What is the difference between LGPLv2.1 and LGPLv3?

Question

Below text is cited from https://www1.qt.io/faq/#_Toc_3_6

LGPLv3 is the current version of the GNU Lesser General Public License. LGPLv2.1 is an older version and not recommended by the Free Software Foundation for new projects anymore. Both licenses have the same intention, namely to protect the freedom of users to use and modify the software licensed under LGPL.

LGPLv3 makes this intention very explicit. You have to provide means to the end user to install a modified version of the library licensed under LGPLv3 and run your software using that modified library. In practice, this for example refers to:

Tivoization – Explicitly not allowing creation of closed devices where the end user does not have the LGPL granted rights for the Qt open source libraries

DRM and hardware encryption – This cannot be used to circumvent these obligations

Software patent retaliation – Where all users of the software are granted licenses thus making software patent retaliation of any potentially patented software in the distributed software meaningless.

Questions:

1) When using LGPLv2.1 license free/open software, don't we need to meet the above three obligations ?

2) It seems to me it is very difficult to use LGPLv3 license free/open software on embedded system, because a) we have to make the compiler tool chain available and b) public key to assign the apps to users.

Answer 1

When using LGPLv2.1 license free/open software, don't we need to meet the above three obligations ?

No. All you had to do was to provide the source code and instructions on how to build the source; there was no need to make it possible for somebody to actually be able to run the new binary on a device. It's called tivoization because this is precisely what TiVo did. Similarly, you can use patents to restrict the use of LGPL v2.1 (or GPL v2) code.

2) It seems to me it is very difficult to use LGPLv3 license free/open software on embedded system, because a) we have to make the compiler tool chain available and b) public key to assign the apps to users.

For (a), you have to do this with LGPL v2.1; quoting from Section 6:

For an executable, the required form of the "work that uses the Library" must include any data and utility programs needed for reproducing the executable from it.

The toolchain is precisely what "data and utility programs" is referring to here.

For (b), not necessarily. You need to provide a means for people to replace the LGPL code on the system with their own - that doesn't have to be a "public key". Note that attempting to restrict things in this kind of way is exactly what the (L)GPL v3 is designed to stop. If you don't like that, you have the choice not to use (L)GPL v3 software.

Answer 2

Even though LGPLv2.1 does not mention TiVo it does come to almost the same effect when you combine the library via dynamic linking with proprietary code. For that purpose you have to adhere to No. 6b of the license:

b) Use a suitable shared library mechanism for linking with the Library. A suitable mechanism is one that (1) uses at run time a copy of the library already present on the user's computer system, rather than copying library functions into the executable, and (2) will operate properly with a modified version of the library, if the user installs one, as long as the modified version is interface-compatible with the version that the work was made with.

The license requires the software to operate properly if the user installs a modified version. So if your system uses mechnisms against manipulation such as signatures you will have to make sure the user can get hold of these signature keys.