The GNU FAQ says whether a plug-in and its host form one combined program depends on how they communicate. Simple fork and exec with no intimate data exchange points to two programs. Dynamic linking with shared data structures points to one. If they are one program, the GPL reaches all of it.
The FAQ's framing
The FAQ treats plug-ins as a question of fact, not of file layout. Two cases mark the ends of the scale:
- Separate programs. Communication through fork and exec, pipes or sockets with no intimate sharing of data structures.
- One combined program. Dynamic linking where the plug-in and host exchange complex internal data structures.
If they form a combined program, the plug-in must be under the GPL or a GPL compatible license, and a non-free main program that loads a GPL plug-in as part of one program must itself be GPL compatible.
Cases teams run into
A proprietary app with a GPL plug-in loaded in process. The FAQ says combining a GPL plug-in with a non-free main program violates the GPL unless the plug-in's license adds an exception.
A GPL host with a proprietary plug-in. The same combined work logic applies from the other side. The plug-in must be GPL compatible if it forms one program with the host.
Tools called as subprocesses. A build tool that your app runs as a separate process, exchanging files or text, is closer to the separate programs end.
Wrapper modules. The FAQ says a GPL compatible wrapper does not avoid the issue. The combined whole still must be GPL licensed.
Questions to ask about any plug-in boundary
- Is the plug-in loaded into the host's address space?
- Do they exchange rich internal structures, or only files and messages?
- Does the plug-in make sense without the host?
- Does the licensor of the plug-in state an exception?
None of these is a legal test on its own. They help you describe the facts to counsel.
Documenting the decision
Keep an architecture note: how the component is invoked, what crosses the boundary and who approved it. A change in the integration, say from a subprocess to an in process library, is a trigger to review again.
Safeguard's SBOM and dependency scanning list the components, though the integration style is something your architecture notes must capture. The free scan covers the inventory part.
Quick check
Does running a GPL tool as a subprocess make my app GPL?
The FAQ suggests simple fork and exec with no intimate data exchange points to separate programs. The facts of your case still decide.
Does a wrapper module solve a linking issue?
According to the FAQ, no. The combined whole must still be GPL licensed.
Sources
This post is general information, not legal advice.
Last reviewed: 19 October 2026.
