GPL-3.0 keeps the source duty on distributed binaries and adds a patent grant, an anti-lockdown rule for consumer devices, and a cure period.
On this page
What it does
GPL-3.0-only is GPLv3 without permission to take a later FSF GPL. The core deal is the same as version 2: host it and change it freely. The moment you convey a binary, recipients can ask for the complete corresponding source of the combined work under GPL-3.0-only. Version 3 adds an express patent license from every contributor, a rule against locking a consumer device so that a modified build will not run, and a 30-day cure period for a first breach. Recipients cannot elect a future GPL. Contrast GPL-3.0-or-later, which is the form GCC, Bash, GIMP and Ansible actually ship.
Details
For a hosted product, GPL-3.0 behaves like GPL-2.0: no network clause, and no source duty as long as you never hand out a copy. For hardware it is the harder of the two. Section 6 asks for Installation Information when the binary ships inside a User Product, meaning the consumer has to be able to install a modified build on the device they bought. That one requirement is why several device vendors refuse GPLv3 outright, and it is worth checking before the firmware is designed.
Pros
- Clear rules for sharing improvements. Recipients of a binary can ask for the corresponding source.
- Widely understood by legal and engineering. Compatibility questions have a large public record.
Cons
- Shipping a combined binary usually means offering corresponding source under the same license.
- Mixing with Apache-2.0 or other patents-bearing licenses is a known compatibility trap on older GPL versions.
What it allows and requires
Choose a category to see the full grant in one scannable list. Permissions show what the license allows, limits show what it withholds, and obligations show the conditions your release process must satisfy.
Permissions
Commercial use
You may ship the code inside a paid product. The license does not restrict commercial use.
Modify
You may change the code, including keeping those changes private, unless a later obligation says otherwise.
Distribute
You may give copies to others. Distribution is what usually turns notice and source duties into real work.
Private use
Use inside your company, including internal forks, does not by itself trigger distribution duties.
Limits
Hold liable
The authors disclaim warranty. Recipients cannot hold them liable for damages arising from the software, except where law forbids that disclaimer.
Use trademark
The license is not a trademark license. Names, logos and product marks stay with their owners unless a separate grant says otherwise.
Open your product
Copyleft can reach a combined work you distribute, not only the original files. How far that reaches in your stack is a counsel question.
Network copyleft
Classic GPL has no network clause. Offering the program as a hosted service, without distributing a copy, does not by itself trigger the source offer.
Obligations
Include copyright
Keep copyright notices on distributed copies.
Include license
Give recipients a copy of the license with the program.
Disclose source
When you distribute a binary of a covered work, corresponding source has to be offered in the way the license describes.
Same license
The combined work you distribute has to stay under this license. You cannot close the covered work with a more restrictive grant.
Installation Information
Section 6 also asks for Installation Information when a binary ships in a User Product, so the owner can run a modified build on the device.
What GPL-3.0-only requires when you ship
When you distribute a binary that includes GPL-3.0-only code, notice still travels with the copy, and the corresponding source has to be available under the same license. Internal use without a copy leaving the company is a different situation. The list below is the shipping work: what a recipient of that binary can demand, and what you record so a buyer can see it.
You meet the terms while the code stays on machines you control. GPL-3.0 has no network clause, so hosting it as a service creates no source duty on its own.
You meet them on a shipped binary when recipients get the complete corresponding source of the combined work under GPL-3.0, with the scripts needed to build and install it.
You meet section 6 when a consumer product ships with the Installation Information its owner needs to run a modified build on the device, signing steps and keys included.
You keep the grant intact when you do not start patent litigation over the covered code. Section 11 grants the patent license, section 10 forbids that suit, and section 8 is what ends your own license when the terms are broken.
You have handled a mixed inventory when nothing pairs GPL-3.0-only with GPL-2.0-only code, and when you have not treated this id as or-later. Recipients cannot move the work to a future GPL.
The duties named in GPL-3.0-only
Notice still travels with the copy. On top of that, GPL-3.0-only names a source duty. These are the conditions in the text. The how-to above is when they become real work.
Include copyright
Keep copyright notices on distributed copies.
Include license
Give recipients a copy of the license with the program.
Disclose source
When you distribute a binary of a covered work, corresponding source has to be offered in the way the license describes.
Same license
The combined work you distribute has to stay under this license. You cannot close the covered work with a more restrictive grant.
Installation Information
Section 6 also asks for Installation Information when a binary ships in a User Product, so the owner can run a modified build on the device.
Things to be aware of
- Shipping GPL-3.0 code inside a locked-down consumer device. If the owner cannot install a modified build, plan for a different component or a different product design.
- Reading GPL-3.0 as a network license because it is newer than GPL-2.0. The network clause lives in the AGPL, and only there.
- Combining GPL-3.0 with GPL-2.0-only code and calling it a version bump. Check the header of every GPL file in the tree before you assume the versions line up.
- Treating the patent grant as optional boilerplate. It runs from every contributor to every user, and your own contributions carry it out to your recipients too.
What the GNU GPL v3.0 does not do
Search results often flatten GNU GPL v3.0 into a slogan. These are the usual misreads. GPL-3.0-only is a grant with conditions, not a permission to skip the paperwork below.
- GPL-3.0-only does not let you keep the combined program closed if you distribute it. The reciprocal duty reaches the work as a whole under version 3, with no later-GPL election.
