9 ms·

>Why do people even buy QT Commercial? LGPL is a very easy license to comply with. Qt is used a lot on embedded devices (i.e. car infotainment systems, smart T

by ndiddy 2y ago

>Why do people even buy QT Commercial? LGPL is a very easy license to comply with. Qt is used a lot on embedded devices (i.e. car infotainment systems, smart TVs, smart appliances, etc). Complying with LGPLv3 means that the user must be allowed to reverse engineer the product and upload a modified version of the software to the product. This blocks practices such as firmware signing, so a lot of companies would rather pay for Qt than comply with LGPLv3.

spookie 2y ago
GPL 2 with the Classpath/Linking Exception? Still, not many do this.
riedel 2y ago
Why would you need to allow modifications the binary und er LGPL? You will need to ship the source of qt and all mods you made to it, but that is it. Or am I missing sth?
- bramblerose 2y ago
  You also have to allow the end user to make changes to the LGPL software running on the device.
- seba_dos1 2y ago
  Yes, you're missing the ability for the user to install and use the modified code, which is one of the main things that LGPLv3 introduced over LGPLv2.1.
- tsimionescu 2y ago
  Unless the software is written to ROM or otherwise made not modifiable by anyone, the creators of the GPL intend that the end user gains the right to modify this software. If using a version before GPL/LGPL/AGPLv3, it is ok if the proprietary parts of the system stop running if the software is not an official build. With the v3 versions, even this is not ok. Now, I believe Linus Torvalds for example interprets the license differently, and doesn't believe that a company using Linux on an embedded system is obligated to allow their customers to apply a patch to this Linux system (and he certainly doesn't want the manufacturer to be forced to make their proprietary software run on top of the modified Linux, which is why he never wanted the Linux sources to be updated to GPLv3, even if it were feasible to do so).
  - riedel 2y ago
    OK, understood. One remaining question: is it enough to allow the re-linking to run in developer or emulated hw? Does LGPL e.g. forbid code signing of firmware?
    - tsimionescu 2y ago
      No, according to the FSF and SFC at least. The goal is to allow end users to patch the GPL parts of their physical device. Whether the device has to keep functioning as before is more debatable, but being able to run the code in a separate, emulated, device is not good enough.
  - pabs3 2y ago
    With the GPLv3/AGPLv3 versions, it is still OK to break the proprietary parts. For the LGPL in general, you have to be able to re-link, so that isn't OK I think. https://events19.linuxfoundation.org/wp-content/uploads/2017/11/Safely-Copylefted-Cars-Reexamining-GPLv3-Installation-Information-Requirements-ALS-Bradley-Kuhn-Behan-Webster-1.pdf https://events19.linuxfoundation.org/wp-content/uploads/2017...
    - tsimionescu 2y ago
      This is still a matter of interpretation. Here is an exchange that this same author has had with Stallman about Stallman's opinion on the GPLv3 (and his intention) [0]: > Specifically, I asked him on 2012-05-05: > > [so], these words in GPLv3: “The information must suffice to ensure that the continued functioning of the modified object code is in no case prevented or interfered with solely because modification has been made.” mean that the proprietary software that is not a combined work with the GPLv3'd work must also function? > Stallman replied on 2012-05-06 with: > > Absolutely. And I wrote it specifically to do that! I don't think this has ever been litigated, so we don't know what a judge and jury would find, but I suspect that if they found Bradley Kuhn is right, there may be a GPLv4 that is more explicit about requiring the device