7 ms·

“In violation of GPL” is a stretch. Can’t imagine Google is making the process of obtaining source code easier on themselves though. Android has always been m

by jmole 29d ago

“In violation of GPL” is a stretch. Can’t imagine Google is making the process of obtaining source code easier on themselves though. Android has always been more source-open than “open source”. The vast majority of community contributions that make it into the codebase are security fixes and small bug fixes. Everything else is essentially all the work of Google and (to some extent) Samsung.

ajross 29d ago
> “In violation of GPL” is a stretch. The originally envisioned distribution method, in fact, was "Send FSF a blank 9-track tape and they'll fill it and mail it back". Nor, obviously, does anything prevent someone who downloads this from Drive from mirroring it on GitHub or wherever. This is arguably bad stewardship of a historically open source project. It's certainly not a license violation.
- Brian_K_White 29d ago
  It's paying a bill in pennies.
  - ajross 28d ago
    It's not even that. Downstream projects host their own mirrors already, this is an annoying hoop to jump through for the maintainers (basically suck down a bunch of tarballs for every release, analogous to grabbing stuff from FTP sites back in the day), but not exactly a terrible hardship compared to the really very significant work of maintaining a large project.
    - simoncion 28d ago
      There might be some merit to a claim that Google Drive isn't a medium customarily used for software distribution these days, but, yeah, it's definitely not paying a thousand+ cent bill in pennies, and I'm skeptical that it's a violation of the letter of the GPL. It is definitely a dick move by Google.
      - jraph 28d ago
        > There might be some merit to a claim that Google Drive isn't a medium customarily used for software distribution these days I suppose forcing a means to share the source code could have been too restrictive, but the GPL only speaks about the shape of the source code itself (it should be "the preferred form of the work for making modifications to it"), not how it is shared, so indeed, not a violation of the letter of the GPL I think. It's like what we had in France and the Hadopi, which requested ISPs to share the IP addresses of people torrenting a defined set of files. One of them sent them printed on paper... (But the malicious compliance was cool in this case).
        simoncion 28d ago
        > I suppose forcing a means to share the source code could have been too restrictive, but the GPL only speaks about the shape of the source code itself (it should be "the preferred form of the work for making modifications to it"), not how it is shared... With the greatest of respect, you've forgotten what the licenses say. GPLv2: [0] 3. You may copy and distribute the Program (or a work based on it, under Section 2) in object code or executable form under the terms of Sections 1 and 2 above provided that you also do one of the following: a) Accompany it with the complete corresponding machine-readable source code, which must be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange; or, b) Accompany it with a written offer, valid for at least three years, to give any third party, for a charge no more than your cost of physically performing source distribution, a complete machine-readable copy of the corresponding source code, to be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange; or, ... GPLv3: [1] 6. Conveying Non-Source Forms. You may convey a covered work in object code form under the terms of sections 4 and 5, provided that you also convey the machine-readable Corresponding Source under the terms of this License, in one of these ways: a) Convey the object code in, or embodied in, a physical product (including a physical distribution medium), accompanied by the Corresponding Source fixed on a durable physical medium customarily used for software interchange. b) Convey the object code in, or embodied in, a physical product (including a physical distribution medium), accompanied by a written offer [to convey the source code upon request]... on a durable physical medium customarily used for software interchange, for a price no more than your reasonable cost of physically performing this conveying of source, or (2) access to copy the Corresponding Source from a network server at no charge. ... d) Convey the object code by offering access from a designated place (gratis or for a charge), and offer equivalent access to the Corresponding Source in the same way through the same place at no further charge. ... e) Convey the object code using peer-to-peer transmission, provided you inform other peers where the object code and Corresponding Source of the work are being offered to the general public at no charge under subsection 6d. This unambiguously speaks about the form in which the source code is shared. If the licenses didn't specify this, folks would be compliant with the letter of the license by shipping you a printout of the source code and everything you need to build it and charging you for both the labor to generate that enormous, heavy-ass printout and shipping and handling to get it to you. [2] [0] <https://www.gnu.org/licenses/old-licenses/gpl-2.0.html https://www.gnu.org/licenses/old-licenses/gpl-2.0.html> [1] <https://www.gnu.org/licenses/gpl-3.0.html https://www.gnu.org/licenses/gpl-3.0.html> [2] To downvoters: Don't forget that OCR was decent even back in the 1990s... certainly good enough for a good-quality printout in a fixed-width font to be -strictly speaking- machine-readable, and it has only gotten better as time has wobbled on. If you don't believe my account of the history, go look up how Zimmerman exported copies of PGP back when it was considered an export-controlled munition.
