Google replaces Git tags for Android source with Google Drive requests, GrapheneOS cries GPL violation
Google replaced Git tags for certain source code with obtaining via Google Drive
GrapheneOS reports that Google has stopped pushing Git tags for certain Android source code and now requires requests via Google Forms to obtain tarballs from Google Drive. The process is slow, often taking weeks, and GrapheneOS argues this violates GPLv2 obligations. They note that Google also squashes history into single commits before release, making the source harder to work with. GrapheneOS plans to host its own AOSP repositories for upcoming Motorola devices, which will be available in 2027.
They're in clear violation of the GPLv2 now.
- grapheneos
They stopped pushing tags for any of the Pixel kernel or userspace driver repositories to AOSP. They also stopped pushing AOSP releases specific to Pixels which is why AOSP now only gets yearly releases, QPR2 releases and security backports to both of those. Other OEMs use the yearly and theoretically also the QPR2 releases. Both the yearly and QPR2 releases get monthly security backports. Since they dropped Pixel support from AOSP, they don't push the releases not shipped by other OEMs anymore.
These changes directly led to our Motorola partnership. One of their security people reached out to us after seeing our posts about this with the launch of Android 16. We haven't talked about it much since then since we adapted to it during the several weeks it delayed our Android 16 port. We then continued adapting to it and have fully worked around it. It was an ongoing problem but not a new one and we had accepted we had to deal with it as the new normal.
They were previously responding to our kernel source requests within a day. It was often done without hours. Despite the archaic system, this part wasn't that bad. Recently, they've been taking weeks or longer to get back to us for the requests which is ridiculous. It's the direct result of purposely adding a lot of friction with manual handling of the requests even if the delays weren't directly planned by management.
Weeks or months of delay is not reasonable for one of the largest tech companies in the world. GPL doesn't set a […]
- g-b-r
Let's just forget about the tags, the point is that they're not publishing what Graphene OS needs on any git repository that they can access.
Even before that it had been jokes of repositories, but at least you didn't have to ask for someone every time and wait for them to respond to the request.
(that's my understanding)
- shevy-java
I don't think the real focus is on the tags, but on the delay here via a form as well as human interaction.
Worded differently, the simplest way to provide the source code is IMO via a URL that you can just wget. At the least this is done by so many projects out there. Google refusing to do so means Google wants to violate the GPLv2, since their alternatives are inferior.
https://distrowatch.com/ has many convenient links to URLs on the left side; I often use that to download the latest and greatest and compile it away, e. g. https://ftp.isc.org/isc/bind9/9.20.27/bind-9.20.27.tar.xz as a current example, taken from the left panel.
- doe88
What's the point of Android if not of being open?!! I don't see any value for them to be closed or combative. It's sad to see Google, once the greatest company on earth, lose absolutely everything of what they made them great in just a matter of a couple of years.
- teekert
We need something other than Android, and we need the government to make sure we can run Android apps (like government ID and banking apps) without being spied on. They've been doing whatever the f they like for long enough if you ask me.
- gumby
GPL says that you can give that link to anyone you want.
If someone on HN has received one of these links, feel free to post it here.
- jmole
“In violation of GPL” is a stretch.
Can’t imagine Google is making the process of obtaining source code easier on themselves though.
Android has always been more source-open than “open source”. The vast majority of community contributions that make it into the codebase are security fixes and small bug fixes.
Everything else is essentially all the work of Google and (to some extent) Samsung.
- raphinou
But why? What can be the internal justification? What do they think they win by doing this?
- QuiEgo
I have to wonder how good a shepard Google will be long term for other things people build on. Looking at you, Bazel.
- TheMiddleMan
Relevant: https://keepandroidopen.org/
> Starting in 2027*, a silent update, nonconsensually pushed by Google, will block every Android app whose developer hasn't registered with Google, signed their contract, paid up, and handed over government ID.