Can I bundle a GPL-2 binary (Pandoc) with my GPL-3 app?

Question

I’ve made a GPL-3 licensed app, the source code and binary releases of which are available on GitHub.

• Can I bundle the Pandoc and Pandoc-citeproc binaries with my app? These binaries are GPL-2 licensed.
• Can I upload these binaries to GitHub?
• Do I have to note anywhere in my app that I have bundled these binaries? (In the source code, in the user interface, or both?)
• If so, is there any common text that is used to notify users that a binary has been bundled with an app?

The license text for Pandoc reads:

This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version.

I’ve read some similar threads on this Stack Exchange, mostly about FFMPEG, but I just wanted to double-check to be on the safe side because my question is specifically about open source binaries in an open source package.

Answer 1

Pandoc is available under the terms of the GPL version 2 or greater so the different versions are not relevant: you can just use the terms of the GPLv3. Even then, bundling a GPLv2 program with a GPLv3 project is fine as long as that falls under “mere aggregation”.

Yes, you can of course bundle the Pandoc binaries with you app. The same rules as for distributing other GPLv3 binaries apply (sections 4 and 6 of the GPLv3), in particular that you must also provide their source code. In my opinion it is sufficient to point to the official Pandoc repository (in particular if you also use the official Pandoc binaries), though do note that your obligations to offer the source code do not end should the official repository be deleted for some reason.

If you bundle the binaries you should make it clear that these are a separate program. E.g. I would place them into a separate third-party directory, in which I would also place their licensing information and instructions on how to obtain the source code. In the top level license file, I would also list the bundled software and their licenses. For your binary releases, the installer should also offer all of this information (easy if it is just a tarball with an installation script). However, since your software is free software as well, the usual problems do not occur, e.g. a proprietary software that would try to prevent changes to a GPL covered component.