hackernews client

Google replaced Git tags for certain source code with obtaining via Google Drive

226 pointsposted 6 hours ago

74 Comments

hatthew

3 hours ago

If you're like me and struggled to parse the title, my understanding is, "To obtain certain source code from Google, you could previously reference git tags, but now you have to fill out a form and wait for a human to give you a google drive link."

aleph_minus_one

4 minutes ago

> "To obtain certain source code from Google, you could previously reference git tags, but now you have to fill out a form and wait for a human to give you a google drive link."

Couldn't simply someone mirror these Google Drive folders?

g-b-r

2 hours ago

Let's just forget about the tags, the point is that they're not publishing what Graphene OS needs on any git repository that they can access.

Even before that it had been jokes of repositories, but at least you didn't have to ask for someone every time and wait for them to respond to the request.

(that's my understanding)

shevy-java

an hour ago

I don't think the real focus is on the tags, but on the delay here via a form as well as human interaction.

Worded differently, the simplest way to provide the source code is IMO via a URL that you can just wget. At the least this is done by so many projects out there. Google refusing to do so means Google wants to violate the GPLv2, since their alternatives are inferior.

https://distrowatch.com/ has many convenient links to URLs on the left side; I often use that to download the latest and greatest and compile it away, e. g. https://ftp.isc.org/isc/bind9/9.20.27/bind-9.20.27.tar.xz as a current example, taken from the left panel.

bitpush

36 minutes ago

> Google refusing to do so means Google wants to violate the GPLv2

Not an expert in GPL, but does it say that the source code needs to be provided by a url?

devy

24 minutes ago

GPL doesn't require them to publish the source in git. FWIW, Google can be compliant and publish the source in Physical Medium too if they opt too.

Also, the OP did mentioned that Google also squashed the git commit to a single commit for whatever reason.

mikestorrent

6 minutes ago

Can't wait for pallets of paper to get shipped out to comply maliciously

TheMiddleMan

an hour ago

Relevant: https://keepandroidopen.org/

> Starting in 2027*, a silent update, nonconsensually pushed by Google, will block every Android app whose developer hasn't registered with Google, signed their contract, paid up, and handed over government ID.

paxys

an hour ago

Doesn’t Apple do the same?

sunaookami

an hour ago

The difference is that Apple always did it with iOS and Google did not. Many chose Android because of that.

lambda

29 minutes ago

I specifically use Android because of this, among other requirements, that Apple imposes on software development on their platform.

I do not own general purpose computers that I am not allowed to develop software for without permission. I have always avoided consoles for that reason as well (Steam Machine and other similar platforms would be fine, but I've been avoiding consoles for long enough that it's not something I really look for any more).

I was a major Apple fanboy up until the iPhone. Left the ecosystem after the iPhone and macOS started moving in that direction as well.

I'm going to miss having a smartphone that I can use with my banking and EV apps, but probably for the best to get out of Google's ecosystem. Hoping that GrapheneOS will still allow me to use some of the apps that I like.

mikestorrent

3 minutes ago

Android has been a brutal disappointment on this front since the day it launched. Sure, you could hack various devices and spend too much time on xda-developers and get custom ROMs, but if you compare that to the openness of even a stock Windows PC it's an absolute joke. Android was supposed to be the open Linux phone, when I bought my HTC G1 full of hope; turned into an inferior iPhone wannabe with worse performance and a low quality walled garden that keeps most people in without keeping the trash out.

Time to start over.

EastSmith

an hour ago

Does it matter that Apple does the same?

croes

an hour ago

Did Apple claim iOS is open source?

mikestorrent

a few seconds ago

Well, https://github.com/apple-oss-distributions/xnu is, but it's not enough to make you an iPhone.

paxys

28 minutes ago

AOSP is open source. The Android running on most manufacturer-branded phones isn’t.

jmole

3 hours ago

“In violation of GPL” is a stretch.

