# Open source license check: GPLv3 30-Day Cure — Ship or Hold 2026

Priya Menon · October 24, 2026

> Check the GPLv3 §8 cure path against the official license text and run the five-step register audit before any ship-or-hold decision in 2026.

This guide sets out how to check the GPLv3 §8 cure path against the license text at gnu.org/licenses/gpl-3.0.en.html and how to run a five-step register audit before any ship or hold decision during a termination challenge.

It sets out a five-step register audit—identify, trace, compare, document, decide—and the rule that shipping is allowed only when every GPL component is identifiable.

![This guide sets out how to check the — Open source license check](https://static.mm-ais.com/article-images-ai/open-source-license-check-gplv3-30-day-c-ai-e2329174.jpg)

## How GPLv3 §8 Cure Works

Start with the primary text, not a summary. GPLv3 §8 is published verbatim at gnu.org/licenses/gpl-3.0.en.html. Open that page, locate the termination and reinstatement sentences, and save the version you checked. Then compare any blog post, vendor note, or internal checklist against that text. The operative distinction is between provisional reinstatement and permanent reinstatement, and summaries often blur the two.

The mechanism begins with suspension. Under §8, an attempt to propagate or modify a covered work outside the license's terms is void and automatically terminates the licensee's rights under that license. Rights are not merely at risk; they stop unless a reinstatement condition applies. Cessation of the violation can reinstate rights provisionally, unless and until the copyright holder explicitly and finally terminates them. If the holder fails to notify the licensee by reasonable means within 60 days after cessation, that reinstatement becomes permanent.

Notice creates the 30-day cure path. If the holder notifies the licensee by reasonable means, that notice is the first notice of violation from that holder for any work, and the licensee cures before 30 days after receiving the notice, reinstatement is permanent. The clock is measured from receipt of notice, not from the date the violation began, the date an engineer found it, or the date a ticket was opened. Record the receipt date and the cure date in the same register entry.

The permanent cure is limited to first-notice cases. Where the same license has already been the subject of a violation notice, a later violation followed by notice and failure to cure leaves the holder able to make termination final and irrevocable under that license. Provisional reinstatement then functions as a temporary pause, not as a standing right to cure again. This is the point at which "we fixed the code" and "we restored the license" stop being the same statement.

| Reinstatement | Trigger under §8 |
| --- | --- |
| Provisional | Cessation of violation, unless the holder explicitly and finally terminates; also the default when the 30-day permanent cure is unavailable |
| Permanent | No notice within 60 days after cessation, or first notice plus cure within 30 days after receipt |

Use §8 as a verification step, not as a shipping authorization. The text tells you whether reinstatement is provisional or permanent; it does not tell you whether a component is identifiable, whether source was delivered, or whether a register entry is complete. Keep the saved §8 text, the notice, and the cure evidence together so a later reviewer can see which sentence of §8 was applied and on what dates.

![How GPLv3 §8 Cure Works — Open source license check](https://static.mm-ais.com/article-images-ai/open-source-license-check-gplv3-30-day-c-ai-a476f536.jpg)

## The 5-Step Cure Audit Method

When a termination notice arrives, treat it as an audit trigger rather than a shipping decision. Start from the license register, not from memory, a single SBOM, or the notice's allegations. The register must list every GPL component in the shipped binary; the quattroformaggi/checkpoint-register repository illustrates a register with import and export to Excel tables, but you should verify that your own tool exports SPDX identifiers so each component is unambiguous.

Step 1 is to identify every GPL component in the shipped binary from the register, including transitive dependencies, vendored code, and build artifacts. Step 2 is to trace each entry to its exact license version—GPLv2-only, GPLv2-or-later, or GPLv3-only—because cure rights and obligations differ by version. If a component cannot be traced to a version, mark it unresolved instead of assuming the most permissive reading.

Step 3 is to compare what you actually distributed against the license requirements for each component: whether you provided an offer of source, the full corresponding source, and the license text. Check the distributed binary's source offer location, archive completeness, and license text placement. Record each requirement as satisfied, partially satisfied, or missing; a missing offer or incomplete source archive is a gap even when the code itself is unchanged.