    - grapheneos 28d ago
      We said artificially delaying it for weeks or more is how they're violating it, not using Google Drive. It's also not provided in the preferred form for modification. It isn't in the form expected by the build system and causes it to not function in the way it did for their own builds.
  - aleph_minus_one 28d ago
    > It's paying a bill in pennies. This is actually a problem that is solved in German law: § 3 Münzgesetz (MünzG), Absatz 1 [§ 3 Coins Act, article 1] "§ 3 Annahme- und Umtauschpflicht (1) Niemand ist verpflichtet, deutsche Euro-Gedenkmünzen im Betrag von mehr als 200 Euro bei einer einzelnen Zahlung anzunehmen. Erfolgt eine einzelne Zahlung sowohl in Euro-Münzen als auch in deutschen Euro-Gedenkmünzen, ist niemand verpflichtet, mehr als 50 Münzen anzunehmen; dies gilt auch dann, wenn der Gesamtbetrag 200 Euro unterschreitet." https://www.gesetze-im-internet.de/m_nzg_2002/__3.html https://www.gesetze-im-internet.de/m_nzg_2002/__3.html Translation based on the one created by DeepL: "§ 3 Obligation to Accept and Exchange (1) No one is obliged to accept German commemorative euro coins totalling more than 200 euros in a single payment. If a single payment is made using both euro coins and German commemorative euro coins, no one is obliged to accept more than 50 coins; this also applies if the total amount is less than 200 euros."
    - ajross 28d ago
      To clarify given the subject at hand: German courts are 100% not going to find a Google Drive link to be disallowed by the GPLv2. That's literally about physical coins.
    - g6taa 28d ago
      This is explicitly about commemorative coins, not regular ones.
      - aleph_minus_one 28d ago
        > This is explicitly about commemorative coins, not regular ones. The formulation is not so easy to read (very common for German laws), but it includes also the regulations for normal coins: "Erfolgt eine einzelne Zahlung sowohl in Euro-Münzen als auch in deutschen Euro-Gedenkmünzen, ist niemand verpflichtet, mehr als 50 Münzen anzunehmen; dies gilt auch dann, wenn der Gesamtbetrag 200 Euro unterschreitet." "If a single payment is made using both euro coins and German commemorative euro coins, no one is obliged to accept more than 50 coins; this also applies if the total amount is less than 200 euros." So, there exist two cases in which the vendor is not obliged to take more than 50 coins: - The payment consists of both normal Euro coins and German commemorative euro coins - The payment is less than EUR 200. -- Independently, there does exist another source of law by which the vendor is not obliged to take more than 50 coins: Artikel 11 der EG-Verordnung Nr. 974/98 des Rates über die Einführung des Euro, EU-Amtsblatt L139 vom 11. Mai 1998: > https://eur-lex.europa.eu/legal-content/DE/TXT/PDF/?uri=CELEX:31998R0974 https://eur-lex.europa.eu/legal-content/DE/TXT/PDF/?uri=CELE... (German) > https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:31998R0974 https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELE... (English) "As from 1 January 2002, the participating Member States shall issue coins denominated in euro or in cent and complying with the denominations and technical specifications which the Council may lay down in accordance with the second sentence of Article 105a(2) of the Treaty. Without prejudice to Article 15, these coins shall be the only coins which have the status of legal tender in all these Member States. Except for the issuing authority and for those persons specifically designated by the national legislation of the issuing Member State, no party shall be obliged to accept more than 50 coins in any single payment." Relevant part of this article: "Except for the issuing authority and for those persons specifically designated by the national legislation of the issuing Member State, no party shall be obliged to accept more than 50 coins in any single payment."
- grapheneos 28d ago
  We said artificially delaying it for weeks or more is how they're violating it, not using Google Drive. It's also not provided in the preferred form for modification. It isn't in the form expected by the build system and causes it to not function in the way it did for their own builds.
  - ajross 28d ago
    Well to be fair you didn't say that in the linked tweet. Delay is bad too, but again the original spirit of the license was absolutely OK with the idea of weeks-long delays. Our modern world of instant github access has spoiled us, but courts are not going to see damages from just "we had to ship a month late" unless you can show something more specific.
    - grapheneos 27d ago
      It's required for providing timely security patches. It's not hard to show why that's important and Google engineers have written plenty about it for us to cite. We've managed to avoid delays for security patches so far through reverse engineering and other workarounds. Having to invest time from developers paid to work on GrapheneOS in reverse engineering compiled GPLv2 code shows Google is violating the GPLv2.
