not only the GPL file, and the source offer has to exist before the release does.
Pros
- Clear rules for sharing improvements. Recipients of a binary can ask for the corresponding source.
- Widely understood by legal and engineering. Compatibility questions have a large public record.
Cons
- Shipping a combined binary usually means offering corresponding source under the same license.
- Mixing with Apache-2.0 or other patents-bearing licenses is a known compatibility trap on older GPL versions.
What it allows and requires
Choose a category to see the full grant in one scannable list. Permissions show what the license allows, limits show what it withholds, and obligations show the conditions your release process must satisfy.
Permissions
Commercial use
You may ship the code inside a paid product. The license does not restrict commercial use.
Modify
You may change the code, including keeping those changes private, unless a later obligation says otherwise.
Distribute
You may give copies to others. Distribution is what usually turns notice and source duties into real work.
Private use
Use inside your company, including internal forks, does not by itself trigger distribution duties.
Limits
Hold liable
The authors disclaim warranty. Recipients cannot hold them liable for damages arising from the software, except where law forbids that disclaimer.
Use trademark
The license is not a trademark license. Names, logos and product marks stay with their owners unless a separate grant says otherwise.
Open your product
Copyleft can reach a combined work you distribute, not only the original files. How far that reaches in your stack is a counsel question.
Network copyleft
Classic GPL has no network clause. Offering the program as a hosted service, without distributing a copy, does not by itself trigger the source offer.
Obligations
Include copyright
Keep copyright notices on distributed copies.
Include license
Give recipients a copy of the license with the program.
Disclose source
When you distribute a binary of a covered work, corresponding source has to be offered in the way the license describes.
Same license
The combined work you distribute has to stay under this license. You cannot close the covered work with a more restrictive grant.
Later GPL
Or later lets a recipient take GPLv3 terms. Until they do, the copy you ship still has to meet GPL-2.0's corresponding-source rules.
What GPL-2.0-or-later requires when you ship
When you distribute a binary that includes GPL-2.0-or-later code, notice still travels with the copy, and the corresponding source has to be available under the same license. Internal use without a copy leaving the company is a different situation. The list below is the shipping work: what a recipient of that binary can demand, and what you record so a buyer can see it.
You meet the terms while nobody outside your team receives a copy. Running and modifying GPL-2.0 code on your own servers triggers no source duty, because version 2 has no network clause.
You meet them on a shipped binary when every recipient can get the complete corresponding source of the combined program. The same delivery or a written offer valid for three years both work.
You meet the notice terms when the original copyright lines and the license text travel with the copy, and each file you changed carries a note saying that you changed it and when.
You are reading the grant correctly when you treat 'only' and 'or later' as two different licenses. 'Or later' lets a recipient move to GPLv3 terms, which is what makes Apache-2.0 code combinable in practice.
You have closed the linking question when counsel has answered it. The FSF reads both static and dynamic linking as creating one combined work, and that reading has never been settled in court.
The duties named in GPL-2.0-or-later
Notice still travels with the copy. On top of that, GPL-2.0-or-later names a source duty. These are the conditions in the text. The how-to above is when they become real work.
Include copyright
Keep copyright notices on distributed copies.
Include license
Give recipients a copy of the license with the program.
Disclose source
When you distribute a binary of a covered work, corresponding source has to be offered in the way the license describes.
Same license
The combined work you distribute has to stay under this license. You cannot close the covered work with a more restrictive grant.
Later GPL
Or later lets a recipient take GPLv3 terms. Until they do, the copy you ship still has to meet GPL-2.0's corresponding-source rules.
Things to be aware of
- Saying 'we only use it on the server, so GPL does not matter', and then shipping a Docker image or an on-prem build. Ask the question per artifact you hand out, not once per company.
- Offering source for the GPL package alone. The obligation covers the corresponding source of the whole program you shipped, including build scripts and the files needed to rebuild it.
- Writing a source offer that nobody owns. Name the repository or the postal address before release, and put a person on keeping it reachable for the full three years.
- Assuming the package is 'GPL-2.0' when its headers say 'only'. Git and BusyBox are GPL-2.0-only, the two grants differ, and a package that declares one while shipping the other text lands as a mismatch instead of confirmed.
What the GNU GPL v2.0 or later does not do
Search results often flatten GNU GPL v2.0 or later into a slogan. These are the usual misreads. GPL-2.0-or-later is a grant with conditions, not a permission to skip the paperwork below.
- GPL-2.0-or-later does not let you keep the combined program closed if you distribute it. The reciprocal duty reaches the work as a whole.
- Network use alone is not distribution for GPL-family licenses. Running a GPL program as SaaS, without AGPL, does not by itself trigger the source duty.
How GPL-2.0-or-later differs from nearby licenses
These licenses are often confused with GPL-2.0-or-later, but their release duties differ. Each row summarizes what the license requires when you ship. Open the linked page for the full checklist.
