Join the discussion
Write your take first — we'll ask for email only when you're ready to publish.
- Hacker News
- “In violation of GPL” is a stretch.
Can’t imagine Google is making the process of obtaining source code easier on themselves though.
Android has always been more source-open than “open source”. The vast majority of community contributions that make it into the codebase are security fixes and small bug fixes.
Everything else is essentially all the work of Google and (to some extent) Samsung.
by jmole - The era of big tech cooperation around free software is obviously over.
Those kind of moves are petty but there are worst tricks they can pull unfortunately.
It seems Grapheneos is the rare actor willing to put up a fight nowadays, and their "partnership" with Motorola seems to be a first step. They need to ensure a hardware platform.
My guess is at some point they will have to fork AOSP, just because Google will take it in directions that go against Grapheneos principles.
by sunshine-o - GPL says that you can give that link to anyone you want.
If someone on HN has received one of these links, feel free to post it here.
by gumby - We need something other than Android, and we need the government to make sure we can run Android apps (like government ID and banking apps) without being spied on. They've been doing whatever the f they like for long enough if you ask me.by teekert
- What's the point of Android if not of being open?!! I don't see any value for them to be closed or combative. It's sad to see Google, once the greatest company on earth, lose absolutely everything of what they made them great in just a matter of a couple of years.by doe88
- I don't think the real focus is on the tags, but on the delay here via a form as well as human interaction.
Worded differently, the simplest way to provide the source code is IMO via a URL that you can just wget. At the least this is done by so many projects out there. Google refusing to do so means Google wants to violate the GPLv2, since their alternatives are inferior.
https://distrowatch.com/ has many convenient links to URLs on the left side; I often use that to download the latest and greatest and compile it away, e. g. https://ftp.isc.org/isc/bind9/9.20.27/bind-9.20.27.tar.xz as a current example, taken from the left panel.
by shevy-java - Let's just forget about the tags, the point is that they're not publishing what Graphene OS needs on any git repository that they can access.
Even before that it had been jokes of repositories, but at least you didn't have to ask for someone every time and wait for them to respond to the request.
(that's my understanding)
by g-b-r - They stopped pushing tags for any of the Pixel kernel or userspace driver repositories to AOSP. They also stopped pushing AOSP releases specific to Pixels which is why AOSP now only gets yearly releases, QPR2 releases and security backports to both of those. Other OEMs use the yearly and theoretically also the QPR2 releases. Both the yearly and QPR2 releases get monthly security backports. Since they dropped Pixel support from AOSP, they don't push the releases not shipped by other OEMs anymore.
These changes directly led to our Motorola partnership. One of their security people reached out to us after seeing our posts about this with the launch of Android 16. We haven't talked about it much since then since we adapted to it during the several weeks it delayed our Android 16 port. We then continued adapting to it and have fully worked around it. It was an ongoing problem but not a new one and we had accepted we had to deal with it as the new normal.
They were previously responding to our kernel source requests within a day. It was often done without hours. Despite the archaic system, this part wasn't that bad. Recently, they've been taking weeks or longer to get back to us for the requests which is ridiculous. It's the direct result of purposely adding a lot of friction with manual handling of the requests even if the delays weren't directly planned by management.
Weeks or months of delay is not reasonable for one of the largest tech companies in the world. GPL doesn't set a standard time limit for providing the sources, but that doesn't mean they can delay it indefinitely. They need to do it in a reasonable amount of time. What's reasonable for one of the largest tech companies in the world in 2026 with current technology is not the same as what was reasonable 30 years ago. Google chose to come up with a archaic way of distributing the sources involving someone manually going through a list and sharing Google Drive access. It's a deliberate way of making it painful. If they can't keep up with it and it gets delayed for weeks or months then they're not complying with the GPL by not providing it in a reasonable amount of time. Law is not code and a time limit not being explicitly written down doesn't mean there isn't a limit to what's reasonable for compliance.
They'll sell far fewer Pixels because of these overall changes. It pushes GrapheneOS and other projects towards other devices instead. For us, Pixels are being used due to security rather than ease of supporting them. It's now a lot harder to deal with Pixels than it would be for many other devices but they're currently still the most secure option. We're working on changing that and have a lot less reason to contribute to improving Pixels. We helped them fix serious security weaknesses for Pixels including vulnerabilities being exploited in the wild by forensic data extraction companies. Pixel security with the stock OS would be worse without GrapheneOS.
by grapheneos