      - gsquaredxc 27d ago
        Delay is frustrating, but not a violation. Just because you reverse engineered GPLv2 code doesn’t make that in violation of GPLv2, many people have done that for reasons that rhyme with yours over the decades. GPLv2 also doesn’t have any clause about security patches or if you have a requirement for a certain timeline. GPLv2 isn’t a “you agree to not be an asshole” license.
jsiepkes 28d ago
> Everything else is essentially all the work of Google and (to some extent) Samsung. There is plenty in Android which isn't the work of Google. For starters the Kotlin implementation and the Java implementation (OpenJDK).
jraph 28d ago
Open source doesn't imply open to contributions. And you could imagine source available software that's not open source but takes contributions (and this is not theoretical, I've seen this in the wild). (However, that's quite orthogonal to being a dick about making the source code that you must share available)
- leipert 28d ago
  GitLab is MIT licensed, but also has also parts which are source available but not MIT licensed. Contributions to both are possible.
shevy-java 28d ago
Why would it be a "stretch"? The basic requirement is whether the source code is available - and made available. Are you certain that Google's solution here is ensuring that the source code is easily made available? So many other projects just provide a wget-able link. Why does Google want to make it harder to obtain the source code than those other projects? > Android has always been more source-open than “open source”. And what exactly does that mean? I don't know what your words mean here. More source open than open source? Is that a tautology? > Everything else is essentially all the work of Google and (to some extent) Samsung. Is it GPLv2? If so then I fail to see why anyone should get higher rights. Everyone gets the same for GPLv2. That's the whole point. I don't understand your statements here.
- knollimar 28d ago
  "And what exactly does that mean? I don't know what your words mean here. More source open than open source? Is that a tautology?" I'm sure this means the source happens to be open rather than following the spirit of open source.
- demibabs 28d ago
  > The basic requirement is whether the source code is available - and made available. Are you certain that Google's solution here is ensuring that the source code is easily made available? The word “easily” sure did sneak into this sentence
flotzam 28d ago
GrapheneOS is arguing that throwing away the metadata of however many commits and squashing them into a messy tarball is not the "preferred form of the work for making modifications", and that a manual process where you have to fill out a form in order to get a Google Drive link a week later is not "a medium customarily used for software interchange" in current times. Those are quotes from the GPLv2.
- mjg59 28d ago
  If distributing under 3(b) then it's legitimate to only supply source on request. Historically source has been distributed without revision control history or metadata and been considered acceptable (the source tarballs on gnu.org are snapshots, for instance) so I think the preferred form argument is also tricky. I agree that there's huge value in having the individual commits, but from a GPL perspective we had this argument when Red Hat started flattening all patches in the RHEL kernel source 15 years ago.
  - verdverm 28d ago
    we could argue about license semantics all day, either way Google is not being a good player
    - mjg59 28d ago
      Oh, I agree there.
  - flotzam 28d ago
    I've been wondering about the Red Hat model! Seems like so much of modern development involves git blame or whatever to make sense of how the code came to be, and sometimes rule out an "obvious" modification that actually turns out to be a bad idea now that you know the historical context. GrapheneOS might have a better case though if it's not just about understanding the code but about how the Android build system expects that everything is in Git.
    - 28d ago
phire 28d ago
Google are absolutely within the letter of the GPL, pedantically so. But maybe not the sprit. We didn't have git tags when GPL was written in 1989, and while we did have sccs and rcs, (and early versions of cvs) they just weren't that widely used, and generally not used for distribution. Even when GPL 3.0 was written in 2005-2007, source tarballs were still the primary form of distribution, even though it was starting to become standard to additionally provide anonymous cvs, svn, or one of the brand new distributed systems like git. But these days git is the primary form of distribution, and source tarballs are noting more an afterthought. Hell, even tags are a bit of an afterthought on many projects. It's basically become the norm to expect an healthy revision history for any open source code. Based on it's stated goals of "freedom to modify the software you use", IMO if the GPL was written (or updated) today, it would most likely require the distribution of revision history and restrict how much that history can be squashed/rewritten.
- flotzam 28d ago