Step 4 is to document the audit trail. Save the register export, binary hash, source archive, notice, comparison notes, component list, gaps, owner, and decision in one record with dates. The later ship or hold decision should be reproducible from that record rather than from recollection.

Step 5 is to decide. Ship only if every GPL component is identifiable, version-traced, and requirement-complete. If any component is unresolved or any requirement is missing, hold the shipment and patch or replace before release. If all checks pass, shipping is defensible on the documented record; if not, remediation comes before release. This sequence maps the termination notice to a ship or hold decision without relying on assumptions about cure rights.

![The 5-Step Cure Audit Method — Open source license check](https://static.mm-ais.com/article-images-pixabay/open-source-license-check-gplv3-30-day-c-fe76e3e5.jpg)

## Ship vs Hold: Options Compared

After a termination notice, the shipping decision should be driven by a documented license-register audit, not by the notice's allegations or by schedule pressure. The practical choice is among four post-notice paths, and each carries a different failure mode.

The winner is cure-and-hold: pause distribution, complete the cure, obtain written reinstatement confirmation, and only then resume shipping. This path preserves the cure right and avoids compounding violations during the cure window, because no new copies of the challenged build leave the organization while the license status is unresolved.

Cure-and-ship fails because continued distribution of the same non-compliant build during the notice period can be treated as a second violation. That can convert a provisional lapse into permanent termination, turning a recoverable compliance problem into a release-blocking legal event.

Patch-and-replace is viable only if a functionally equivalent non-GPL substitute exists and can be integrated, tested, and documented before the next release. If the substitute is partial, untested, or still depends on GPL-derived code, the path becomes an uncontrolled rewrite with the same license exposure.

Negotiate when the facts are disputed, the copyright holder requests broader terms, or the product cannot pause without customer harm. Require written terms covering scope, cure conditions, and reinstatement before any resumed distribution; oral assurances or email threads without sign-off are not a shipping basis.

Use a simple gate: ship only after cure-and-hold completion or a signed reinstatement agreement; hold for cure-and-ship, unverified patch-and-replace, or open negotiation. The table summarizes the comparison.

| Path | Use when | Primary risk |
| --- | --- | --- |
| Cure-and-hold | License status can be corrected without shipping | Schedule delay |
| Cure-and-ship | Never as a default | Second violation and permanent termination |
| Patch-and-replace | Equivalent non-GPL substitute is ready | Incomplete replacement or hidden GPL dependency |
| Negotiate | Facts or terms are disputed | Shipping before written reinstatement |

![Ship vs Hold: Options Compared — Open source license check](https://static.mm-ais.com/article-images-pixabay/open-source-license-check-gplv3-30-day-c-fb1891f3.jpg)

## Costs of Wrong Ship/Hold Calls

The two errors are not symmetric. Shipping during a cure window can convert a temporary compliance problem into a permanent loss of rights, while holding a compliant build only defers revenue for a bounded period. That asymmetry is the reason the ship decision should be treated as a risk decision, not a schedule decision.

A wrong ship call can end in permanent, irrevocable termination of rights to the affected GPL component under §8 for a second violation. The practical cost is not a fine; it is the engineering cost of rewriting or removing that component from the product. Price that exposure component by component: count the lines of code attributable to each GPL component, multiply by the blended engineer rate, and add the integration and regression work needed to remove or replace it. If a component cannot be isolated in the codebase, treat the exposure as the cost of replacing the whole affected subsystem, not just the component.

A wrong hold call costs forfeited revenue and release slippage, but only for the cure period. If the Section 2 audit is run immediately, that delay is at most 30 days. There is no rewrite, no removal, and no permanent loss of rights; the downside is a bounded delay rather than an unbounded engineering project. Price it as the revenue and schedule impact of that at-most-30-day window, not as a product-wide failure.

The useful comparison is not "ship versus hold" in the abstract; it is the size of the GPL footprint versus the value of the release date. A small, well-isolated GPL component makes a wrong ship survivable; a large or entangled one makes it a rewrite. That is why the register must show component boundaries before the decision, not after the notice.

