GPL-3.0-or-later is GPLv3 plus permission to take a later FSF GPL. That election is how Apache-2.0 code becomes combinable in a GPL tree.
On this page
What it does
GNU GPL v3.0 or later is the GPLv3 grant plus permission to use any later GPL published by the FSF. Distribution of a combined work still requires corresponding source under GPLv3 until someone elects a later version. GPLv3 adds patent terms, Installation Information for User Products, and a 30-day cure. The 'or later' token is what lets a downstream party relicense onto a future GPL, and it is also what makes Apache-2.0 combinable in practice. GCC, Bash, GIMP and Ansible ship in this form. Contrast GPL-3.0-only, which pins version 3.
Details
For a hosted product, GPL-3.0-or-later behaves like GPL-3.0-only: no network clause, and no source duty as long as you never hand out a copy. For hardware it is still the harder GPL. Section 6 asks for Installation Information when the binary ships inside a User Product. The extra work versus GPL-3.0-only is recording that recipients may elect a later GPL, and not treating a header that says 'only' as this grant.
Pros
- Clear rules for sharing improvements. Recipients of a binary can ask for the corresponding source.
- The or-later token is the usual path for combining Apache-2.0 into a GPL tree.
Cons
- Shipping a combined binary usually means offering corresponding source under GPLv3, including Installation Information on a User Product.
- A later FSF GPL, if one appears, can change the terms a recipient elects. Record which version you actually shipped.
What it allows and requires
Choose a category to see the full grant in one scannable list. Permissions show what the license allows, limits show what it withholds, and obligations show the conditions your release process must satisfy.
Permissions
Commercial use
You may ship the code inside a paid product. The license does not restrict commercial use.
Modify
You may change the code, including keeping those changes private, unless a later obligation says otherwise.
Distribute
You may give copies to others. Distribution is what usually turns notice and source duties into real work.
Private use
Use inside your company, including internal forks, does not by itself trigger distribution duties.
Limits
Hold liable
The authors disclaim warranty. Recipients cannot hold them liable for damages arising from the software, except where law forbids that disclaimer.
Use trademark
The license is not a trademark license. Names, logos and product marks stay with their owners unless a separate grant says otherwise.
Open your product
Copyleft can reach a combined work you distribute, not only the original files. How far that reaches in your stack is a counsel question.
Network copyleft
Classic GPL has no network clause. Offering the program as a hosted service, without distributing a copy, does not by itself trigger the source offer.
Obligations
Include copyright
Keep copyright notices on distributed copies.
Include license
Give recipients a copy of the license with the program.
Disclose source
When you distribute a binary of a covered work, corresponding source has to be offered in the way the license describes.
Same license
The combined work you distribute has to stay under this license. You cannot close the covered work with a more restrictive grant.
Later GPL
Or later lets a recipient take a future GPL from the FSF. The copy you ship still has to meet GPLv3, including Installation Information on a User Product.
What GPL-3.0-or-later requires when you ship
When you distribute a binary that includes GPL-3.0-or-later code, notice still travels with the copy, and the corresponding source has to be available under the same license. Internal use without a copy leaving the company is a different situation. The list below is the shipping work: what a recipient of that binary can demand, and what you record so a buyer can see it.
You meet the terms while the code stays on machines you control. GPL-3.0-or-later has no network clause, so hosting it as a service creates no source duty on its own.
You meet them on a shipped binary when recipients get the complete corresponding source of the combined work under GPLv3, with the scripts needed to build and install it, unless they have elected a later GPL.
You meet section 6 when a consumer product ships with the Installation Information its owner needs to run a modified build on the device, signing steps and keys included.
You keep the or-later grant visible when headers, SPDX, and the shipped license text all say or later, so a recipient can actually elect a future GPL.
You have handled Apache-2.0 in the tree when the GPL side is this grant, not GPL-2.0-only. The or-later token is what makes that combination work in practice.
The duties named in GPL-3.0-or-later
Notice still travels with the copy. On top of that, GPL-3.0-or-later names a source duty. These are the conditions in the text. The how-to above is when they become real work.
Include copyright
Keep copyright notices on distributed copies.
Include license
Give recipients a copy of the license with the program.
Disclose source
When you distribute a binary of a covered work, corresponding source has to be offered in the way the license describes.
Same license
The combined work you distribute has to stay under this license. You cannot close the covered work with a more restrictive grant.
Later GPL
Or later lets a recipient take a future GPL from the FSF. The copy you ship still has to meet GPLv3, including Installation Information on a User Product.
Things to be aware of
- Treating GCC, Bash or Ansible as GPL-3.0-only. Those projects ship or-later, and pinning only would strip the upgrade the authors granted.
- Reading or-later as a network trigger. The network clause lives in the AGPL. Or-later is about future GPL versions.
- Combining this grant with GPL-2.0-only files and calling it a version bump. Check every header before you assume the versions line up.
What the GNU GPL v3.0 or later does not do
Search results often flatten GNU GPL v3.0 or later into a slogan. These are the usual misreads. GPL-3.0-or-later is a grant with conditions, not a permission to skip the paperwork below.
