What's this about?
GrapheneOS reports that to obtain certain Android source code, Google has replaced pushing Git tags with a process where you submit a Google Form request and eventually receive a Google Drive link. They say the handling has become gradually slower and call it a clear GPLv2 violation.
What exactly is a Git tag, and why does this matter?
A tag is a permanent label on a specific commit — "this exact code is release 15.0" — that anyone can fetch instantly and verify. Replacing it with a form request means the source is technically still available but only through a human-mediated process with unpredictable latency, and with no cryptographic link between what you receive and what shipped. For a project like GrapheneOS, which builds a hardened Android from source, that latency is the whole problem: security patches must be rebuilt promptly, and waiting on a form breaks that.
What's the community saying?
- "'In violation of GPL' is a stretch." The most-upvoted correction: GPLv2 requires providing source, not providing it conveniently — so this is likely malicious compliance rather than a violation.
- "Android has always been more source-open than open-source." A widely-agreed framing, with the observation that community contributions have mostly been security fixes and small patches rather than shared development.
- Genuine confusion about scope. Multiple commenters couldn't tell which components this affects, and one wrote a plain-language translation of the headline that got upvoted for clarity alone.
- The sideloading connection. Several tied it to other recent Android restrictions, arguing that openness and sideloading were the reasons to choose the platform and both are being narrowed.