Context

On 29 June 2007 the Free Software Foundation published version 3 of the GNU General Public License, sixteen years after version 2 of 1991. The text comes at the end of roughly eighteen months of public consultation and four discussion drafts, with comments collected through the platform at gplv3.fsf.org. The GNU Lesser General Public License version 3 came out the same day, rewritten as a set of additional permissions on top of GPLv3 rather than as a licence in its own right.

GPLv2 held up well as long as free software circulated mostly as source and binary on general-purpose machines. After 1991 three practices emerged that the text could no longer stop, and that ate away at the freedoms it set out to protect: software patents used as contractual leverage, patent-licensing deals that discriminate between recipients, and hardware that accepts free firmware but refuses to run modified builds of it. Version 3 acts on all three fronts.

Anti-tivoization

GPLv2 guarantees access to the corresponding source for a distributed binary. What the device does with a recompiled binary, on the other hand, it leaves unsaid. Some manufacturers exploited that silence: they ship the firmware source, as required, but the device checks a cryptographic signature at boot and refuses to run any binary not signed by the manufacturer. The user has the source, edits it, recompiles it, and cannot get the result to run on their own appliance. The term tivoization comes from TiVo digital video recorders, which worked in exactly this way.

GPLv3 handles the practice in section 6, with the notion of Installation Information. For a “User Product” — a definition taken from US consumer-warranty law, that is a consumer good or an object normally used for personal or household purposes — anyone distributing a binary must also hand over whatever is needed to install and run modified versions on the same device, signing keys included. The requirement bans neither code signing nor secure boot: it bans using them to deny the user the ability to run their own build. Software written permanently into ROM falls outside it, as do the cases where modification is provided to no one, the manufacturer included.

Patents

Section 11 of GPLv3 sets down in black and white what v2 left to arguments about implied licensing. Each contributor grants every recipient of the software a non-exclusive, worldwide, royalty-free patent licence over all patent claims they control that their version of the code would infringe. The grant covers use, modification and redistribution. This shuts off the route of contributing code and later revealing patent coverage in order to charge users a royalty.

The same section deals with a specific case that emerged in November 2006, the Microsoft–Novell agreement, in which a distributor obtained from a third party a promise not to assert patents, but only towards that distributor’s own customers. GPLv3 provides that anyone distributing free software while relying on such an arrangement, under which some recipients gain patent protection and others do not, extends that same protection to all recipients, automatically. The clause removes any economic point to a discriminatory deal for a GPLv3 distributor.

Apache 2.0 compatibility

Under GPLv2 you could not combine GPL code and code released under the Apache License 2.0 in a single work. Apache 2.0 carries patent and indemnification clauses that GPLv2 read as further restrictions, and GPLv2 tolerates no restrictions beyond its own text. The incompatibility ran one way only, but it was real and cut out a growing body of code.

GPLv3 unties the knot by explicitly admitting certain categories of additional terms, among them patent and indemnification clauses of the kind Apache carries with it. Apache 2.0 code can therefore be folded into a GPLv3 project, while the reverse path stays closed by the structure of the permissive licence. Compatibility runs one way only, and that is enough for almost every practical use, where the resulting project is itself copyleft.

The Linux kernel stays on v2

Linus Torvalds has confirmed that the Linux kernel remains under GPLv2. He had already taken a stand against migration in early 2006; on 12 June 2007, on the Linux Kernel Mailing List, he repeated that he had no intention of moving to v3 and named the anti-tivoization requirement as the main reason for refusing. For Torvalds GPLv2 sets up a symmetric exchange — you receive the source, you give back your changes — whereas a constraint on hardware devices reaches beyond that exchange.

There is a structural obstacle as well. The kernel is distributed under GPLv2 without the “or any later version” clause, so it does not inherit v3 by itself. Changing the licence would need the agreement of thousands of copyright holders across the individual contributions, many of them by now untraceable. Even if it were wanted, the migration would be impractical.

Implications and limits

The ecosystem now has two versions of the reference copyleft in use at the same time. GNU projects take v3; the kernel and its close dependencies stay on v2. Coexistence is manageable at the operating-system level, because kernel and userspace are separate works that talk through system calls, not one derived work. The problem makes itself felt when you want to link v2-only and v3-only code into a single binary: the two are not compatible with each other, and the only bridge is the “or later” clause, where a project includes it.

Open questions remain that the text does not settle on its own. The definition of “User Product” and the reach of Installation Information will be clarified by practice and, sooner or later, by some dispute. Apache 2.0 compatibility holds for combining code, but the licence fragmentation of real projects — dependencies under different licences, files with mixed headers — still calls for a case-by-case review that no clause removes.

Cover image: Official logo of the GNU GPL version 3: the wordmark “GPLv3” in red on a white background — logo by Free Software Foundation, public domain — https://commons.wikimedia.org/wiki/File:GPLv3_Logo.svg