Top
Best
New

Posted by Animux 19 hours ago

Google has stopped pushing Git tags for some Android source code(grapheneos.social)
664 points | 258 commentspage 4
zephen 11 hours ago|
Many commenters agree this is not a nice move by google.

But is there any reason that google might have that they feel is legitimate?

For example, delaying releasing source until they've had a chance to update all the pixels with security patches might be good from their perspective, to reduce zero-day exploits for people they are supporting.

hedora 11 hours ago|
This just breaks legitimate downstream distros that target Pixel devices.

Ransomware gangs, etc still get red carpet service.

zephen 10 hours ago||
So all the non-pixel-specific stuff is in a publicly accessible repo? So the pixel team just decided that they wanted to keep their kimono mostly closed?
hedora 9 hours ago||
Yes, but that’s the only reference android device, so the whole ecosystem is getting pretty close to completely locked down. Google is going to require devs to register, pay and get permission to publish Android software sometime next year. Locking pixel owners out of third party operating systems means they get to force pixel owners to hand control over their devices and applications to Google.

The motorola / GrapheneOS partnership gives me some hope though. Maybe when the pendulum swings back in 2028, the US will pass consumer protection laws, and we’ll have the right to import devices that allow open ROMs, and demand they be supported by cell networks.

(I doubt the moderate democrats would support this, but I’d guess the DSA candidates could be convinced to.)

evolve2k 15 hours ago||
Shameful acts.
Havoc 5 hours ago||
Google doing anti competitive bullshit? Never
IshKebab 13 hours ago||
This is a direct consequence of their loss to Epic. They saw Apple win because they didn't have any competition to stifle, and they want the same. Pretty shit.
water-data-dude 11 hours ago||
"Free" as in "free to play by our rules or suffer"
cute_boi 16 hours ago||
I think leadership in Google is getting worst day by day. The main reason to use Android is mostly sideloading and open source and they are trying to sabotage both.
bitpush 15 hours ago|
What is the alternative?
Cider9986 15 hours ago|||
GrapheneOS
Zigurd 14 hours ago|||
HarmonyOS?
rurban 7 hours ago||
Hopefully. I don't trust them neither, but they do have no powers over me.
hatthew 16 hours ago||
If you're like me and struggled to parse the title, my understanding is, "To obtain certain source code from Google, you could previously reference git tags, but now you have to fill out a form and wait for a human to give you a google drive link."
aleph_minus_one 13 hours ago|
> "To obtain certain source code from Google, you could previously reference git tags, but now you have to fill out a form and wait for a human to give you a google drive link."

Couldn't simply someone mirror these Google Drive folders?

grapheneos 12 hours ago|||
Yes, and we do mirror their source code on GitLab. We put the upstream 17 code in the 17-base branch and our code on top of it in the 17 branch:

https://gitlab.com/grapheneos/kernel_pixel/-/tree/17-base

https://gitlab.com/grapheneos/kernel_pixel_muzel/-/tree/17-b...

We also have mirrors of the QPR1 Beta and QPR2 Beta code there too.

It's not meant to be distributed as a tarball or a single Git repository. The build system runs Git commands to determine the revisions of each component. It's supposed to be in dozens of Git repositories. They provide repo metadata as part of the tarballs on Google Drive which you can see there but it's not a full replacement for the Git repository layout expected by builds. It's somewhat convenient having it in a monorepo but it's not the way it's meant to be and the build system makes it clear that it isn't happy about it despite running.

It would be nice if Google would simply push it to the Git repositories still available on AOSP again. The repositories still exist both internally and publicly but they're making it a hassle instead of simply pushing tags.

We publicly complained about these and other Pixel changes as they were ongoing and that directly led to our Motorola partnership. It was in Google's financial interest to work with us so we continue using Pixels and that's still the case. They're welcome to reach out to us and start collaborating again. We made a lot of upstream contributions and aren't their enemy.

Google should want more people to use their devices, apps and services. It shows how heavily they're violating antitrust laws by using monopolies to protect other monopolies when they sacrifice revenue for their devices and apps/services for it.

geokon 8 hours ago|||
Maybe a naiive question, but couldn't you request the source code from phone companies? Say you request it from Xiaomi - sure they're not the original writers of the code, but they too "distributing GPL code" and therefore must release the code on request. They may be more amenable to your request since they have leverage with Google and are in an adversarial relationship
Gud 7 hours ago|||
“Couldn’t you just” couldn’t fucking GOOGLE, the don’t do evil corporation, support one of the few alternative mobile phone OSs use standard development tools, instead of being little shits?
nikanj 7 hours ago|||
You can request anything from anyone, but compelling a company to follow their GPL obligations requires cooperation from the copyright holders + infinite funds for legal fees
hedora 11 hours ago||||
Doesn't their change break supply chain security on Google's end?

