GrapheneOS says Google stopped pushing Git tags for some Android source

Public Git tags replaced with a Drive request

The GrapheneOS project says Google has stopped pushing Git tags for some of the Android source code it depends on. According to the project, that public and automated route has been replaced by a manual procedure: the code is now obtained through Google Drive after a request is submitted via a Google Forms questionnaire.

In a short post on its Mastodon account, the project described the arrangement as "completely ridiculous" and said Google had gradually become very slow at handling such requests. The post did not identify the specific components involved.

Why the project calls it a GPLv2 violation

GrapheneOS states that Google is now "in clear violation of the GPLv2." Under that licence, anyone distributing binaries must make the corresponding source code available to the people who receive them. The obligation covers the parts of the stack released under GPLv2, including the Linux kernel that Android uses.

GrapheneOS is a hardened, security-focused Android distribution that builds releases for supported Pixel devices. A project of that kind needs steady access to vendor source in order to carry security patches into its own builds; request queues and manual downloads make that harder to do on time.

What it means for downstream builders

Git tags let developers fetch the exact source tree that matches a released build, and automated tooling can follow new tags as they appear. Tag-based checkouts are standard practice when working with the Android Open Source Project. A form-based request process breaks that workflow: builds fall behind releases, and anyone redistributing a modified system has to chase the code by hand.

Google has not commented publicly on the claim, and no timetable has been given for restoring tag-based access.