Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google has stopped pushing Git tags for some Android source code

grapheneos.social

Post reply on HN
Print view View original

121–130 of 350 posts

Re: Google has stopped pushing Git tags for some Android source code

#121

Post by simoncion »

jraph wrote: post #115
simoncion wrote: post #57

Earlier quoted context omitted.

> I suppose forcing a means to share the source code could have been too restrictive, but the GPL only speaks about the shape of the source code itself (it should be "the preferred form of the work for making modifications to it"), not how it is shared... With the greatest of respect, you've forgotten what the licenses say. GPLv2: [0] 3. You may copy and distribute the Program (or a work based on it, under Section 2)…

Indeed, you are right, my phrasing "but the GPL only speaks about the shape of the source code itself" is somewhat wrong or at least incomplete. I should have been more careful. It does force some stuff about how to convey the corresponding source; and it seems the GPLv3 tries to close some loopholes or address some situations more explicitly. You cited the parts of the GPLv2 and GPLv3 I should have. I stand by the p…

> my phrasing ... is somewhat wrong

It's completely wrong.

> I stand by the position that all this doesn't seem very restrictive though.

Is your position that it's less restrictive than it needs to be?

If that's not your position, then I'm not at all sure why you're bringing this up. If that is your position, then I disagree with you. The entire point of the GPL is to require distributors to "share and share alike". It's not a "sue everyone into oblivion" license, it's a "don't be a fuckin asshole with this gift I gave you to use, inspect, and modify however you wish... pass it along to others under the same terms" license.

Re: Google has stopped pushing Git tags for some Android source code

#122

Post by klardotsh »

phire wrote: post #87
lambda wrote: post #63

Earlier quoted context omitted.

I specifically use Android because of this, among other requirements, that Apple imposes on software development on their platform. I do not own general purpose computers that I am not allowed to develop software for without permission. I have always avoided consoles for that reason as well (Steam Machine and other similar platforms would be fine, but I've been avoiding consoles for long enough that it's not somethin…

I switched to an iPhone last year, mostly because I was getting sick of Samsung’s shit, and google doesn’t sell their pixel phones locally (and I don’t like Oppo). But the other reason is that most of Android’s openness is quickly disappearing, so my main argument against iPhone is gone. And on the topic of privacy, I actually trust Apple way more than I trust the company that makes most of their revenue via advertis…

Exactly this. Once the writing was on the wall that deGoogled / FOSS Android was on borrowed time (at best), a ton of the argument against iOS dissolved overnight. We can argue that Apple's anti-repair policies and anti-user-customization policies are their own evils, sure, but at least my phone works for its core tasks, and works phenomenally well at that. My deGoogled Android phones were mostly hobbled together piles of "it sometimes works, as long as I don't look at it too funny". This tradeoff was fine for fully owning my data and being able to install absolutely anything I wanted on my phone. With arbitrary APK installation disappearing, and unlocked bootloaders to install a less hostile fork of Android becoming such a rarity these days, I may as well at least not fear looking at my phone the wrong way when the moon is in alignment with the wrong star.

Source: about 12 years of Android usage (11 of those on unlocked bootloaders and custom ROMs, ~6? of those deGoogled) -> iPhone 16e.

Re: Google has stopped pushing Git tags for some Android source code

#123

Post by grapheneos »

jmole wrote: post #4

“In violation of GPL” is a stretch. Can’t imagine Google is making the process of obtaining source code easier on themselves though. Android has always been more source-open than “open source”. The vast majority of community contributions that make it into the codebase are security fixes and small bug fixes. Everything else is essentially all the work of Google and (to some extent) Samsung.

Lack of a specific time limit in GPL doesn't mean there isn't one based on what's reasonable. What they're doing it not reasonable.

> Android has always been more source-open than “open source”.

This is about Pixels rather than AOSP. Google decided Pixels would no longer be supported by AOSP which is why they stopped pushing the kernel drivers, userspace drivers and other Pixel related code to AOSP. They moved to publishing kernel driver code via Google Drive after filling out a Google Forms submission. They're handling those manually. It's a ridiculous system and comes across as them wanting to make it a hassle on purpose. Perhaps that isn't the case and someone simply needs to make the decision to simply push Git tags somewhere else. They could put it on GitHub if the goal is disassociating it from AOSP.

We accepted the archaic new system while they were responding to requests in a reasonable time but that ended. It's now very inconsistent and is regularly getting delayed for weeks or more.

> The vast majority of community contributions that make it into the codebase are security fixes and small bug fixes.

Open source does not imply anything about accepting contributions. SQLite barely takes any contributions and the same applies to many projects. There were a lot more code contributions to AOSP than you're describing prior to recent changes with Android 16. It was relatively easy to contribute to the lower level parts of it.

Re: Google has stopped pushing Git tags for some Android source code

#124

Post by hedora »

grapheneos wrote: post #105
aleph_minus_one wrote: post #75

Earlier quoted context omitted.

> "To obtain certain source code from Google, you could previously reference git tags, but now you have to fill out a form and wait for a human to give you a google drive link." Couldn't simply someone mirror these Google Drive folders?