With git tags, presumably people spoke in terms of cryptographic hashes. Now what prevents them from serving different Google drive contents to different accounts?

CBLT 11 hours ago|||
It doesn't break supply chain security for anybody with power to change the situation.
asdfsa32 9 hours ago||
It is an easy to overlook this, but even for someone in position of power to change, creating different code with the same hash is borderline impossible.
CBLT 9 hours ago||
Non-sequitor? They're not providing a (sha-1) hash, they're providing source code to integration partners using their business channels, not public git providers. Those business channels include contracts etc to "secure their supply chain".

You and I aren't in those business channels, and we're not being given anything with a hash. There's simply no hash to collide with?

asdfsa32 6 hours ago||
A git hash is cryptographically secure. It doesn't matter how you distribute it. That is the entire point you're missing.
CBLT 49 minutes ago||
The Google Drive link is to a simple tarball, not a git artifact.
mvdtnz 9 hours ago|||
[flagged]
processunknown 8 hours ago|||
There is a giant list of reasons here https://grapheneos.org/faq#future-devices
tannertech 8 hours ago||||
Answered long ago: https://grapheneos.org/faq#future-devices
mjg59 13 hours ago|||
Yes, but that person still needs to file a request and wait several days
grapheneos 11 hours ago|||
It was initially taking under a business day for them to respond, but our recent requests have often taken weeks for them to get back to us. We want the code for all the Beta releases and are entitled to it.

This is the relevant code for Android 17:

https://gitlab.com/grapheneos/kernel_pixel/-/tree/17-base

https://gitlab.com/grapheneos/kernel_pixel_muzel/-/tree/17-b...

There are other branches there with it for Android 17 QPR1 Beta and Android 17 QPR2 Beta.

Google could save everyone including themselves a lot of hassle by simply publishing it to GitHub. If they don't want to push it to AOSP for weird organizational reasons as part of saying AOSP doesn't support Pixels, fine. Taking weeks or more to get back to us isn't reasonable for one the largest tech companies in the world.

It's also questionable whether what they're providing is truly the preferred form for modification considering the build system is quite unhappy about the lack of Git repositories. They had to provide a repo manifest metadata file to work around part of it.

mjg59 10 hours ago||
I wholeheartedly agree. Making it more difficult to obtain GPLed source code than it was before is fundamentally a dick move.
grapheneos 9 hours ago||
It also isn't only them pushing the boundaries of the GPL.

Pixel 9a and earlier were sold as the official Android Open Source Project (AOSP) reference devices. They made a commitment to providing 7 years of updates for the Pixel 8 and later. Android 16 declared Pixels were no longer AOSP reference devices and stopped providing any support for them. From our perspective, Google hasn't fulfilled their update commitment for the Pixel 6 through Pixel 9a. It's fair to say the Pixel 10 and later weren't sold as AOSP reference devices and didn't have any commitment to providing sources as part of the updates, but that isn't the case for the earlier devices.

aleph_minus_one 13 hours ago|||
But after one person does this, the source code access is a solved problem.
urbnspacecowboy 11 hours ago|||
No it's not, because "one person" has to keep sitting up and begging for access, every time there's a new release, over and over and over and over and over.
petre 8 hours ago||
Maybe we colld getan AI agent to pester them with forms?
voakbasda 7 hours ago||
What consequences do you imagine if they (rightfully) choose to ignore it?
mjg59 13 hours ago|||
But nobody has done this, which is why it's a problem for Graphene
beanjuiceII 12 hours ago||
Maybe should someone should do it then?
gruez 12 hours ago|||
Submitting the form isn't too hard, so there's not much to be gained by getting a non-affiliated volunteer to do it. Also if they're not the ones requesting it, it becomes hard to ascertain the authenticity of the links (eg. it doesn't contain a backdoored kernel).
mjg59 12 hours ago|||
They are, which is how they know how long it's taking.
cdrnsf 14 hours ago|
Give them a few years and they'll only provide it by printing out a copy and mailing it to you.
RachelF 11 hours ago|
Don't give them ideas!
eredengrin 8 hours ago||
Seriously, if we keep this up they'll be sending us pallets of punch cards before you know it.