Can’t imagine Google is making the process of obtaining source code easier on themselves though.

Android has always been more source-open than “open source”. The vast majority of community contributions that make it into the codebase are security fixes and small bug fixes.

Everything else is essentially all the work of Google and (to some extent) Samsung.

flotzam

an hour ago

GrapheneOS is arguing that throwing away the metadata of however many commits and squashing them into a messy tarball is not the "preferred form of the work for making modifications", and that a manual process where you have to fill out a form in order to get a Google Drive link a week later is not "a medium customarily used for software interchange" in current times. Those are quotes from the GPLv2.

kllrnohj

10 minutes ago

> Android has always been more source-open than “open source”. The vast majority of community contributions that make it into the codebase are security fixes and small bug fixes.

I believe this isn't actually about "Android" at all but rather Pixel. Android is still openly accessible on git. But the kernel sources for Pixel devices is now behind this big song & dance for some fucking inexcusable reason.

phire

27 minutes ago

Google are absolutely within the letter of the GPL, pedantically so. But maybe not the sprit.

We didn't have git tags when GPL was written in 1989, and while we did have sccs and rcs, (and early versions of cvs) they just weren't that widely used, and generally not used for distribution.

Even when GPL 3.0 was written in 2005-2007, source tarballs were still the primary form of distribution, even though it was starting to become standard to additionally provide anonymous cvs, svn, or one of the brand new distributed systems like git.

But these days git is the primary form of distribution, and source tarballs are noting more an afterthought. Hell, even tags are a bit of an afterthought on many projects. It's basically become the norm to expect an healthy revision history for any open source code.

Based on it's stated goals of "freedom to modify the software you use", IMO if the GPL was written (or updated) today, it would most likely require the distribution of revision history and restrict how much that history can be squashed/rewritten.

flotzam

15 minutes ago

> We didn't have git tags when GPL was written in 1989

The GPLv2 requires "a medium customarily used for software interchange", not "a medium customarily used in 1989 for software interchange". Customs are the customs of the time someone is releasing the work.

jraph

2 hours ago

Open source doesn't imply open to contributions. And you could imagine source available software that's not open source but takes contributions (and this is not theoretical, I've seen this in the wild).

(However, that's quite orthogonal to being a dick about making the source code that you must share available)

leipert

21 minutes ago

GitLab is MIT licensed, but also has also parts which are source available but not MIT licensed. Contributions to both are possible.

jsiepkes

3 hours ago

> Everything else is essentially all the work of Google and (to some extent) Samsung.

There is plenty in Android which isn't the work of Google. For starters the Kotlin implementation and the Java implementation (OpenJDK).

shevy-java

an hour ago

Why would it be a "stretch"?

The basic requirement is whether the source code is available - and made available. Are you certain that Google's solution here is ensuring that the source code is easily made available? So many other projects just provide a wget-able link. Why does Google want to make it harder to obtain the source code than those other projects?

> Android has always been more source-open than “open source”.

And what exactly does that mean? I don't know what your words mean here. More source open than open source? Is that a tautology?

> Everything else is essentially all the work of Google and (to some extent) Samsung.

Is it GPLv2? If so then I fail to see why anyone should get higher rights. Everyone gets the same for GPLv2. That's the whole point. I don't understand your statements here.

knollimar

an hour ago

"And what exactly does that mean? I don't know what your words mean here. More source open than open source? Is that a tautology?"

I'm sure this means the source happens to be open rather than following the spirit of open source.

ajross

3 hours ago

> “In violation of GPL” is a stretch.

The originally envisioned distribution method, in fact, was "Send FSF a blank 9-track tape and they'll fill it and mail it back". Nor, obviously, does anything prevent someone who downloads this from Drive from mirroring it on GitHub or wherever.

This is arguably bad stewardship of a historically open source project. It's certainly not a license violation.

