My general thoughts, and personal opinion on the matter is as follows.I have seen several permutations of this phenomenon where the license in the distribution is different from that on the project's web site.

For example:

  1. the GPLv2 is in the downloaded distribution, and the project web site specifically states the project is released under GPLv2, but links to the generic http://www.gnu.org/licenses/gpl.html which of course now links to the text of GPLv3;
  2. the GPLv2 is in the downloaded distribution and the project web site says to either check the LICENSE.TXT file in the distribution for license info or to go to a link on the project web site, which it states *supersedes* what is included in the distribution (I've been looking, but at the moment I cannot find the project that did this);
  3. the GPLv2 is in the downloaded distribution and the project web site says only that the GPL (no version number specified) applies to the project but actually shows the full text of the GPLv3 license on the project web site.

I am fairly certain that the license included in the distribution governs the user who downloads and installs software from that distribution. Otherwise there would be no certainty or consistency for end users about what license terms they are bound by, particularly if they receive the distribution via CD or some other media not downloaded and no files within the distribution give notice that any "later" or other version of a license applies. However, if a file in the distribution gives notice that current license terms are on the project web site, the end user may be obligated to check there before accepting and using the software. Then the issue of the generic GPL link comes into play. The generic link to the GPL license that so many projects use probably needs to be reevaluated and clarified by each project lead on a project-per-project basis. This is an additional burden on project leaders, probably unintentional on the part of the Free Software Foundation, but each project needs to determine whether they want to be pointing their GPL link to the GPLv3 or the GPLv2. I think that unless an end user is given notice within the project distribution that they need to go to the project web site for license terms or that some other license or version of a license applies, the end user can only be bound by what they find in the distribution.This is a tricky issue, and I'd be interested to see what, if anything, the FSF has to say about it.

 

Ernie Park