  > We didn't have git tags when GPL was written in 1989 The GPLv2 requires "a medium customarily used for software interchange", not "a medium customarily used in 1989 for software interchange". Customs are the customs of the time someone is releasing the work.
  - phire 28d ago
    “a medium customarily used for software interchange“ Interesting choice of cropping for that quote. If you had included the previous word, it would be blindly obvious that “on a medium“ is only talking about the transport layer, not the format of the data. So it would exclude distributing source code on tape, or even optical discs, as nobody uses those anymore. About the only medium used for source code distribution these days is “the internet” You could potentially stretch this to excluding google drive, though google will argue that the medium is http, not google drive; But you can’t stretch this to requiring it be formatted as git. And even if you did manage to successfully argue that, google would just ship it as one (tagged) commit per release. The history would still be missing.
    - 28d ago
kllrnohj 28d ago
> Android has always been more source-open than “open source”. The vast majority of community contributions that make it into the codebase are security fixes and small bug fixes. I believe this isn't actually about "Android" at all but rather Pixel. Android is still openly accessible on git. But the kernel sources for Pixel devices is now behind this big song & dance for some fucking inexcusable reason.
- grapheneos 28d ago
  It's about the Pixel kernel drivers and build system. The source code for the base kernel tree itself is still part of AOSP. Everything related to Pixels is no longer being pushed to AOSP. They stopped pushing tags for any of the Pixel kernel or userspace driver repositories to AOSP. They also stopped pushing AOSP releases specific to Pixels which is why AOSP now only gets yearly releases, QPR2 releases and security backports to both of those. Other OEMs are meant to use the yearly and QPR2 releases along with the security backports to those so that's all they push. The monthly and QPR1/QPR3 releases aren't used by their OEM partners so they stopped pushing them to AOSP. Those no longer being pushed is because of them deciding AOSP doesn't support Pixels anymore.
grapheneos 28d ago
Lack of a specific time limit in GPL doesn't mean there isn't one based on what's reasonable. What they're doing it not reasonable. > Android has always been more source-open than “open source”. This is about Pixels rather than AOSP. Google decided Pixels would no longer be supported by AOSP which is why they stopped pushing the kernel drivers, userspace drivers and other Pixel related code to AOSP. They moved to publishing kernel driver code via Google Drive after filling out a Google Forms submission. They're handling those manually. It's a ridiculous system and comes across as them wanting to make it a hassle on purpose. Perhaps that isn't the case and someone simply needs to make the decision to simply push Git tags somewhere else. They could put it on GitHub if the goal is disassociating it from AOSP. We accepted the archaic new system while they were responding to requests in a reasonable time but that ended. It's now very inconsistent and is regularly getting delayed for weeks or more. > The vast majority of community contributions that make it into the codebase are security fixes and small bug fixes. Open source does not imply anything about accepting contributions. SQLite barely takes any contributions and the same applies to many projects. There were a lot more code contributions to AOSP than you're describing prior to recent changes with Android 16. It was relatively easy to contribute to the lower level parts of it.
D4Ha 28d ago
I see your point, However the majority of Android devices have lots of closed source firmware/drivers, a large part of the Android OS doesn't run without them. I'm refering to Bootloaders, TrustZone OS, Trusted Applications, then firmware for Bluetooth, Wifi, GPU, Sensors and power management. All of those are always closed source binary blobs running in the background.
- codedokode 28d ago
  You should be using open-source firmware without any "untrusted" zones.
  - D4Ha 25d ago
    its not always possible to flash your trust zone firmware, you get what the vendor forces on you.
palata 28d ago
> Android has always been more source-open than “open source”. I hate Google as much as the next person, and the only way with those companies would be to fine them heavily, quickly and systematically. But it is important that we are clear about what Google does bad and what it does well. And I believe that understanding what "open source" means is important when one wants to talk about a violation of an open source licence. Open source does not mean that they take contributions. Many firmwares used by Android are not open source, but AOSP is open source. It is licenced under a permissive licence (Apache 2, I think for everything), which makes it open source, period.
ahoka 28d ago
The intent is obviously to make it hard to get the source code, which violates the license.
maybewhenthesun 28d ago
> Everything else is essentially all the work of Google Well,large parts of the linux kernel are emphatically not the work of google, of course. And I don't doubt there's tons of other software in android that originates outside of google. Which makes it that they are at least violating the spirit of the GPL.