Brian_K_White

3 hours ago

It's paying a bill in pennies.

ajross

3 hours ago

It's not even that. Downstream projects host their own mirrors already, this is an annoying hoop to jump through for the maintainers (basically suck down a bunch of tarballs for every release, analogous to grabbing stuff from FTP sites back in the day), but not exactly a terrible hardship compared to the really very significant work of maintaining a large project.

simoncion

2 hours ago

There might be some merit to a claim that Google Drive isn't a medium customarily used for software distribution these days, but, yeah, it's definitely not paying a thousand+ cent bill in pennies, and I'm skeptical that it's a violation of the letter of the GPL.

It is definitely a dick move by Google.

jraph

2 hours ago

> There might be some merit to a claim that Google Drive isn't a medium customarily used for software distribution these days

I suppose forcing a means to share the source code could have been too restrictive, but the GPL only speaks about the shape of the source code itself (it should be "the preferred form of the work for making modifications to it"), not how it is shared, so indeed, not a violation of the letter of the GPL I think.

It's like what we had in France and the Hadopi, which requested ISPs to share the IP addresses of people torrenting a defined set of files. One of them sent them printed on paper... (But the malicious compliance was cool in this case).

simoncion

an hour ago

> I suppose forcing a means to share the source code could have been too restrictive, but the GPL only speaks about the shape of the source code itself (it should be "the preferred form of the work for making modifications to it"), not how it is shared...

With the greatest of respect, you've forgotten what the licenses say.

GPLv2: [0]

  3. You may copy and distribute the Program (or a work based on it, under Section 2) in object code or executable form under the terms of Sections 1 and 2 above provided that you also do one of the following:
  
    a) Accompany it with the complete corresponding machine-readable source code, which must be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange; or, 
    
    b) Accompany it with a written offer, valid for at least three years, to give any third party, for a charge no more than your cost of physically performing source distribution, a complete machine-readable copy of the corresponding source code, to be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange; or,
    
    ...

GPLv3: [1]

  6. Conveying Non-Source Forms.
  You may convey a covered work in object code form under the terms of sections 4 and 5, provided that you also convey the machine-readable Corresponding Source under the terms of this License, in one of these ways:

    a) Convey the object code in, or embodied in, a physical product (including a physical distribution medium), accompanied by the Corresponding Source fixed on a durable physical medium customarily used for software interchange.
    
    b) Convey the object code in, or embodied in, a physical product (including a physical distribution medium), accompanied by a written offer [to convey the source code upon request]...  on a durable physical medium customarily used for software interchange, for a price no more than your reasonable cost of physically performing this conveying of source, or (2) access to copy the Corresponding Source from a network server at no charge.
    
    ...
    
    d) Convey the object code by offering access from a designated place (gratis or for a charge), and offer equivalent access to the Corresponding Source in the same way through the same place at no further charge. ...
    
    e) Convey the object code using peer-to-peer transmission, provided you inform other peers where the object code and Corresponding Source of the work are being offered to the general public at no charge under subsection 6d.

This unambiguously speaks about the form in which the source code is shared. If the licenses didn't specify this, folks would be compliant with the letter of the license by shipping you a printout of the source code and everything you need to build it and charging you for both the labor to generate that enormous, heavy-ass printout and shipping and handling to get it to you. [2]

[0] <https://www.gnu.org/licenses/old-licenses/gpl-2.0.html>

[1] <https://www.gnu.org/licenses/gpl-3.0.html>

[2] To downvoters: Don't forget that OCR was decent even back in the 1990s... certainly good enough for a good-quality printout in a fixed-width font to be -strictly speaking- machine-readable, and it has only gotten better as time has wobbled on. If you don't believe my account of the history, go look up how Zimmerman exported copies of PGP back when it was considered an export-controlled munition.

leni536

2 hours ago

While I don't find any requirements on how timely the source distribution must be upon request, one can reasonably say that there must be a line between 1 nanosecond and 1 century.

shevy-java

an hour ago

Courts would most definitely make a distinction here. For instance, one century would mean "refusing to release the source code".

