3 ms·

Yes, and we do mirror their source code on GitLab. We put the upstream 17 code in the 17-base branch and our code on top of it in the 17 branch: https://gitlab

Yes, and we do mirror their source code on GitLab. We put the upstream 17 code in the 17-base branch and our code on top of it in the 17 branch: https://gitlab.com/grapheneos/kernel_pixel/-/tree/17-base https://gitlab.com/grapheneos/kernel_pixel/-/tree/17-base https://gitlab.com/grapheneos/kernel_pixel_muzel/-/tree/17-base https://gitlab.com/grapheneos/kernel_pixel_muzel/-/tree/17-b... We also have mirrors of the QPR1 Beta and QPR2 Beta code there too. It's not meant to be distributed as a tarball or a single Git repository. The build system runs Git commands to determine the revisions of each component. It's supposed to be in dozens of Git repositories. They provide repo metadata as part of the tarballs on Google Drive which you can see there but it's not a full replacement for the Git repository layout expected by builds. It's somewhat convenient having it in a monorepo but it's not the way it's meant to be and the build system makes it clear that it isn't happy about it despite running. It would be nice if Google would simply push it to the Git repositories still available on AOSP again. The repositories still exist both internally and publicly but they're making it a hassle instead of simply pushing tags. We publicly complained about these and other Pixel changes as they were ongoing and that directly led to our Motorola partnership. It was in Google's financial interest to work with us so we continue using Pixels and that's still the case. They're welcome to reach out to us and start collaborating again. We made a lot of upstream contributions and aren't their enemy. Google should want more people to use their devices, apps and services. It shows how heavily they're violating antitrust laws by using monopolies to protect other monopolies when they sacrifice revenue for their devices and apps/services for it.

hedora 2mo ago
Doesn't their change break supply chain security on Google's end? With git tags, presumably people spoke in terms of cryptographic hashes. Now what prevents them from serving different Google drive contents to different accounts?
- CBLT 2mo ago
  It doesn't break supply chain security for anybody with power to change the situation.
  - asdfsa32 2mo ago
    It is an easy to overlook this, but even for someone in position of power to change, creating different code with the same hash is borderline impossible.
    - CBLT 2mo ago
      Non-sequitor? They're not providing a (sha-1) hash, they're providing source code to integration partners using their business channels, not public git providers. Those business channels include contracts etc to "secure their supply chain". You and I aren't in those business channels, and we're not being given anything with a hash. There's simply no hash to collide with?
      - asdfsa32 2mo ago
        A git hash is cryptographically secure. It doesn't matter how you distribute it. That is the entire point you're missing.
        CBLT 2mo ago
        The Google Drive link is to a simple tarball, not a git artifact.
        asdfsa32 2mo ago
        Yes, that is the problem, as the titles says "Google has stopped pushing Git tags". No git tags, no cryptographic content hash.
- deleted 2mo ago
  [deleted]
mvdtnz 2mo ago
[flagged]
- processunknown 2mo ago
  There is a giant list of reasons here https://grapheneos.org/faq#future-devices https://grapheneos.org/faq#future-devices
- deleted 2mo ago
  [deleted]
- tannertech 2mo ago
  Answered long ago: https://grapheneos.org/faq#future-devices https://grapheneos.org/faq#future-devices
geokon 2mo ago
Maybe a naiive question, but couldn't you request the source code from phone companies? Say you request it from Xiaomi - sure they're not the original writers of the code, but they too "distributing GPL code" and therefore must release the code on request. They may be more amenable to your request since they have leverage with Google and are in an adversarial relationship
- nikanj 2mo ago
  You can request anything from anyone, but compelling a company to follow their GPL obligations requires cooperation from the copyright holders + infinite funds for legal fees
- Gud 2mo ago
  “Couldn’t you just” couldn’t fucking GOOGLE, the don’t do evil corporation, support one of the few alternative mobile phone OSs use standard development tools, instead of being little shits?

hedora 2mo ago

Doesn't their change break supply chain security on Google's end? With git tags, presumably people spoke in terms of cryptographic hashes. Now what prevents them from serving different Google drive contents to different accounts?

CBLT 2mo ago
It doesn't break supply chain security for anybody with power to change the situation.
- asdfsa32 2mo ago
  It is an easy to overlook this, but even for someone in position of power to change, creating different code with the same hash is borderline impossible.
  - CBLT 2mo ago
    Non-sequitor? They're not providing a (sha-1) hash, they're providing source code to integration partners using their business channels, not public git providers. Those business channels include contracts etc to "secure their supply chain". You and I aren't in those business channels, and we're not being given anything with a hash. There's simply no hash to collide with?
    - asdfsa32 2mo ago
      A git hash is cryptographically secure. It doesn't matter how you distribute it. That is the entire point you're missing.
      - CBLT 2mo ago
        The Google Drive link is to a simple tarball, not a git artifact.
        asdfsa32 2mo ago
        Yes, that is the problem, as the titles says "Google has stopped pushing Git tags". No git tags, no cryptographic content hash.
deleted 2mo ago
[deleted]

mvdtnz 2mo ago

[flagged]

processunknown 2mo ago
There is a giant list of reasons here https://grapheneos.org/faq#future-devices https://grapheneos.org/faq#future-devices
deleted 2mo ago
[deleted]
tannertech 2mo ago
Answered long ago: https://grapheneos.org/faq#future-devices https://grapheneos.org/faq#future-devices

geokon 2mo ago

Maybe a naiive question, but couldn't you request the source code from phone companies? Say you request it from Xiaomi - sure they're not the original writers of the code, but they too "distributing GPL code" and therefore must release the code on request. They may be more amenable to your request since they have leverage with Google and are in an adversarial relationship

nikanj 2mo ago
You can request anything from anyone, but compelling a company to follow their GPL obligations requires cooperation from the copyright holders + infinite funds for legal fees
Gud 2mo ago
“Couldn’t you just” couldn’t fucking GOOGLE, the don’t do evil corporation, support one of the few alternative mobile phone OSs use standard development tools, instead of being little shits?