Google has stopped pushing Git tags for some Android source code

They stopped pushing tags for any of the Pixel kernel or userspace driver repositories to AOSP. They also stopped pushing AOSP releases specific to Pixels which is why AOSP now only gets yearly releases, QPR2 releases and security backports to both of those. Other OEMs use the yearly and theoretically also the QPR2 releases. Both the yearly and QPR2 releases get monthly security backports. Since they dropped Pixel support from AOSP, they don't push the releases not shipped by other OEMs anymore.

These changes directly led to our Motorola partnership. One of their security people reached out to us after seeing our posts about this with the launch of Android 16. We haven't talked about it much since then since we adapted to it during the several weeks it delayed our Android 16 port. We then continued adapting to it and have fully worked around it. It was an ongoing problem but not a new one and we had accepted we had to deal with it as the new normal.

They were previously responding to our kernel source requests within a day. It was often done without hours. Despite the archaic system, this part wasn't that bad. Recently, they've been taking weeks or longer to get back to us for the requests which is ridiculous. It's the direct result of purposely adding a lot of friction with manual handling of the requests even if the delays weren't directly planned by management.

Weeks or months of delay is not reasonable for one of the largest tech companies in the world. GPL doesn't set a standard time limit for providing the sources, but that doesn't mean they can delay it indefinitely. They need to do it in a reasonable amount of time. What's reasonable for one of the largest tech companies in the world in 2026 with current technology is not the same as what was reasonable 30 years ago. Google chose to come up with a archaic way of distributing the sources involving someone manually going through a list and sharing Google Drive access. It's a deliberate way of making it painful. If they can't keep up with it and it gets delayed for weeks or months then they're not complying with the GPL by not providing it in a reasonable amount of time. Law is not code and a time limit not being explicitly written down doesn't mean there isn't a limit to what's reasonable for compliance.

They'll sell far fewer Pixels because of these overall changes. It pushes GrapheneOS and other projects towards other devices instead. For us, Pixels are being used due to security rather than ease of supporting them. It's now a lot harder to deal with Pixels than it would be for many other devices but they're currently still the most secure option. We're working on changing that and have a lot less reason to contribute to improving Pixels. We helped them fix serious security weaknesses for Pixels including vulnerabilities being exploited in the wild by forensic data extraction companies. Pixel security with the stock OS would be worse without GrapheneOS.

We need something other than Android, and we need the government to make sure we can run Android apps (like government ID and banking apps) without being spied on. They've been doing whatever the f they like for long enough if you ask me.

Let's just forget about the tags, the point is that they're not publishing what Graphene OS needs on any git repository that they can access.

Even before that it had been jokes of repositories, but at least you didn't have to ask for someone every time and wait for them to respond to the request.

(that's my understanding)

I don't think the real focus is on the tags, but on the delay here via a form as well as human interaction.

Worded differently, the simplest way to provide the source code is IMO via a URL that you can just wget. At the least this is done by so many projects out there. Google refusing to do so means Google wants to violate the GPLv2, since their alternatives are inferior.

https://distrowatch.com/ has many convenient links to URLs on the left side; I often use that to download the latest and greatest and compile it away, e. g. https://ftp.isc.org/isc/bind9/9.20.27/bind-9.20.27.tar.xz as a current example, taken from the left panel.

GPL says that you can give that link to anyone you want.

If someone on HN has received one of these links, feel free to post it here.

But why? What can be the internal justification? What do they think they win by doing this?

“In violation of GPL” is a stretch.

Can’t imagine Google is making the process of obtaining source code easier on themselves though.

Android has always been more source-open than “open source”. The vast majority of community contributions that make it into the codebase are security fixes and small bug fixes.

Everything else is essentially all the work of Google and (to some extent) Samsung.

Relevant: https://keepandroidopen.org/

> Starting in 2027*, a silent update, nonconsensually pushed by Google, will block every Android app whose developer hasn't registered with Google, signed their contract, paid up, and handed over government ID.

They are shutting it down. Same agenda as with the ban on side-loading.

Classical not being evil stuff by Google.

Can't help but wonder if making it costly for themselves the entire point. So that they can later turn around and bill that distribution fee to the recipient.

Every year a new low.

Can someone explain what this means? Am not familiar with the terminology

isn't this just malicious compliance? not clear how this would violate GPLv2?

Google's intent is to make web development and mobile development so complex that you have to rely on their browser or other means to get anything done.

Switching from Git tags to Google Drive downloads technically satisfies GPL but makes it much harder for downstream projects to track changes. The inconvenience is the point.

Quoting the first tweet:

> Google replaced pushing Git tags for certain source code with obtaining source code via Google Drive after making a request through Google Forms. It's completely ridiculous and they've gradually become very slow at handling requests. They're in clear violation of the GPLv2 now.

Is it about Android code?

Could this be related to the upcoming change (close) of the apk side-loading?

I really don't understand the thought process here.

Judging by public statements, Google is one of the 3 big western AI companies. Surely they should be rolling in cash and working hard towards AGI.

And yet, for whatever reason, they can't help themselves from further restricting user freedoms on Android. Why?

I don't want to be conspiratorial, but surely it's not money, right? It has to be control. Someone high up at Google just seems to resent people having control over their own devices.

Google needs to lose in court here. This company is getting more and more evil by the day.

RE satisfying GPL, the google drive thing is annoying, and I called it paying a bill in pennies in another comment, But RedHat is 100x worse.

They might actually be violating the gpl because of the attempt to set terms on redistribution and the retaliation (kill your account and block future access) if you do.

The era of big tech cooperation around free software is obviously over.

Those kind of moves are petty but there are worst tricks they can pull unfortunately.

It seems Grapheneos is the rare actor willing to put up a fight nowadays, and their "partnership" with Motorola seems to be a first step. They need to ensure a hardware platform.

My guess is at some point they will have to fork AOSP, just because Google will take it in directions that go against Grapheneos principles.

It's a bit unclear what this is about exactly. What releases are we talking about? How git tags come into play here?

hanlon's razor comes to mind. which trees are these? weird device trees that have complicated third party licensing nonsense attached?

i remember jumping through crazy hoops to interact with a google open source project years ago. i wouldn't be surprised if it's just megacorp bureaucracy.

That's like this fun fact where Microsoft needs to send you source code via post when you mail them a 5$ check. lol

Yo Louis Rossmann, do your thing!

I have feeling that is related to their upcoming changes that make sideloading harder

Source code of which components is that? It's not very clear from the mastodon thread.

Many commenters agree this is not a nice move by google.

But is there any reason that google might have that they feel is legitimate?

For example, delaying releasing source until they've had a chance to update all the pixels with security patches might be good from their perspective, to reduce zero-day exploits for people they are supporting.

Google doing anti competitive bullshit? Never

Shameful acts.

This is a direct consequence of their loss to Epic. They saw Apple win because they didn't have any competition to stifle, and they want the same. Pretty shit.

"Free" as in "free to play by our rules or suffer"

I think leadership in Google is getting worst day by day. The main reason to use Android is mostly sideloading and open source and they are trying to sabotage both.

If you're like me and struggled to parse the title, my understanding is, "To obtain certain source code from Google, you could previously reference git tags, but now you have to fill out a form and wait for a human to give you a google drive link."

Give them a few years and they'll only provide it by printing out a copy and mailing it to you.