by jmole 29d ago

ajross 29d ago

> “In violation of GPL” is a stretch. The originally envisioned distribution method, in fact, was "Send FSF a blank 9-track tape and they'll fill it and mail it back". Nor, obviously, does anything prevent someone who downloads this from Drive from mirroring it on GitHub or wherever. This is arguably bad stewardship of a historically open source project. It's certainly not a license violation.

Brian_K_White 29d ago
It's paying a bill in pennies.
- ajross 28d ago
  It's not even that. Downstream projects host their own mirrors already, this is an annoying hoop to jump through for the maintainers (basically suck down a bunch of tarballs for every release, analogous to grabbing stuff from FTP sites back in the day), but not exactly a terrible hardship compared to the really very significant work of maintaining a large project.
  - simoncion 28d ago
    There might be some merit to a claim that Google Drive isn't a medium customarily used for software distribution these days, but, yeah, it's definitely not paying a thousand+ cent bill in pennies, and I'm skeptical that it's a violation of the letter of the GPL. It is definitely a dick move by Google.
    - jraph 28d ago
      > There might be some merit to a claim that Google Drive isn't a medium customarily used for software distribution these days I suppose forcing a means to share the source code could have been too restrictive, but the GPL only speaks about the shape of the source code itself (it should be "the preferred form of the work for making modifications to it"), not how it is shared, so indeed, not a violation of the letter of the GPL I think. It's like what we had in France and the Hadopi, which requested ISPs to share the IP addresses of people torrenting a defined set of files. One of them sent them printed on paper... (But the malicious compliance was cool in this case).
      - simoncion 28d ago
        > I suppose forcing a means to share the source code could have been too restrictive, but the GPL only speaks about the shape of the source code itself (it should be "the preferred form of the work for making modifications to it"), not how it is shared... With the greatest of respect, you've forgotten what the licenses say. GPLv2: [0] 3. You may copy and distribute the Program (or a work based on it, under Section 2) in object code or executable form under the terms of Sections 1 and 2 above provided that you also do one of the following: a) Accompany it with the complete corresponding machine-readable source code, which must be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange; or, b) Accompany it with a written offer, valid for at least three years, to give any third party, for a charge no more than your cost of physically performing source distribution, a complete machine-readable copy of the corresponding source code, to be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange; or, ... GPLv3: [1] 6. Conveying Non-Source Forms. You may convey a covered work in object code form under the terms of sections 4 and 5, provided that you also convey the machine-readable Corresponding Source under the terms of this License, in one of these ways: a) Convey the object code in, or embodied in, a physical product (including a physical distribution medium), accompanied by the Corresponding Source fixed on a durable physical medium customarily used for software interchange. b) Convey the object code in, or embodied in, a physical product (including a physical distribution medium), accompanied by a written offer [to convey the source code upon request]... on a durable physical medium customarily used for software interchange, for a price no more than your reasonable cost of physically performing this conveying of source, or (2) access to copy the Corresponding Source from a network server at no charge. ... d) Convey the object code by offering access from a designated place (gratis or for a charge), and offer equivalent access to the Corresponding Source in the same way through the same place at no further charge. ... e) Convey the object code using peer-to-peer transmission, provided you inform other peers where the object code and Corresponding Source of the work are being offered to the general public at no charge under subsection 6d. This unambiguously speaks about the form in which the source code is shared. If the licenses didn't specify this, folks would be compliant with the letter of the license by shipping you a printout of the source code and everything you need to build it and charging you for both the labor to generate that enormous, heavy-ass printout and shipping and handling to get it to you. [2] [0] <https://www.gnu.org/licenses/old-licenses/gpl-2.0.html https://www.gnu.org/licenses/old-licenses/gpl-2.0.html> [1] <https://www.gnu.org/licenses/gpl-3.0.html https://www.gnu.org/licenses/gpl-3.0.html> [2] To downvoters: Don't forget that OCR was decent even back in the 1990s... certainly good enough for a good-quality printout in a fixed-width font to be -strictly speaking- machine-readable, and it has only gotten better as time has wobbled on. If you don't believe my account of the history, go look up how Zimmerman exported copies of PGP back when it was considered an export-controlled munition.
  - grapheneos 28d ago
