Purism has always promised lifetime software updates since the original crowdfunding announcement in August 2017 and it is still listed on Purism’s Librem 5 web page:
Because of the hardware that was chosen and the way that Purism has designed the software in the Librem 5, it won’t cost Purism much to continue to provide lifetime software updates. I go through the arguments in the community FAQ:
3.11. How can Purism provide lifetime software updates for the Librem 5?
Purism has made an unprecedented promise that the Librem 5 will get lifetime software updates. Some people have expressed skepticism that Purism can fulfill this promise, but Purism has designed the Librem 5 and its software stack in ways that will make it much easier and more economical for Purism to provide future software updates.
The integrated mobile system on a chip (SoC) used in most mobile phones, like the Snapdragon, Exynos, Helios/Dimensity, Tiger/SCxxxx and Kirin, are only produced for 1 - 2 years and only receive software updates from the manufacturer for 2.5 - 5 years. Once the chip manufacturer stops supporting a mobile SoC, it is difficult for the phone maker to keep providing software updates, and most of the mobile industry runs on planned obsolescence to generate more sales, so there is little economic incentive for phone makers to support old hardware. Over 40% of the Android devices in use are no longer gettting security updates, so over a billion Android devices are at risk of being compromised by recent security holes which are not being patched.
Even when the maker of an Android phone wants to keep providing software updates, the mobile industry often prevents it. It is worth examining what happened to the Fairphone 2, which was the long supported smartphone in history, in order to understand why it is difficult for Android phone makers to keep providing software upgrades and security updates. Fairphone originally had the goal of providing at least 5 years of software updates for the Fairphone 2, which contains a Snapdragon 801 processor and was first released in December 2015 with Android 5.1 Lollipop. None of the Android phones with the Snapdragon 800/801 that were released in 2013-4 got upgraded to Android 7 (Nougat) in 2016-7, because Qualcomm decided that it wouldn’t release updated graphics drivers for the Snapdragon 800/801 because it was too old. Others say that the reason the Snapdragon 800/801 couldn’t be officially upgraded to Nougat is because it lacked hardware AES encryption and full disk encryption was mandated by Nougat’s Android Compatibility Definition Document (CDD) and it couldn’t pass the encryption speed requirements of the Android Compatibility Test Suite (CTS). Because Fairphone needs to provide its users with access to the Google Play Store and Google Web Services (such as Google Maps), it could only provide upgrades to Android that met Google’s standards.
In order to obey Google’s onerous CDD rules and pass its CTS, Fairphone had to spend €500,000 to switch from Qualcomm’s unsupported Snapdragon 801 drivers to community-developed free/open source drivers. In November 2018, the Fairphone 2 became the only Snapdragon 800/801 phone to officially receive a Nougat upgrade. Unfortunately, Fairphone was not able to keep providing security updates for Android 7, because Google released its last update to Nougat in October 2019, since it has a policy of only supporting its Android releases for 3 years. Since Fairphone wasn’t able to upgrade to Android 8 in a way that met Google’s requirements, the phone was stuck using Android 7.1, which was first first released in October 2016, and the phone was stuck using the Linux kernel 3.4.0, which was originally released by kernel.org in May 2012. The community ported the FairPhone 2 to LineageOS 17.1 (based on Android 10), but FairPhone couldn’t officially offer Android upgrades for the phone without passing Google’s Compatibility Test Suite.
Finally on March 25 2021, after 16 months without security updates, Fairphone offered an upgrade to Android 9 Pie, that was capable of passing Google’s stringent requirements, although it came 20 months after Google released that version of Android. It appears that Google made an exception for Fairphone because officially Android 9 only supported kernels 4.4.107+, 4.9.84+ and 4.14.42+, but Qualcomm only released drivers for the Snapdragon 801 that were compatible with kernel 3.4.0, which was orginally released by kernel.org in May 2012. For its Android 9 release, Fairphone upgraded the kernel to 3.4.113, which was the last update available for the 3.4 kernel, but it received no updates after October 2016. The Fairphone 2 used that same outdated kernel for its Android 10 and 11 upgrades as well. By the time that support ended for the Fairphone 2 in March 2023, it was using a kernel that was 6.5 years old, which calls into question its security. Fairphone made a point to say that it relied heavily on the work of the LineageOS community to do the upgrades to Android 9-11, which shows how little the component makers for Android phones support their old hardware.