- Network use alone is not distribution for GPL-family licenses. Running a GPL program as SaaS, without AGPL, does not by itself trigger the source duty.
How GPL-3.0-only differs from nearby licenses
These licenses are often confused with GPL-3.0-only, but their release duties differ. Each row summarizes what the license requires when you ship. Open the linked page for the full checklist.
- GPL-3.0-only
- GPL-3.0 keeps the source duty on distributed binaries and adds a patent grant, an anti-lockdown rule for consumer devices, and a cure period.
- GPL-3.0-or-later
- GPL-3.0-or-later is GPLv3 plus permission to take a later FSF GPL. That election is how Apache-2.0 code becomes combinable in a GPL tree.
- GPL-2.0-only
- GPL-2.0-only is strong copyleft pinned to version 2. Recipients cannot move the work to GPLv3, so Apache-2.0 does not combine with it.
- AGPL-3.0-only
- AGPL is GPLv3 plus section 13: if you let users reach your modified version over a network, they can ask you for its source.
Common questions about GNU GPL v3.0
Answers to common questions about what GNU GPL v3.0 requires, when its duties apply, and what evidence belongs with a release.
What is the GNU GPL v3.0?
GPL-3.0-only is GPLv3 without permission to take a later FSF GPL. The core deal is the same as version 2: host it and change it freely. The moment you convey a binary, recipients can ask for the complete corresponding source of the combined work under GPL-3.0-only. Version 3 adds an express patent license from every contributor, a rule against locking a consumer device so that a modified build will not run, and a 30-day cure period for a first breach. Recipients cannot elect a future GPL. Contrast GPL-3.0-or-later, which is the form GCC, Bash, GIMP and Ansible actually ship.
What does GPL-3.0-only require when you ship a product?
You meet the terms while the code stays on machines you control. GPL-3.0 has no network clause, so hosting it as a service creates no source duty on its own. You meet them on a shipped binary when recipients get the complete corresponding source of the combined work under GPL-3.0, with the scripts needed to build and install it. You meet section 6 when a consumer product ships with the Installation Information its owner needs to run a modified build on the device, signing steps and keys included. You keep the grant intact when you do not start patent litigation over the covered code. Section 11 grants the patent license, section 10 forbids that suit, and section 8 is what ends your own license when the terms are broken. You have handled a mixed inventory when nothing pairs GPL-3.0-only with GPL-2.0-only code, and when you have not treated this id as or-later. Recipients cannot move the work to a future GPL.
Does hosting a product that uses GPL-3.0-only trigger extra duties?
Hosting alone usually does not trigger the source duty for GPL-3.0-only. Shipping a binary, a container, or an on-prem build does. Notice still travels with any copy you hand over.
Does linking to GPL-3.0-only force me to open my application?
For strong copyleft such as GPL-3.0-only, the FSF reads static and dynamic linking as one combined work when you distribute the result. Shipping a binary that includes GPL-3.0-only code is the usual trigger. Internal use with no copy leaving the company is a different situation. Read the actual text, not the family nickname.
What is corresponding source for GPL-3.0-only?
Corresponding source is the source a recipient needs to build and run the same binary, including scripts and interface files the license names. Hosting a repository URL can be an offer. The offer has to match what you actually shipped. SourceTrust records that a person on your team confirmed the offer. It does not publish your source and does not host a mirror.
How is GPL-3.0-only different from GNU GPL v3.0 or later?
GPL-3.0-only asks this: GPL-3.0 keeps the source duty on distributed binaries and adds a patent grant, an anti-lockdown rule for consumer devices, and a cure period. GNU GPL v3.0 or later asks this: GPL-3.0-or-later is GPLv3 plus permission to take a later FSF GPL. That election is how Apache-2.0 code becomes combinable in a GPL tree. Open the GNU GPL v3.0 or later page for what that license requires when you ship. Do not treat the SPDX ids as interchangeable because the short names look similar.
Where do I record GPL-3.0-only for a buyer?
The catalog marks GPL-3.0-only as copyleft, so a source offer item appears on the project checklist when the distribution context is Distributed binary or Mixed, and nothing appears for a SaaS-only project. The item waits for a person: someone on your team confirms it, and publishing is blocked until every applicable item is confirmed. The tick is stored per obligation on the component. Who approved the component, and when, is recorded on the component's approval decision. SourceTrust does not check that you actually shipped the source.
Where do I record GPL-3.0-only for a buyer?
The catalog marks GPL-3.0-only as copyleft, so a source offer item appears on the project checklist when the distribution context is Distributed binary or Mixed, and nothing appears for a SaaS-only project. The item waits for a person: someone on your team confirms it, and publishing is blocked until every applicable item is confirmed.
The tick is stored per obligation on the component. Who approved the component, and when, is recorded on the component's approval decision.
SourceTrust does not check that you actually shipped the source. Read /docs/reviewing-component for the review flow.
- There is no separate checklist item for the section 6 Installation Information. SourceTrust raises one source offer item, and the device question belongs in your own review notes.
- A component that declares GPL-3.0-or-later is a different grant. Do not treat the two ids as one page. The fetcher will mismatch an or-later text under an only id.
See also
The hub is the pillar for this cluster. Sibling licenses are the other spokes. Product FAQ links explain how SourceTrust records the duty, not the license text itself.
Practical guidance for procurement review, not legal advice. Confirm high-stakes use with counsel.