GPL
The GNU General Public License, published by the Free Software Foundation. Drupal.org requires GPL version 2 or later for core and every hosted project.
The GNU General Public License (GPL) is the license Drupal is released under. It lets you run, change and share the code. When you distribute a work that contains or is derived from GPL code, the whole work must be licensed under the GPL as well, and you must make its source code available. Drupal core and the projects on Drupal.org use version 2 or later.
How the GPL works for Drupal 11
Drupal core ships the text of the GPL version 2 in core/LICENSE.txt, and its composer.json names the license as GPL-2.0-or-later. The "or later" part comes from section 9 of the license: when a program names its version and adds "any later version", you may follow the terms of that version or of any later version the Free Software Foundation publishes.
Three passages of the version 2 text cover running, distributing and source code:
- Running is free. Section 0 says the act of running the program is not restricted.
- Distributed works stay GPL. Section 2 requires that any work you distribute or publish that contains or derives from the program is licensed as a whole, at no charge, to all third parties under the same license.
- Source code comes along. Section 3 allows you to distribute a program in executable form only if you also provide the source code in one of the ways it lists, such as the complete source itself or a written offer for it.
Section 11 adds a disclaimer: the program comes without warranty, to the extent the law permits.
Drupal.org turns this into project rules. Modules and themes are derivative works of Drupal, so anything committed to a Drupal Git repository must be GPL version 2 or later and include its editable source. Contributors keep their copyright and agree to release the code under Drupal's license. Content on Drupal.org is a separate matter: the user guide says it is licensed under Creative Commons Attribution-ShareAlike 2.0, while sample code there is GPL version 2 or later.
Example
Before you add a module, check what license it declares. A module states it in the license property of its composer.json; the Search API module, for instance, declares GPL-2.0-or-later. To list the license of every package in a Composer-managed project, run:
composer licensesThe command prints the name, version and license of each installed package. Add --format=json for machine-readable output. A package whose license reads proprietary is closed source in Composer's vocabulary, which is a signal to read its terms before you rely on it.
Common mistakes
- Bundling an incompatible library in a module you publish. Drupal.org cannot host GPL-incompatible code and tells maintainers not to commit library code to their repositories. Declare the library as a Composer dependency instead.
- Mixing up the licenses around Drupal. The code is GPL, the Drupal.org documentation text is Creative Commons, and the name Drupal is a registered trademark of Dries Buytaert. Each has its own rules.
- Treating a license summary as legal advice. Drupal.org states that it does not give legal advice, and its FAQ sends specific cases to a copyright attorney.
For marketing and content teams
The user guide says you may download, reuse, modify and distribute project files from Drupal.org under the GPL, and section 0 of the license does not restrict running them. When you compare vendors, ask which license each module or theme declares and whether the vendor hands you code or only runs a service for you. The first question is answered by composer licenses; for the second, remember Drupal.org's position that viewing a website is not distribution. The wider idea is covered under FOSS.