    We said artificially delaying it for weeks or more is how they're violating it, not using Google Drive. It's also not provided in the preferred form for modification. It isn't in the form expected by the build system and causes it to not function in the way it did for their own builds.
- aleph_minus_one 28d ago
  > It's paying a bill in pennies. This is actually a problem that is solved in German law: § 3 Münzgesetz (MünzG), Absatz 1 [§ 3 Coins Act, article 1] "§ 3 Annahme- und Umtauschpflicht (1) Niemand ist verpflichtet, deutsche Euro-Gedenkmünzen im Betrag von mehr als 200 Euro bei einer einzelnen Zahlung anzunehmen. Erfolgt eine einzelne Zahlung sowohl in Euro-Münzen als auch in deutschen Euro-Gedenkmünzen, ist niemand verpflichtet, mehr als 50 Münzen anzunehmen; dies gilt auch dann, wenn der Gesamtbetrag 200 Euro unterschreitet." https://www.gesetze-im-internet.de/m_nzg_2002/__3.html https://www.gesetze-im-internet.de/m_nzg_2002/__3.html Translation based on the one created by DeepL: "§ 3 Obligation to Accept and Exchange (1) No one is obliged to accept German commemorative euro coins totalling more than 200 euros in a single payment. If a single payment is made using both euro coins and German commemorative euro coins, no one is obliged to accept more than 50 coins; this also applies if the total amount is less than 200 euros."
  - ajross 28d ago
    To clarify given the subject at hand: German courts are 100% not going to find a Google Drive link to be disallowed by the GPLv2. That's literally about physical coins.
  - g6taa 28d ago
    This is explicitly about commemorative coins, not regular ones.
    - aleph_minus_one 28d ago
      > This is explicitly about commemorative coins, not regular ones. The formulation is not so easy to read (very common for German laws), but it includes also the regulations for normal coins: "Erfolgt eine einzelne Zahlung sowohl in Euro-Münzen als auch in deutschen Euro-Gedenkmünzen, ist niemand verpflichtet, mehr als 50 Münzen anzunehmen; dies gilt auch dann, wenn der Gesamtbetrag 200 Euro unterschreitet." "If a single payment is made using both euro coins and German commemorative euro coins, no one is obliged to accept more than 50 coins; this also applies if the total amount is less than 200 euros." So, there exist two cases in which the vendor is not obliged to take more than 50 coins: - The payment consists of both normal Euro coins and German commemorative euro coins - The payment is less than EUR 200. -- Independently, there does exist another source of law by which the vendor is not obliged to take more than 50 coins: Artikel 11 der EG-Verordnung Nr. 974/98 des Rates über die Einführung des Euro, EU-Amtsblatt L139 vom 11. Mai 1998: > https://eur-lex.europa.eu/legal-content/DE/TXT/PDF/?uri=CELEX:31998R0974 https://eur-lex.europa.eu/legal-content/DE/TXT/PDF/?uri=CELE... (German) > https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:31998R0974 https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELE... (English) "As from 1 January 2002, the participating Member States shall issue coins denominated in euro or in cent and complying with the denominations and technical specifications which the Council may lay down in accordance with the second sentence of Article 105a(2) of the Treaty. Without prejudice to Article 15, these coins shall be the only coins which have the status of legal tender in all these Member States. Except for the issuing authority and for those persons specifically designated by the national legislation of the issuing Member State, no party shall be obliged to accept more than 50 coins in any single payment." Relevant part of this article: "Except for the issuing authority and for those persons specifically designated by the national legislation of the issuing Member State, no party shall be obliged to accept more than 50 coins in any single payment."
grapheneos 28d ago
We said artificially delaying it for weeks or more is how they're violating it, not using Google Drive. It's also not provided in the preferred form for modification. It isn't in the form expected by the build system and causes it to not function in the way it did for their own builds.
- ajross 28d ago
  Well to be fair you didn't say that in the linked tweet. Delay is bad too, but again the original spirit of the license was absolutely OK with the idea of weeks-long delays. Our modern world of instant github access has spoiled us, but courts are not going to see damages from just "we had to ship a month late" unless you can show something more specific.
  - grapheneos 27d ago
    It's required for providing timely security patches. It's not hard to show why that's important and Google engineers have written plenty about it for us to cite. We've managed to avoid delays for security patches so far through reverse engineering and other workarounds. Having to invest time from developers paid to work on GrapheneOS in reverse engineering compiled GPLv2 code shows Google is violating the GPLv2.
    - gsquaredxc 27d ago
      Delay is frustrating, but not a violation. Just because you reverse engineered GPLv2 code doesn’t make that in violation of GPLv2, many people have done that for reasons that rhyme with yours over the decades. GPLv2 also doesn’t have any clause about security patches or if you have a requirement for a certain timeline. GPLv2 isn’t a “you agree to not be an asshole” license.