to keep functioning as it was, not just as a dev board as he calls it in these slides. And that GPLv4 would apply automatically to lots of GPL software going forward (because of the "or later" clause that many projects are using). I also think he is explicitly contradicting his earlier article to some extent. He also mentions in that that the whole original purpose of the GPL, as also told by Stallman, was to be able to fox your own printer by patching its code when you find a bug in it. It's clear that "turn the printer into a dev board by blowing a fuse" doesn't achieve this original goal at least - whether it achieves the license terms as written is more debatable. [0] https://sfconservancy.org/blog/2021/jul/23/tivoization-and-the-gpl-right-to-install/ https://sfconservancy.org/blog/2021/jul/23/tivoization-and-t...
Rochus 2y ago
LeanQt still has LGPL 2; never saw a need or advantage to switch to more recent versions.
aaron695 2y ago
[dead]
azalemeth 2y ago
That frankly makes me just wish it was legislated to be true. Sigh. Reverse engineering iot devices that are supposed to help you shouldn't be a necessary step but it looks like it increasingly is...
indrora 2y ago
This is false, and one of the simultaneous boons and banes of the GPL family of licenses. LGPL compliance is achieved purely by providing a copy of your version of the source code; if no modifications have been made to the LGPL portion, a simple link to upstream is sufficient, otherwise a “reasonable” means of getting the same code (full tarball, diff against upstream at some point in time, etc) is needed. The LGPL (and GPL overall) does not make any provision that the user MUST be able to replace the object binary, only that source is provided to enable doing so if you break whatever tamper seals are there for yourself.
- ndiddy 2y ago
  Please don't make claims like "this is false" if you aren't familiar with the licenses you're commenting on. Section 4e of the LGPLv3 says that one of the conditions for conveying a "combined work" (such as a proprietary application that links with an LGPLv3 library) is "Provide Installation Information, but only if you would otherwise be required to provide such information under section 6 of the GNU GPL, and only to the extent that such information is necessary to install and execute a modified version of the Combined Work produced by recombining or relinking the Application with a modified version of the Linked Version." The relevant quote from Section 6 of the GPLv3 is: > “Installation Information” for a User Product means any methods, procedures, authorization keys, or other information required to install and execute modified versions of a covered work in that User Product from a modified version of its Corresponding Source. The information must suffice to ensure that the continued functioning of the modified object code is in no case prevented or interfered with solely because modification has been made. > If you convey an object code work under this section in, or with, or specifically for use in, a User Product, and the conveying occurs as part of a transaction in which the right of possession and use of the User Product is transferred to the recipient in perpetuity or for a fixed term (regardless of how the transaction is characterized), the Corresponding Source conveyed under this section must be accompanied by the Installation Information. But this requirement does not apply if neither you nor any third party retains the ability to install modified object code on the User Product (for example, the work has been installed in ROM). In summary, if you ship a device that is physically capable of running modified code, you must give users the ability to both link the LGPL'd library with your proprietary code and to write the resulting modified firmware to the device.

