When a mirror site provides binary download for GPL software (e.g. Git for Windows, when mirrored from GitHub Releases), is it mandatory that the site provide source code tarball or zipball as well? Or is it acceptable that source codes are added only on popular demand?

As far as I know of, many mirror sites exist for users' convenience, so many popular OSS are redistributed without accompanying source code because few users are interested. This (fact) led me into thinking about this question.

  • Does the site provide a link to the server where the corresponding source can be downloaded?
    – Brandin
    Sep 29 at 13:45
  • @Brandin Nope. The site uses very simple directory listing (like the built-in from Nginx or Apache2) with no additional markup. I don't think that counts as "provide" in any way.
    – iBug
    Sep 29 at 14:13

We have to look at the different versions of GPL separately.

In GPL v2 you find this sentence: "If distribution of executable or object code is made by offering access to copy from a designated place, then offering equivalent access to copy the source code from the same place counts as distribution of the source code, even though third parties are not compelled to copy the source along with the object code." This allows 2 interpretations: a) either the source code needs to come from the same place as the binary, or b) the link to the source code must be near to the link to download the executable.

In GPL v3 you find this language in section 6 d): "Convey the object code by offering access from a designated place (gratis or for a charge), and offer equivalent access to the Corresponding Source in the same way through the same place at no further charge. You need not require recipients to copy the Corresponding Source along with the object code. If the place to copy the object code is a network server, the Corresponding Source may be on a different server (operated by you or a third party) that supports equivalent copying facilities, provided you maintain clear directions next to the object code saying where to find the Corresponding Source. Regardless of what server hosts the Corresponding Source, you remain obligated to ensure that it is available for as long as needed to satisfy these requirements." This is much more verbose and clearer: as long as you make sure that the sources can be downloaded on the other server you are not obliged to offer the download yourself, you just need to provide the link.

While the language in GPL v2 is not 100% clear I tend to interpret it in the direction as it is written in GPL v3. But if you want to be on the very safe side you should host the source on your mirror.


Neither your suggested options are required. The available options for distributing a GPL v2 program such as Git are enumerated in Section 3 of the license:

  1. You may copy and distribute the Program (or a work based on it, under Section 2) in object code or executable form under the terms of Sections 1 and 2 above provided that you also do one of the following:

a) Accompany it with the complete corresponding machine-readable source code, which must be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange; or,

b) Accompany it with a written offer, valid for at least three years, to give any third party, for a charge no more than your cost of physically performing source distribution, a complete machine-readable copy of the corresponding source code, to be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange; or,

c) Accompany it with the information you received as to the offer to distribute corresponding source code. (This alternative is allowed only for noncommercial distribution and only if you received the program in object code or executable form with such an offer, in accord with Subsection b above.)

Option (a) is essentially what you are suggesting, but it would certainly be valid for the mirror sites to do (b). In most cases, I would imagine that the mirror sites distribution would count as "noncommercial" so they could simply forward on any offer they received when getting the binaries.

  • Note that GPLv3 isn't quite so laissez-faire about this; the "written offer" option can only be used under certain circumstances, which don't seem to apply in this case. If the software is GPLv3 or LGPLv3, I'd say the sites were in violation.
    – MadHatter
    Sep 29 at 15:26
  • Yeah, I may have focused a bit too much on the Git example from the question. @MadHatter while you're here can I draw your attention to chat.stackexchange.com/transcript/message/59228234#59228234 Sep 29 at 15:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.