In contrast, the ability of Purism to upgrade the Librem 5’s operating system is not dictated by any other company, because it runs on 100% free software, so Purism doesn’t depend on the arbitrary whims of Qualcomm or Google. Of course, the Librem 5 does rely on proprietary firmware found in components such as the CPU/GPU, WiFi/Bluetooth, cellular modem, GNSS, etc. The Librem 5 uses 6 separate chips instead of a single integrated SoC, and those individual chips will be supported for much longer. For example, NXP promises to produce the i.MX 8M Quad till January 2033, which means that the Librem 5 should get at least a decade of proprietary firmware updates for its CPU/GPU/VPU, which is unmatched longevity in the mobile industry. Considering that NXP markets its i.MX processors to industrial manufacturers with long-lasting products like automobiles, it is likely that NXP will keep providing firmware updates for many years after 2033 for the Librem 5. Purism has indicated that it plans to provide proprietary firmware updates, which are important for security reasons.
Because all the drivers used by the Librem 5 are free/open source, the community can maintain them and keep updating them to be compatible with new Linux kernels. As long as the community cares about the hardware, it will maintain the drivers, as shown by the fact that the Linux kernel still contains drivers for the Intel 80486 which was released in 1989. In addition, NXP and Redpine Signals contribute to the drivers for their chips in mainline Linux, so their updates can be easily used by the Librem 5.
Purism designed Phosh to be a thin overlay on top of a Linux + Wayland + wlroots + GTK + GNOME middleware stack, so it can be easily incorporated into existing distros. Phosh is already included in Debian, Arch, Manjaro, Fedora, openSUSE, postmarketOS, Mobian, NixOS and PinePhone’s PureOS fork. Libhandy, Calls and Chats (i.e. Chatty) have been included as official GNOME projects. Two thirds of PinePhone users report using Phosh and postmarketOS and Mobian developers already commit upstream to Phosh. As mobile Linux grows, Purism can expect to receive more outside help in maintaining its software.
Purism created the libhandy and libadwaita libraries so that it could adapt the interface of existing GTK/GNOME desktop software to work in a mobile environment. Because Purism chose to adapt existing desktop GTK/GNOME software, rather than making new mobile apps, it can count on the developers of those desktop applications to keep providing software updates in the future. Because Purism is upstreaming many of its code changes to these desktop applications, it should be able to use their future versions inside Phosh with little or no modification.
Unlike other mobile desktop environments (Ubuntu Touch, KDE Plasma Mobile, LuneOS and Sailfish OS) which rely on mobile stacks such as Halium and Mer Project, PureOS/Phosh is based on using the existing desktop software stack of GKT/GNOME, which is well maintained and has a lot of corporate support from IBM/Red Hat, SUSE, Canonical and Google, so it can count on future software updates.
Even if Purism fails as a company, there is good reason to expect that the community will be able to keep providing software updates, as has happened with the Maemo community supporting the Nokia N900 for over a decade. The communities at UBports and LuneOS took over maintenance of Ubuntu Touch and WebOS after Canonical and HP/LG abandoned them. Because Purism has worked to get the hardware in the Librem 5 supported by mainline Linux and to easily integrate with the existing Wayland/wlroots/GTK/GNOME stack, it should be much easier for a community of volunteers to keep providing updates. When new versions of these parent projects are released, it should not be nearly as much work to integrate the new versions into PureOS/Phosh as with other mobile desktop environments.
The critical questions are whether Purism can finish getting all the L5’s hardware supported in the mainline Linux kernel and whether Purism can develop Phosh to a point that it becomes widely adopted and the community can take over the dev work even if Purism disappears. Given that libhandy, libadwaita, Calls and Chats/Chatty are now official GNOME projects, I think that their development will continue no matter what happens to Purism in the future. I’m less sure about the other components that Purism has created (phoc, phosh, feedbackd, squeekboard, etc.), but these components are now packaged in most of the major distros (Debian->Ubuntu->Mint, Fedora, Arch, etc.), so there is some hope for them being maintained by the community in my opinion if Purism disappears.