Because the wrong-ship downside is unbounded and component-specific while the wrong-hold downside is bounded by the cure window, the default should be hold whenever any GPL component is not identifiable in the register. Ship only when the audit shows every GPL component is identifiable, traceable, and documented; otherwise, the cheaper error is the delay.

| Wrong call | Primary loss | How to price it | Time bound |
| --- | --- | --- | --- |
| Ship | Permanent loss of rights to the GPL component; rewrite or removal | Lines of code per GPL component × blended engineer rate, plus integration and regression | None; persists until replaced |
| Hold | Forfeited revenue and release slippage | Revenue and schedule impact of the delay | At most 30 days if the audit runs immediately |

![Costs of Wrong Ship/Hold Calls — Open source license check](https://static.mm-ais.com/article-images-pixabay/open-source-license-check-gplv3-30-day-c-353e5ffb.jpg)

## Limits and Edge Cases Table

This section covers the cases where the GPLv3 cure framework stops being a reliable ship/hold test: LGPL components, GPLv2-only code, dual-licensed code, multiple copyright holders, and MIA copyright holders who cannot be identified or served. In those cases, the register audit must switch from cure-window arithmetic to license-text and holder-specific checks.

An LGPL library is not a drop-in substitute for a GPLv3 component in the audit. LGPL compliance turns on relinking and interface obligations that differ by version, so applying the GPLv3 ship/hold test to it misstates both the alleged violation and any cure. The register entry should name the exact LGPL version, and the component should be checked against that version's text before any ship/hold call.

GPLv2-only code has no 30-day cure window in the GPLv3 sense; the analysis does not transfer. A v2 violation therefore requires a separate remedy negotiation with the holder, and the audit should mark the component as not governed by the GPLv3 cure path rather than as curable.

Where several copyright holders exist, §8 reinstatement is per holder: a cure accepted by one holder does not automatically restore rights granted by another, so the register must track holder-by-holder status. Dual-licensed code may be governed by the non-GPL grant or a separate agreement, and an MIA holder breaks the notice-and-cure sequence; both cases require escalation and documented contact attempts rather than a routine cure-and-ship decision.

| Edge case | Why the GPLv3 cure test misapplies | Register action |
| --- | --- | --- |
| LGPL component | Relinking and interface obligations differ by LGPL version | Record exact LGPL version and check that version's text |
| GPLv2-only component | No GPLv3 30-day cure window applies | Mark not governed by GPLv3 cure; negotiate remedy separately |
| Multiple copyright holders | Reinstatement is per holder | Track holder-by-holder cure status |
| Dual-licensed component | Non-GPL grant or agreement may govern | Check the grant and any commercial agreement first |
| MIA copyright holder | Notice-and-cure sequence may not be operable | Escalate and document all contact attempts |

Ship only if every GPL component is identifiable, its holder and license version are recorded, and none of the edge cases above remains unresolved in the register.

## What to do next

| Step | Action | Why it matters |
| --- | --- | --- |
| 1 | Identify every GPL component in the product and confirm each is identifiable in the license register. | Shipping is allowed only when every GPL component is identifiable; an unidentified component means hold. |
| 2 | Trace each identified GPL component to its source, version, and register entry, moving license-register evidence between systems when needed for audit support. | It creates an auditable chain from code to register before the 30-day window closes. |
| 3 | Compare the traced entries with the copyright holder's notice and the specific §8 cure condition, using the checkpoint-register tool's import and export to Excel tables. | It tests whether the cure condition can be stated in writing to counsel. |
| 4 | Document the audit findings and the written §8 cure condition for counsel within the 30-day window. | Cure within 30 days restores rights provisionally, and permanent restoration applies after a first violation. |
| 5 | Decide ship or hold: ship only if every GPL component is identifiable and the specific §8 cure condition can be stated in writing to counsel within the 30-day window; otherwise hold during the cure window. | This applies the canonical decision rule and avoids shipping under an unresolved termination challenge. |

## Frequently Asked Questions

**Where must the GPLv3 §8 cure check begin?**

It must begin with the primary text at gnu.org/licenses/gpl-3.0.en.html, not a summary.