We should test how long it takes Google to release source code upon request. And whether it is 100%. I think we should test whether Google fulfils the GPL here. That's now a challenge.

cdrnsf

40 minutes ago

Give them a few years and they'll only provide it by printing out a copy and mailing it to you.

dgellow

4 hours ago

Quoting the first tweet:

> Google replaced pushing Git tags for certain source code with obtaining source code via Google Drive after making a request through Google Forms. It's completely ridiculous and they've gradually become very slow at handling requests. They're in clear violation of the GPLv2 now.

petcat

3 hours ago

> They're in clear violation of the GPLv2 now.

I don't think they are? They could just as easily require requests for the source code to be made through the regular mail instead of a Google form. It's still (maliciously) compliant with the license.

logological

2 hours ago

> I don't think they are?

If filling out the source code request form via Google Forms and/or accessing the download link via Google Drive requires the requester to run non-free (or at least non-GPLv2) JavaScript, then maybe it is in violation of section 6 of the GPLv2 ("You may not impose any further restrictions on the recipients' exercise of the rights granted herein") since the requester is then required to accept an entirely different set of licensing terms and conditions.

nomel

2 hours ago

IANAL, but I don't think you're interpreting that correctly.

I believe section 3.b and 3.c are the rights this is referring to, where you can request the source, and even be changed for the physical act. Suggesting this extends to the license of the implementation of their contact system doesn't make sense. No method of contact, except physical, is going to meet your requirements, including sending postage, where the software used to sort your mail is not GPL.

r3trohack3r

2 hours ago

I think it’s nuanced

I can see an argument that Google is requiring you to enter into a separate agreement with them (the terms they require you to agree to when using Google Forms) to request access to the GPL licensed source.

You do not enter into an agreement with the vendor of the software the postal service uses to sort your mail.

Dylan16807

2 hours ago

If they do force you into google forms and you can't send a letter then that's a potential issue.

Making you run javascript is a weaker argument...

waisbrot

an hour ago

Don't they force you to sign up for a Google account to be able to gate access to a Google Drive file?

compiler-guy

an hour ago

No. As long as the sharing permission is “Anyone with the link”, then anyone can download from that link with wget or whatever.

Is that the permission they use? Who knows? But it’s at least possible.

rlpb

3 hours ago

Didn't Google work very hard to avoid any GPL in Android, apart from the kernel? What is in there that is GPL?

cute_boi

3 hours ago

I assume Linux.

I am very thankful linux is gpl. Because of GPL these tech giants are forced to release source code.

ares623

6 minutes ago

But Linux allowed Tivoization though.

gowld

3 hours ago

How slow is "very slow" ? What is "certain source code"? Why is the OP being so coy about describing the problem?

Here is the form:

https://source.android.com/opensourcerequest

This is interesting:

> We might charge you a fee to cover the cost of processing. Your request must be sent according to whichever of the following rules applies:

> Within three years of the date you received the product from Google that included the component or binary files that are the subject of your request.

That "three years" is the minimum named in the GPLv2: https://opensource.org/license/gpl-2.0

HarlequinHair

3 hours ago

> How slow is "very slow?" The answer can be found two replies after: > Initially, Google would usually provide access to the tarballs within a couple hours. Lately, they're often taking weeks to get back to us. They're the ones who chose to use this archaic system instead of pushing Git tags and it's their responsibility to handle requests promptly.

> What is "certain source code"? The OP seems to be GrapheneOS, which heavy patches AOSP. I guess the context is Android source code and its security patches.

> Why is the OP being so coy about describing the problem? Not sure what you mean, I think they are explicit enough. I guess it's clear enough for developers how an upstream update should go. If people depend on big projects like AOSP, devs should be prompt in delivering source code, especially when it is mandatory by license.