jsiepkes 28d ago

> Everything else is essentially all the work of Google and (to some extent) Samsung. There is plenty in Android which isn't the work of Google. For starters the Kotlin implementation and the Java implementation (OpenJDK).

jraph 28d ago

Open source doesn't imply open to contributions. And you could imagine source available software that's not open source but takes contributions (and this is not theoretical, I've seen this in the wild). (However, that's quite orthogonal to being a dick about making the source code that you must share available)

leipert 28d ago
GitLab is MIT licensed, but also has also parts which are source available but not MIT licensed. Contributions to both are possible.

shevy-java 28d ago

Why would it be a "stretch"? The basic requirement is whether the source code is available - and made available. Are you certain that Google's solution here is ensuring that the source code is easily made available? So many other projects just provide a wget-able link. Why does Google want to make it harder to obtain the source code than those other projects? > Android has always been more source-open than “open source”. And what exactly does that mean? I don't know what your words mean here. More source open than open source? Is that a tautology? > Everything else is essentially all the work of Google and (to some extent) Samsung. Is it GPLv2? If so then I fail to see why anyone should get higher rights. Everyone gets the same for GPLv2. That's the whole point. I don't understand your statements here.

knollimar 28d ago
"And what exactly does that mean? I don't know what your words mean here. More source open than open source? Is that a tautology?" I'm sure this means the source happens to be open rather than following the spirit of open source.
demibabs 28d ago
> The basic requirement is whether the source code is available - and made available. Are you certain that Google's solution here is ensuring that the source code is easily made available? The word “easily” sure did sneak into this sentence

flotzam 28d ago

GrapheneOS is arguing that throwing away the metadata of however many commits and squashing them into a messy tarball is not the "preferred form of the work for making modifications", and that a manual process where you have to fill out a form in order to get a Google Drive link a week later is not "a medium customarily used for software interchange" in current times. Those are quotes from the GPLv2.

mjg59 28d ago
If distributing under 3(b) then it's legitimate to only supply source on request. Historically source has been distributed without revision control history or metadata and been considered acceptable (the source tarballs on gnu.org are snapshots, for instance) so I think the preferred form argument is also tricky. I agree that there's huge value in having the individual commits, but from a GPL perspective we had this argument when Red Hat started flattening all patches in the RHEL kernel source 15 years ago.
- verdverm 28d ago
  we could argue about license semantics all day, either way Google is not being a good player
  - mjg59 28d ago
    Oh, I agree there.
- flotzam 28d ago
  I've been wondering about the Red Hat model! Seems like so much of modern development involves git blame or whatever to make sense of how the code came to be, and sometimes rule out an "obvious" modification that actually turns out to be a bad idea now that you know the historical context. GrapheneOS might have a better case though if it's not just about understanding the code but about how the Android build system expects that everything is in Git.
  - 28d ago

