If you convey GPLv3 licensed object code, section 6 requires you to provide the Corresponding Source, either with the binary or through a written offer. For a physical product, the offer must be valid for at least three years and for as long as you offer spare parts or support for that model.
The options in section 6
Section 6 gives several ways to convey object code. In summary:
- 6a. Ship the object code in a physical product with the source on a durable physical medium.
- 6b. Ship the product with a written offer, valid at least three years and as long as you offer spare parts or customer support, to give anyone who has the object code the source. The source can be on a physical medium for a price no more than your reasonable cost of conveying it, or from a network server at no charge.
- 6c. Pass along an offer you yourself received. This is allowed only occasionally and noncommercially.
- 6d. Offer access to the object code from a designated place, with equivalent access to the source in the same way.
For software downloads, option 6d is the usual route: put the source beside the binary.
What the offer must cover
The offer must reach the Corresponding Source for all the software in the product that the license covers. Not just your own patch, and not only the top level package. A device image or a container with ten GPL components needs source access for each of them.
The GNU FAQ adds that a written offer under GPLv2 for binary distribution must be valid for any third party, so people who got the binary indirectly can still ask for source.
Containers and images
An image with GPL packages inside is conveying those packages when you hand it to customers. The same logic applies as for an appliance. Teams often discover this late, when a customer asks. An SBOM of the image is the fastest way to know which packages need source access.
Checklist before a release
- Build a component list for every shipped artifact.
- Mark each component under GPL, LGPL or AGPL.
- Choose the delivery route per artifact (source next to download, or offer).
- Put the license texts and the source offer in the product or its documentation.
- Keep the source for the stated period and keep the link alive.
Safeguard generates SBOMs for images and projects, which feeds step 1. The free scan shows what that looks like. Counsel should confirm the route.
Quick check
How long must a written offer last for a physical product?
At least three years, and as long as you offer spare parts or customer support for that product model, per GPLv3 section 6b.
Does the offer cover only my modifications?
No. It covers the Corresponding Source for all the software in the product that is covered by the license.
Sources
This post is general information, not legal advice.
Last reviewed: 19 October 2026.
