Google is making Pixel source code unnecessarily difficult to obtain — and GrapheneOS says this may violate GPLv2
If you haven't been following this, Google has changed how it distributes some of the source code needed to build and port Android for Pixel devices.
Previously, Google would publish the relevant source code through its Git repositories and push release/Beta tags. This is the normal workflow: when a new Pixel Android Beta comes out, projects like GrapheneOS can fetch the exact corresponding Git tag, port it, and begin testing.
Google has gradually changed this process.
First, Google started squashing the Git history into a single commit before pushing release tags. The source code itself was still there, but the full Git history was no longer available.
Now, for some of the source, Google has gone a step further: instead of pushing the release tags to Git, Google puts tarballs on Google Drive.
To get those tarballs, GrapheneOS has to submit a Google Form requesting access to specific files, after which someone at Google has to manually provide access.
The source code in the tarballs is apparently the same source code that would otherwise be available through Git. The issue is the completely unnecessary process around obtaining it.
According to GrapheneOS:
> "Initially, Google would usually provide access to the tarballs within a couple hours. Lately, they're often taking weeks to get back to us."
This is particularly problematic because GrapheneOS needs each Beta release. They use the Beta source to port and test upcoming releases in advance. Waiting weeks for Google to approve access can therefore directly interfere with development.
Google could simply push signed Git tags like it did before.
Or, if it insists on using Google Drive, it could automate access or give access to folders rather than requiring individual requests for individual files.
Instead, someone at Google apparently has to go through a growing backlog of requests and manually grant access.
GrapheneOS's position is that Google is obligated to provide the corresponding GPLv2 source, and that this increasingly slow and cumbersome process is Google's responsibility. If Google doesn't want to deal with repeated requests for every release, the obvious solution is simply to publish the Git tags again.
There is an important distinction here: GPLv2 doesn't require Google to use Git specifically. The mere fact that Google switched from Git to Google Drive isn't automatically a GPL violation. The legal question is whether Google is actually making the complete corresponding source available in a manner that satisfies the GPL's requirements.
But if the source corresponding to distributed GPL-covered software is effectively sitting behind a manual request system where access can take weeks, that's where the GPL compliance question becomes much more interesting.
And this isn't just an inconvenience for GrapheneOS. It makes the Pixel development process less reproducible and less automatable for anyone depending on Google's release source.
GrapheneOS also says this won't negatively affect its upcoming Motorola devices. Their partnership with Motorola allows them to prepare releases early and host the necessary Android Git repositories themselves.
So, ironically, the people most immediately hurt by this change are Pixel developers — including GrapheneOS — while Google is also making its own Pixel platform harder for third-party developers to work with.
Google could solve this extremely easily: Just push the signed Git tags.