- GPL-2.0-or-later
- GPL-2.0 asks for source when you hand someone a binary. Running it on your own servers triggers nothing. The trigger is shipping a copy, not merely using it.
- GPL-2.0-only
- GPL-2.0-only is strong copyleft pinned to version 2. Recipients cannot move the work to GPLv3, so Apache-2.0 does not combine with it.
- GPL-3.0-only
- GPL-3.0 keeps the source duty on distributed binaries and adds a patent grant, an anti-lockdown rule for consumer devices, and a cure period.
- LGPL-2.1-or-later
- Weak copyleft for libraries. Your own code can stay closed as long as users can swap in their own build of the library. Static linking makes relinking costly.
Common questions about GNU GPL v2.0 or later
Answers to common questions about what GNU GPL v2.0 or later requires, when its duties apply, and what evidence belongs with a release.
What is the GNU GPL v2.0 or later?
You can run GPL-2.0 code on your own servers, change it, and keep your own source private. The duty starts when you convey a binary, which means handing a copy of the software to somebody outside your own organization. From that point every recipient may ask for the complete corresponding source of the whole combined program, under the same license, build scripts included. That is what copyleft means: the license requires that what you pass on stays as open as what you received. WordPress, Drupal and MediaWiki are the best-known examples.
What does GPL-2.0-or-later require when you ship a product?
You meet the terms while nobody outside your team receives a copy. Running and modifying GPL-2.0 code on your own servers triggers no source duty, because version 2 has no network clause. You meet them on a shipped binary when every recipient can get the complete corresponding source of the combined program. The same delivery or a written offer valid for three years both work. You meet the notice terms when the original copyright lines and the license text travel with the copy, and each file you changed carries a note saying that you changed it and when. You are reading the grant correctly when you treat 'only' and 'or later' as two different licenses. 'Or later' lets a recipient move to GPLv3 terms, which is what makes Apache-2.0 code combinable in practice. You have closed the linking question when counsel has answered it. The FSF reads both static and dynamic linking as creating one combined work, and that reading has never been settled in court.
Does hosting a product that uses GPL-2.0-or-later trigger extra duties?
Hosting alone usually does not trigger the source duty for GPL-2.0-or-later. Shipping a binary, a container, or an on-prem build does. Notice still travels with any copy you hand over.
Does linking to GPL-2.0-or-later force me to open my application?
For strong copyleft such as GPL-2.0-or-later, the FSF reads static and dynamic linking as one combined work when you distribute the result. Shipping a binary that includes GPL-2.0-or-later code is the usual trigger. Internal use with no copy leaving the company is a different situation. Read the actual text, not the family nickname.
What is corresponding source for GPL-2.0-or-later?
Corresponding source is the source a recipient needs to build and run the same binary, including scripts and interface files the license names. Hosting a repository URL can be an offer. The offer has to match what you actually shipped. SourceTrust records that a person on your team confirmed the offer. It does not publish your source and does not host a mirror.
How is GPL-2.0-or-later different from GNU GPL v2.0 only?
GPL-2.0-or-later asks this: GPL-2.0 asks for source when you hand someone a binary. Running it on your own servers triggers nothing. The trigger is shipping a copy, not merely using it. GNU GPL v2.0 only asks this: GPL-2.0-only is strong copyleft pinned to version 2. Recipients cannot move the work to GPLv3, so Apache-2.0 does not combine with it. Open the GNU GPL v2.0 only page for what that license requires when you ship. Do not treat the SPDX ids as interchangeable because the short names look similar.
Where do I record GPL-2.0-or-later for a buyer?
The catalog marks GPL-2.0-or-later as copyleft, so a source offer item appears on the project checklist when the project's distribution context is Distributed binary or Mixed. A SaaS-only project sees no item for it, which matches the license. Nobody ticks the item for you: a person on your team confirms it, and publishing stays blocked until every applicable item is confirmed. SourceTrust does not publish your source and does not host a mirror.
Where do I record GPL-2.0-or-later for a buyer?
The catalog marks GPL-2.0-or-later as copyleft, so a source offer item appears on the project checklist when the project's distribution context is Distributed binary or Mixed. A SaaS-only project sees no item for it, which matches the license.
Nobody ticks the item for you: a person on your team confirms it, and publishing stays blocked until every applicable item is confirmed. SourceTrust does not publish your source and does not host a mirror.
Read /docs/mobile-app-licenses when the binary in question is a mobile app.
- The fetcher compares the license text inside the published artifact against the id the package declares. A package that says 'only' but ships the 'or later' text lands as a mismatch for a person to settle.
- The stored license text is what your published attestation page and every export file carry, including THIRD_PARTY_LICENSES.md and the SBOM formats.
See also
The hub is the pillar for this cluster. Sibling licenses are the other spokes. Product FAQ links explain how SourceTrust records the duty, not the license text itself.
Practical guidance for procurement review, not legal advice. Confirm high-stakes use with counsel.