- GPL-3.0-or-later does not let you keep the combined program closed if you distribute it. The reciprocal duty still reaches the work as a whole under GPLv3 until a later version is elected.
- It is not a network license. The or-later token is about future GPL versions from the FSF, not about AGPL section 13.
How GPL-3.0-or-later differs from nearby licenses
These licenses are often confused with GPL-3.0-or-later, but their release duties differ. Each row summarizes what the license requires when you ship. Open the linked page for the full checklist.
- GPL-3.0-or-later
- GPL-3.0-or-later is GPLv3 plus permission to take a later FSF GPL. That election is how Apache-2.0 code becomes combinable in a GPL tree.
- GPL-3.0-only
- GPL-3.0 keeps the source duty on distributed binaries and adds a patent grant, an anti-lockdown rule for consumer devices, and a cure period.
- GPL-2.0-or-later
- GPL-2.0 asks for source when you hand someone a binary. Running it on your own servers triggers nothing. The trigger is shipping a copy, not merely using it.
- AGPL-3.0-or-later
- AGPL-3.0-or-later is AGPLv3 plus permission to take a later Affero GPL. Section 13 still attaches to a modified version users reach over a network.
Common questions about GNU GPL v3.0 or later
Answers to common questions about what GNU GPL v3.0 or later requires, when its duties apply, and what evidence belongs with a release.
What is the GNU GPL v3.0 or later?
GNU GPL v3.0 or later is the GPLv3 grant plus permission to use any later GPL published by the FSF. Distribution of a combined work still requires corresponding source under GPLv3 until someone elects a later version. GPLv3 adds patent terms, Installation Information for User Products, and a 30-day cure. The 'or later' token is what lets a downstream party relicense onto a future GPL, and it is also what makes Apache-2.0 combinable in practice. GCC, Bash, GIMP and Ansible ship in this form. Contrast GPL-3.0-only, which pins version 3.
What does GPL-3.0-or-later require when you ship a product?
You meet the terms while the code stays on machines you control. GPL-3.0-or-later has no network clause, so hosting it as a service creates no source duty on its own. You meet them on a shipped binary when recipients get the complete corresponding source of the combined work under GPLv3, with the scripts needed to build and install it, unless they have elected a later GPL. You meet section 6 when a consumer product ships with the Installation Information its owner needs to run a modified build on the device, signing steps and keys included. You keep the or-later grant visible when headers, SPDX, and the shipped license text all say or later, so a recipient can actually elect a future GPL. You have handled Apache-2.0 in the tree when the GPL side is this grant, not GPL-2.0-only. The or-later token is what makes that combination work in practice.
Does hosting a product that uses GPL-3.0-or-later trigger extra duties?
Hosting alone usually does not trigger the source duty for GPL-3.0-or-later. Shipping a binary, a container, or an on-prem build does. Notice still travels with any copy you hand over.
Does linking to GPL-3.0-or-later force me to open my application?
For strong copyleft such as GPL-3.0-or-later, the FSF reads static and dynamic linking as one combined work when you distribute the result. Shipping a binary that includes GPL-3.0-or-later code is the usual trigger. Internal use with no copy leaving the company is a different situation. Read the actual text, not the family nickname.
What is corresponding source for GPL-3.0-or-later?
Corresponding source is the source a recipient needs to build and run the same binary, including scripts and interface files the license names. Hosting a repository URL can be an offer. The offer has to match what you actually shipped. SourceTrust records that a person on your team confirmed the offer. It does not publish your source and does not host a mirror.
How is GPL-3.0-or-later different from GNU GPL v3.0?
GPL-3.0-or-later asks this: GPL-3.0-or-later is GPLv3 plus permission to take a later FSF GPL. That election is how Apache-2.0 code becomes combinable in a GPL tree. GNU GPL v3.0 asks this: GPL-3.0 keeps the source duty on distributed binaries and adds a patent grant, an anti-lockdown rule for consumer devices, and a cure period. Open the GNU GPL v3.0 page for what that license requires when you ship. Do not treat the SPDX ids as interchangeable because the short names look similar.
Where do I record GPL-3.0-or-later for a buyer?
The catalog marks GPL-3.0-or-later as copyleft, so a source offer item appears on the project checklist when the distribution context is Distributed binary or Mixed, and nothing appears for a SaaS-only project. The item waits for a person. SourceTrust does not check that you shipped the source or that a recipient elected a later GPL. A package that declares or-later but ships an only text lands as a mismatch.
Where do I record GPL-3.0-or-later for a buyer?
The catalog marks GPL-3.0-or-later as copyleft, so a source offer item appears on the project checklist when the distribution context is Distributed binary or Mixed, and nothing appears for a SaaS-only project. The item waits for a person.
SourceTrust does not check that you shipped the source or that a recipient elected a later GPL. A package that declares or-later but ships an only text lands as a mismatch.
Read /docs/reviewing-component for the review flow.
See also
The hub is the pillar for this cluster. Sibling licenses are the other spokes. Product FAQ links explain how SourceTrust records the duty, not the license text itself.
Practical guidance for procurement review, not legal advice. Confirm high-stakes use with counsel.