Yes, and we do mirror their source code on GitLab. We put the upstream 17 code in the 17-base branch and our code on top of it in the 17 branch: https://gitlab.com/grapheneos/kernel_pixel/-/tree/17-base https://gitlab.com/grapheneos/kernel_pixel_muzel/-/tree/17-b... We also have mirrors of the QPR1 Beta and QPR2 Beta code there too. It's not meant to be distributed as a tarball or a single Git repository. The build s…

Doesn't their change break supply chain security on Google's end?

With git tags, presumably people spoke in terms of cryptographic hashes. Now what prevents them from serving different Google drive contents to different accounts?

Re: Google has stopped pushing Git tags for some Android source code

#125

Post by grapheneos »

mjg59 wrote: post #78
aleph_minus_one wrote: post #75

Earlier quoted context omitted.

> "To obtain certain source code from Google, you could previously reference git tags, but now you have to fill out a form and wait for a human to give you a google drive link." Couldn't simply someone mirror these Google Drive folders?

Yes, but that person still needs to file a request and wait several days

It was initially taking under a business day for them to respond, but our recent requests have often taken weeks for them to get back to us. We want the code for all the Beta releases and are entitled to it.

This is the relevant code for Android 17:

https://gitlab.com/grapheneos/kernel_pixel/-/tree/17-base

https://gitlab.com/grapheneos/kernel_pixel_muzel/-/tree/17-b...

There are other branches there with it for Android 17 QPR1 Beta and Android 17 QPR2 Beta.

Google could save everyone including themselves a lot of hassle by simply publishing it to GitHub. If they don't want to push it to AOSP for weird organizational reasons as part of saying AOSP doesn't support Pixels, fine. Taking weeks or more to get back to us isn't reasonable for one the largest tech companies in the world.

It's also questionable whether what they're providing is truly the preferred form for modification considering the build system is quite unhappy about the lack of Git repositories. They had to provide a repo manifest metadata file to work around part of it.

Re: Google has stopped pushing Git tags for some Android source code

#126

Post by hedora »

TheMiddleMan wrote: post #47

Relevant: https://keepandroidopen.org/ > Starting in 2027*, a silent update, nonconsensually pushed by Google, will block every Android app whose developer hasn't registered with Google, signed their contract, paid up, and handed over government ID.

Any word as to whether this will apply to GrapheneOS? If I had to choose, I'd block apps that did comply with this BS.

Re: Google has stopped pushing Git tags for some Android source code

#127

Post by CBLT »

hedora wrote: post #124
grapheneos wrote: post #105

Earlier quoted context omitted.

Yes, and we do mirror their source code on GitLab. We put the upstream 17 code in the 17-base branch and our code on top of it in the 17 branch: https://gitlab.com/grapheneos/kernel_pixel/-/tree/17-base https://gitlab.com/grapheneos/kernel_pixel_muzel/-/tree/17-b... We also have mirrors of the QPR1 Beta and QPR2 Beta code there too. It's not meant to be distributed as a tarball or a single Git repository. The build s…

Doesn't their change break supply chain security on Google's end? With git tags, presumably people spoke in terms of cryptographic hashes. Now what prevents them from serving different Google drive contents to different accounts?

It doesn't break supply chain security for anybody with power to change the situation.

Re: Google has stopped pushing Git tags for some Android source code

#128

Post by [deleted] »

hedora wrote: post #124
grapheneos wrote: post #105

Earlier quoted context omitted.

Yes, and we do mirror their source code on GitLab. We put the upstream 17 code in the 17-base branch and our code on top of it in the 17 branch: https://gitlab.com/grapheneos/kernel_pixel/-/tree/17-base https://gitlab.com/grapheneos/kernel_pixel_muzel/-/tree/17-b... We also have mirrors of the QPR1 Beta and QPR2 Beta code there too. It's not meant to be distributed as a tarball or a single Git repository. The build s…

Doesn't their change break supply chain security on Google's end? With git tags, presumably people spoke in terms of cryptographic hashes. Now what prevents them from serving different Google drive contents to different accounts?

[deleted]

Re: Google has stopped pushing Git tags for some Android source code

#129

Post by hedora »

petcat wrote: post #15
dgellow wrote: post #2

Quoting the first tweet: > Google replaced pushing Git tags for certain source code with obtaining source code via Google Drive after making a request through Google Forms. It's completely ridiculous and they've gradually become very slow at handling requests. They're in clear violation of the GPLv2 now.

> They're in clear violation of the GPLv2 now. I don't think they are? They could just as easily require requests for the source code to be made through the regular mail instead of a Google form. It's still (maliciously) compliant with the license.

There's an easy way to put them into compliance violation:

Get a large brigade of android users to request access to source on each security update.

Re: Google has stopped pushing Git tags for some Android source code

#130

Post by hedora »

ares623 wrote: post #73
cute_boi wrote: post #13

Earlier quoted context omitted.

I assume Linux. I am very thankful linux is gpl. Because of GPL these tech giants are forced to release source code.

But Linux allowed Tivoization though.

There are worse things than Tivoization.

Google helped lobby the FSF to adopt GPLv3, which bans tivoization, but allows software as a service.

This is why you cannot have bash on MacOS, but Google can still use it to build surveillance capitalism, and arbitrarily enshittify your word processor.

Post reply on HN