1

The Qt Open Source Licensing Obligations contain the following line:

Must make “open” consumer devices

What does this mean? I know about the linking mechanism required by LGPL, and that part of the application can remain close sourced as long as the end user can modify and re-link the Qt libraries.

but what about the hardware? Does an open consumer device mean open hardware (with published schematics, etc.)? Or does it mean that we must allow (and provide support for) the software to run on a different hardware the user has built?

Improve this question

2 Answers 2

Reset to default
5

This is probably a reference to GPLv3's anti-"tivoization" terms. That is, the GPLv3 requires that recipients of embedded GPLv3 software must be able to deploy modified versions of the software in the device, if the device supports that capability:

If you convey an object code work under this section in, or with, or specifically for use in, a User Product... the Corresponding Source conveyed under this section must be accompanied by the Installation Information. But this requirement does not apply if neither you nor any third party retains the ability to install modified object code on the User Product (for example, the work has been installed in ROM).

and

“Installation Information” for a User Product means any methods, procedures, authorization keys, or other information required to install and execute modified versions of a covered work in that User Product from a modified version of its Corresponding Source. The information must suffice to ensure that the continued functioning of the modified object code is in no case prevented or interfered with solely because modification has been made.

For example, this disallows cases where a device will only run software updates that have been signed by an authoritative key held by the device manufacturer. Instead, if you have a device that comes with GPLv3 software (or, more generally, if you have GPLv3 software intended for use in a particular device), the GPLv3 requires the distributor to offer you the necessary keys and instructions to update that GPLv3 software inside the device.

To put it another way, if the device can receive software updates, the user must have the ability to install any modified version of the GPLv3 software, whether that modified version was published by you, or directly edited by the user, or created by any third party. It must not ever be the case that the user has in hand a modified version of the GPLv3 software for your device but is forbidden from installing it on the device. You cannot maintain the exclusive ability to install software on the device by means of secret keys or secret installation protocols. You are welcome to charge money for a copy of updated software for your device, though if the software update is under the GPL or LGPL, you must give the user a copy of the source code under that same license so they can share it with others.

Technically, there is no requirement the device must allow the user to extract already-loaded software out of the device, but this doesn't really matter. You are always required to give the user human-accessible, buildable source code when you give the user GPL-licensed binaries, whether by download, on media, or embedded in a device. The device doesn't need to give the user access to its source code, because you already gave the user source code alongside the device or downloaded software update.

Since the LGPLv3 is an set of additional permissions on top of the GPLv3 (which do not interfere directly with these requirements), this applies equally to the LGPLv3. However, as you might expect from the LGPL's weaker copyleft, you only need to supply the instruction to update the LGPL library, not the entire software on the device. Exactly how to provide an update mechanism that limited to updating to a single library seems like a strange technical problem, but it is legally allowed under the LGPLv3's more narrow scope of this requirement.

Improve this answer
4
  • Basically, does this only mean that if I offer updates to the software, the buyers of the device should be able to install it themselves (instead of, for example, me doing it as a service and charging them money for it), and that if the user wants to replace the LGPL-licensed libraries with different versions or different builds, I am not to make it impossible? And (this was the purpose why I asked the question), I can still prevent, via cryptography, my software from being copied and installed on a hardware someone else built?
    – vsz
    Oct 6, 2017 at 6:15
  • @vsz I edited a few new paragraphs and expanded the final paragraph. For your final question, I think an example of what you mean if: what if your device has a crypto chip with a physically embedded keystore and your code uses that to either verify or decrypt some part of the code? If it verifies some result produced like sign_with_embedded_secret_key(challenge), a user couyld easily edit out that check. If some blob of the source code is encrypted and gets decrypted on the device, that would not satisfy the GPL's definition of human-readable source code.
    – apsillers ♦
    Oct 6, 2017 at 11:51
  • @vsz Note also that "buyers of the device should be able to install it themselves" and "me doing it as a service and charging them money for it" are not mutually exclusive -- you can also change you own oil in your car (there's instructions in the owner's manual and everything), but plenty of people pay for someone else do it.
    – apsillers ♦
    Oct 6, 2017 at 12:11
  • Indeed, I should have written "exclusively". I'm familiar with the LGPL constraints in relation to software, and that the main catch of LGPL (versus GPL) is that I can have closed source software dependent on open source libraries, if I guarantee the users can replace the open source parts with their own builds. Why I asked the question was the word "device", and whether it had to do anything with open hardware. Why I would use cryptography (with a chip in the hardware) would be to prevent someone from building a cheaper lower quality hardware, and selling it using my software installed on it.
    – vsz
    Oct 6, 2017 at 12:22
3

but what about the hardware? Does an open consumer device mean open hardware (with published schematics, etc.)? Or does it mean that we must allow (and provide support for) the software to run on a different hardware the user has built?

We can only guess what QT means by this. As common with companies that provide a choice of FOSS and commercial licensing, FAQs and commentaries are often a tad cryptic and sometimes lack clarity to entice you to buy a commercial license.

My guess is that this is unlikely about the hardware being "open" (with published schematics, etc.)

It is also unlikely about asking to provide support for other hardware, such as a user-built hardware.

SO what could this be about?

The most recent QT licensing is based on a primary combo of GPL 3.0 and LGPL 3.0. Neither the licenses nor the FSF FAQ make any reference to "open consumer devices"... but they refer instead to "User products" and "Consumer products".

Therefore, they (QT) likely conflated the terms open "consumer device" with the "User products" and "Consumer products" L/GPL definitions.

So my guess is this likely is about this: If a "consumer" device is provided with QT binaries, then it should be possible for the recipient of this device to reinstall the (modified or updated) QT software (rebuilt from sources) on such a device. And re-installation documentation should be provided.

The L/GPL 3 licenses are clear on this topic as explained in the section 6:

“Installation Information” for a User Product means any methods, procedures, authorization keys, or other information required to install and execute modified versions of a covered work in that User Product from a modified version of its Corresponding Source. The information must suffice to ensure that the continued functioning of the modified object code is in no case prevented or interfered with solely because modification has been made.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.