Can you give us more details on how/why you think the OP is being coy?

spydum

3 hours ago

isn't this just malicious compliance? not clear how this would violate GPLv2?

osmsucks

3 hours ago

Yeah, I agree. While this is a terrible move IMHO, from my superficial reading of the GPLv2 it doesn't really constitute a violation: the license imposes that the source be distributed to anyone who asks, potentially even charge a fee to cover its distribution costs, but it doesn't require that development happen in the open.

shevy-java

an hour ago

I mean, the only way to test this is to require of Google here to release the source code. And then look at how a court will evaluate it. For instance, what if Google never sends the source code? What if they claim that no request made it in? Though I guess this can be ensured, e. g. via letter that is registered being sent and then looking at Google's response to it.

So right now I think we all probably do not know. Google MIGHT refuse to release the source code, but it could release it - we don't know yet. Someone has to test that.

osmsucks

an hour ago

> For instance, what if Google never sends the source code? What if they claim that no request made it in?

That would be a violation of the license terms. All Google has done so far is, apparently, to make it hella annoying to access the source code (but not impossible).

dataflow

2 hours ago

Can't help but wonder if making it costly for themselves the entire point. So that they can later turn around and bill that distribution fee to the recipient.

gumby

2 hours ago

GPL says that you can give that link to anyone you want.

If someone on HN has received one of these links, feel free to post it here.

a-dub

29 minutes ago

hanlon's razor comes to mind. which trees are these? weird device trees that have complicated third party licensing nonsense attached?

i remember jumping through crazy hoops to interact with a google open source project years ago. i wouldn't be surprised if it's just megacorp bureaucracy.

demibabs

3 hours ago

Can someone explain what this means? Am not familiar with the terminology

Zigurd

an hour ago

It means Google is making it harder than it needs to be to obtain source code. It's a dick move, and the only plausible interpretations are that it will get harder still, and it's intended to slow down projects like GrapheneOS. Even if it can be lawyered to be in the letter of the open source licenses that apply, it's not in the spirit of those licenses.

paxys

2 hours ago

Google uses libraries licensed under GPLv2 in Android (I’m not sure which specific part of Android the author is talking about), and so is required to make the full source code available for anyone to view. They previously used to publish release tag tarballs, but now require you to fill out a Google form and then (weeks later) will share the source with you on Google Drive.

pydry

2 hours ago

Google apparently wants everybody to know how much they hate abiding by the terms of open source licenses.

matheusmoreira

2 hours ago

Every year a new low.

el1s7

an hour ago

It's a bit unclear what this is about exactly. What releases are we talking about? How git tags come into play here?

zb3

41 minutes ago

Pixel kernel drivers which are GPLv2, you need them to build the kernel modules from source. Git tags in this case refer to beta versions, but it being "beta" doesn't mean they can delay the release.

dminik

26 minutes ago

I really don't understand the thought process here.

Judging by public statements, Google is one of the 3 big western AI companies. Surely they should be rolling in cash and working hard towards AGI.

And yet, for whatever reason, they can't help themselves from further restricting user freedoms on Android. Why?

I don't want to be conspiratorial, but surely it's not money, right? It has to be control. Someone high up at Google just seems to resent people having control over their own devices.

torgeros

2 hours ago

That's like this fun fact where Microsoft needs to send you source code via post when you mail them a 5$ check. lol

shevy-java

2 hours ago

Google needs to lose in court here. This company is getting more and more evil by the day.

sunshine-o

an hour ago

The era of big tech cooperation around free software is obviously over.

Those kind of moves are petty but there are worst tricks they can pull unfortunately.

It seems Grapheneos is the rare actor willing to put up a fight nowadays, and their "partnership" with Motorola seems to be a first step. They need to ensure a hardware platform.

My guess is at some point they will have to fork AOSP, just because Google will take it in directions that go against Grapheneos principles.