"or any later version approved by me" in licensing creates confusion

[Aleksanaa]

Nowadays we (packagers) generally use the SPDX ID to classify the licenses used by open source projects. "GNU General Public License version 3.0 or any later versions" means GPL-3.0-or-later while "GNU General Public License version 3.0" means GPL-3.0-only. They are considered as different licenses.

My suggestion: If you are not sure whether or not you are okay with later versions, you can just note "GNU General Public License version 3.0", and if one day say GPL4 comes out, you can decide to switch to it, also allow to distribute with it, or reject it.

[Cu3PO42]

Hi, thanks for your message! I thought I had a SPDX ID in meson.build, but it turns out it's GPL-3.0, not GPLv3 (and I didn't realize that one was deprecated.) I'll change that for the next release. I did intentionally go with the non-plus version there since I'm not pre-approving a potential v4.

I understand it is mildly confusing, but unfortunately just going with GPLv3 creates a problem with contributions. If I license everything as just v3 right now, I'd need any contributor to sign a CLA so I can relicense as v4 later in case it's incompatible.

However, it should still be fine to distribute any package as just GPLv3.0 right now.

Can I ask what distribution you are packaging for? Just out of curiosity.

[Aleksanaa]

If I license everything as just v3 right now, I'd need any contributor to sign a CLA so I can relicense as v4 later in case it's incompatible.

Sounds reasonable, didn't notice that.

Can I ask what distribution you are packaging for? Just out of curiosity.

NixOS/nixpkgs#305361

[Maytha8]

Another thought would be specifying yourself as a proxy instead of a CLA. From the GPL-3.0 itself:

If the Program specifies that a proxy can decide which future versions of the GNU General Public License can be used, that proxy's public statement of acceptance of a version permanently authorizes you to choose that version for the Program.

BTW I'll be packaging gtk-session-lock for Debian since gtklock 3.0.0 depends on it. :)

[Cu3PO42]

Thank you! That is specifically the clause that I meant to invoke. I should probably add the term 'proxy' to make this more clear. If you have other recommendations for wording, I'd be happy to hear them.

BTW I'll be packaging gtk-session-lock for Debian since gtklock 3.0.0 depends on it. :)

That's great to hear! Thanks!