For the most part, the GPL v2 and LPGL v2 and v2.1 require that, if you distribute GPL'ed or LGPL'ed code, you also make the source code available yourself. With a few exceptions, pointing to an upstream repository is not sufficient. See section 3 of the GPL v2 and section 6 of the LGPL v2.1. (Version 3 of the GPL and LGPL ease this restriction and permit pointing people to third-party servers; see section 6 of the GPL v3.)
So #1 and #3 are okay; #2, not so much.
Update: A few additional notes:
- In practice, if you simply point people to third-party servers, most people won't care. Complaints have occurred, though; several years ago, the FSF contacted several Linux distros for not making source available. Slashdot and Linux.com covered this.
- If the libraries are distributed under "LGPL v2 / v2.1 or later," then I believe that distributing library binaries but not the source would be okay, as long as you point people to the source, since LGPL v3 allows that.
- In my own experience, I've found it simplest to just make the source for everything available, rather than trying to track the details of when I do and don't have to distribute things.
In response to your edit: Sections 5 and 6 of the LGPL specifically cover creating "a work that uses the Library." Based on my understanding, it's fine to distribute your work as GPLv2 or later without applying the GPL to the libraries. (Your source code itself is not a derivative of the libraries, so the LGPL doesn't directly apply to your source code, and section 6 allows the resulting binary to use LGPL'ed libraries as long as the license terms are compatible.)
Standard disclaimers apply, I am not a lawyer, etc.