**What are the five register audit steps?**

They are identify, trace, compare, document, and decide.

**When is shipping allowed under the register audit rule?**

Shipping is allowed only when every GPL component is identifiable.

**What must be saved after locating the termination and reinstatement sentences?**

The version of the page that was checked must be saved.

**What happens to rights under §8 after an out-of-terms propagation or modification attempt?**

The attempt is void and automatically terminates the licensee's rights under that license.

**What can make provisional reinstatement become permanent?**

It becomes permanent if the copyright holder fails to notify the licensee by reasonable means within the stated post-cessation period.

## Quick answers

| Where is GPLv3 §8 published verbatim? | GPLv3 §8 is published verbatim at gnu.org/licenses/gpl-3.0.en.html. |
| --- | --- |
| What are the five steps of the register audit? | The five-step register audit is identify, trace, compare, document, decide. |
| When is shipping allowed during a termination challenge? | Shipping is allowed only when every GPL component is identifiable. |
| What happens to an attempt to propagate or modify a covered work outside the license's terms? | It is void and automatically terminates the licensee's rights under that license. |
| What happens if the copyright holder fails to notify the licensee by reasonable means after cessation? | That reinstatement becomes permanent. |

Also worth reading: **Open Weight Model Licenses: Llama vs Mistral vs Qwen IP Clauses for SaaS Build or License**: [Open Weight Model Licenses: Llama](https://iprs.cloud/blog/open-weight-model-licenses-llama-vs-mistral-vs-qwen-ip-clauses-for-saas-build-or-license.php) · **Why Your Product Launch Needs a Pre-Filing IP Check**: [Why Your Product Launch Needs](https://iprs.cloud/blog/why_your_product_launch_needs_a_pre_filing_ip_check.php)

### Related reading

- [Open Weight Model Licenses: Llama vs Mistral vs Qwen IP Clauses for SaaS Build or License](https://iprs.cloud/blog/open-weight-model-licenses-llama-vs-mistral-vs-qwen-ip-clauses-for-saas-build-or-license.php)
- [2026 Centralized License Register: Legal Review 5 Days to 1](https://iprs.cloud/blog/2026-centralized-license-register-legal-review-5-days-to-1.php)
- [AI Inventorship After Thaler: MPEP §1.03(a) 2025—Name or Exclude?](https://iprs.cloud/blog/ai-inventorship-after-thaler-mpep-103a-2025name-or-exclude.php)
- [Provisional Patent at Month 12: Convert, PCT, Refile, or Abandon?](https://iprs.cloud/blog/provisional-patent-at-month-12-convert-pct-refile-or-abandon.php)
- [Patent Sustainability Map: World Patent Body Class Map Flags 33% Overlap—Report or Not?](https://iprs.cloud/blog/patent-sustainability-map-world-patent-body-class-map-flags-33-overlapreport-or-not.php)
- [Weight loss drug patents: 2024-2025 longevity indications hit 37 — watch or challenge?](https://iprs.cloud/blog/weight-loss-drug-patents-2024-2025-longevity-indications-hit-37-watch-or-challenge.php)

### Latest

- [AI Inventorship After Thaler: MPEP §1.03(a) 2025—Name or Exclude?](https://iprs.cloud/blog/ai-inventorship-after-thaler-mpep-103a-2025name-or-exclude.php)
- [Provisional Patent at Month 12: Convert, PCT, Refile, or Abandon?](https://iprs.cloud/blog/provisional-patent-at-month-12-convert-pct-refile-or-abandon.php)
- [Open Weight Model Licenses: Llama vs Mistral vs Qwen IP Clauses for SaaS Build...](https://iprs.cloud/blog/open-weight-model-licenses-llama-vs-mistral-vs-qwen-ip-clauses-for-saas-build-or-license.php)

Canonical: https://iprs.cloud/blog/open-source-license-check-gplv3-30-day-cure-ship-or-hold-2026.php
Markdown: https://iprs.cloud/blog/open-source-license-check-gplv3-30-day-cure-ship-or-hold-2026.php/index.md