by ndiddy 2y ago

spookie 2y ago

GPL 2 with the Classpath/Linking Exception? Still, not many do this.

riedel 2y ago

Why would you need to allow modifications the binary und er LGPL? You will need to ship the source of qt and all mods you made to it, but that is it. Or am I missing sth?

bramblerose 2y ago
You also have to allow the end user to make changes to the LGPL software running on the device.
seba_dos1 2y ago
Yes, you're missing the ability for the user to install and use the modified code, which is one of the main things that LGPLv3 introduced over LGPLv2.1.
tsimionescu 2y ago
Unless the software is written to ROM or otherwise made not modifiable by anyone, the creators of the GPL intend that the end user gains the right to modify this software. If using a version before GPL/LGPL/AGPLv3, it is ok if the proprietary parts of the system stop running if the software is not an official build. With the v3 versions, even this is not ok. Now, I believe Linus Torvalds for example interprets the license differently, and doesn't believe that a company using Linux on an embedded system is obligated to allow their customers to apply a patch to this Linux system (and he certainly doesn't want the manufacturer to be forced to make their proprietary software run on top of the modified Linux, which is why he never wanted the Linux sources to be updated to GPLv3, even if it were feasible to do so).
- riedel 2y ago
  OK, understood. One remaining question: is it enough to allow the re-linking to run in developer or emulated hw? Does LGPL e.g. forbid code signing of firmware?
  - tsimionescu 2y ago
    No, according to the FSF and SFC at least. The goal is to allow end users to patch the GPL parts of their physical device. Whether the device has to keep functioning as before is more debatable, but being able to run the code in a separate, emulated, device is not good enough.
- pabs3 2y ago
  With the GPLv3/AGPLv3 versions, it is still OK to break the proprietary parts. For the LGPL in general, you have to be able to re-link, so that isn't OK I think. https://events19.linuxfoundation.org/wp-content/uploads/2017/11/Safely-Copylefted-Cars-Reexamining-GPLv3-Installation-Information-Requirements-ALS-Bradley-Kuhn-Behan-Webster-1.pdf https://events19.linuxfoundation.org/wp-content/uploads/2017...
  - tsimionescu 2y ago
    This is still a matter of interpretation. Here is an exchange that this same author has had with Stallman about Stallman's opinion on the GPLv3 (and his intention) [0]: > Specifically, I asked him on 2012-05-05: > > [so], these words in GPLv3: “The information must suffice to ensure that the continued functioning of the modified object code is in no case prevented or interfered with solely because modification has been made.” mean that the proprietary software that is not a combined work with the GPLv3'd work must also function? > Stallman replied on 2012-05-06 with: > > Absolutely. And I wrote it specifically to do that! I don't think this has ever been litigated, so we don't know what a judge and jury would find, but I suspect that if they found Bradley Kuhn is right, there may be a GPLv4 that is more explicit about requiring the device to keep functioning as it was, not just as a dev board as he calls it in these slides. And that GPLv4 would apply automatically to lots of GPL software going forward (because of the "or later" clause that many projects are using). I also think he is explicitly contradicting his earlier article to some extent. He also mentions in that that the whole original purpose of the GPL, as also told by Stallman, was to be able to fox your own printer by patching its code when you find a bug in it. It's clear that "turn the printer into a dev board by blowing a fuse" doesn't achieve this original goal at least - whether it achieves the license terms as written is more debatable. [0] https://sfconservancy.org/blog/2021/jul/23/tivoization-and-the-gpl-right-to-install/ https://sfconservancy.org/blog/2021/jul/23/tivoization-and-t...

Rochus 2y ago

LeanQt still has LGPL 2; never saw a need or advantage to switch to more recent versions.

aaron695 2y ago

[dead]

azalemeth 2y ago

That frankly makes me just wish it was legislated to be true. Sigh. Reverse engineering iot devices that are supposed to help you shouldn't be a necessary step but it looks like it increasingly is...

indrora 2y ago

This is false, and one of the simultaneous boons and banes of the GPL family of licenses. LGPL compliance is achieved purely by providing a copy of your version of the source code; if no modifications have been made to the LGPL portion, a simple link to upstream is sufficient, otherwise a “reasonable” means of getting the same code (full tarball, diff against upstream at some point in time, etc) is needed. The LGPL (and GPL overall) does not make any provision that the user MUST be able to replace the object binary, only that source is provided to enable doing so if you break whatever tamper seals are there for yourself.

ndiddy 2y ago
Please don't make claims like "this is false" if you aren't familiar with the licenses you're commenting on. Section 4e of the LGPLv3 says that one of the conditions for conveying a "combined work" (such as a proprietary application that links with an LGPLv3 library) is "Provide Installation Information, but only if you would otherwise be required to provide such information under section 6 of the GNU GPL, and only to the extent that such information is necessary to install and execute a modified version of the Combined Work produced by recombining or relinking the Application with a modified version of the Linked Version." The relevant quote from Section 6 of the GPLv3 is: > “Installation Information” for a User Product means any methods, procedures, authorization keys, or other information required to install and execute modified versions of a covered work in that User Product from a modified version of its Corresponding Source. The information must suffice to ensure that the continued functioning of the modified object code is in no case prevented or interfered with solely because modification has been made. > If you convey an object code work under this section in, or with, or specifically for use in, a User Product, and the conveying occurs as part of a transaction in which the right of possession and use of the User Product is transferred to the recipient in perpetuity or for a fixed term (regardless of how the transaction is characterized), the Corresponding Source conveyed under this section must be accompanied by the Installation Information. But this requirement does not apply if neither you nor any third party retains the ability to install modified object code on the User Product (for example, the work has been installed in ROM). In summary, if you ship a device that is physically capable of running modified code, you must give users the ability to both link the LGPL'd library with your proprietary code and to write the resulting modified firmware to the device.