phire 28d ago

Google are absolutely within the letter of the GPL, pedantically so. But maybe not the sprit. We didn't have git tags when GPL was written in 1989, and while we did have sccs and rcs, (and early versions of cvs) they just weren't that widely used, and generally not used for distribution. Even when GPL 3.0 was written in 2005-2007, source tarballs were still the primary form of distribution, even though it was starting to become standard to additionally provide anonymous cvs, svn, or one of the brand new distributed systems like git. But these days git is the primary form of distribution, and source tarballs are noting more an afterthought. Hell, even tags are a bit of an afterthought on many projects. It's basically become the norm to expect an healthy revision history for any open source code. Based on it's stated goals of "freedom to modify the software you use", IMO if the GPL was written (or updated) today, it would most likely require the distribution of revision history and restrict how much that history can be squashed/rewritten.

flotzam 28d ago
> We didn't have git tags when GPL was written in 1989 The GPLv2 requires "a medium customarily used for software interchange", not "a medium customarily used in 1989 for software interchange". Customs are the customs of the time someone is releasing the work.
- phire 28d ago
  “a medium customarily used for software interchange“ Interesting choice of cropping for that quote. If you had included the previous word, it would be blindly obvious that “on a medium“ is only talking about the transport layer, not the format of the data. So it would exclude distributing source code on tape, or even optical discs, as nobody uses those anymore. About the only medium used for source code distribution these days is “the internet” You could potentially stretch this to excluding google drive, though google will argue that the medium is http, not google drive; But you can’t stretch this to requiring it be formatted as git. And even if you did manage to successfully argue that, google would just ship it as one (tagged) commit per release. The history would still be missing.
  - 28d ago

kllrnohj 28d ago

> Android has always been more source-open than “open source”. The vast majority of community contributions that make it into the codebase are security fixes and small bug fixes. I believe this isn't actually about "Android" at all but rather Pixel. Android is still openly accessible on git. But the kernel sources for Pixel devices is now behind this big song & dance for some fucking inexcusable reason.

grapheneos 28d ago
It's about the Pixel kernel drivers and build system. The source code for the base kernel tree itself is still part of AOSP. Everything related to Pixels is no longer being pushed to AOSP. They stopped pushing tags for any of the Pixel kernel or userspace driver repositories to AOSP. They also stopped pushing AOSP releases specific to Pixels which is why AOSP now only gets yearly releases, QPR2 releases and security backports to both of those. Other OEMs are meant to use the yearly and QPR2 releases along with the security backports to those so that's all they push. The monthly and QPR1/QPR3 releases aren't used by their OEM partners so they stopped pushing them to AOSP. Those no longer being pushed is because of them deciding AOSP doesn't support Pixels anymore.

grapheneos 28d ago

Lack of a specific time limit in GPL doesn't mean there isn't one based on what's reasonable. What they're doing it not reasonable. > Android has always been more source-open than “open source”. This is about Pixels rather than AOSP. Google decided Pixels would no longer be supported by AOSP which is why they stopped pushing the kernel drivers, userspace drivers and other Pixel related code to AOSP. They moved to publishing kernel driver code via Google Drive after filling out a Google Forms submission. They're handling those manually. It's a ridiculous system and comes across as them wanting to make it a hassle on purpose. Perhaps that isn't the case and someone simply needs to make the decision to simply push Git tags somewhere else. They could put it on GitHub if the goal is disassociating it from AOSP. We accepted the archaic new system while they were responding to requests in a reasonable time but that ended. It's now very inconsistent and is regularly getting delayed for weeks or more. > The vast majority of community contributions that make it into the codebase are security fixes and small bug fixes. Open source does not imply anything about accepting contributions. SQLite barely takes any contributions and the same applies to many projects. There were a lot more code contributions to AOSP than you're describing prior to recent changes with Android 16. It was relatively easy to contribute to the lower level parts of it.

D4Ha 28d ago

I see your point, However the majority of Android devices have lots of closed source firmware/drivers, a large part of the Android OS doesn't run without them. I'm refering to Bootloaders, TrustZone OS, Trusted Applications, then firmware for Bluetooth, Wifi, GPU, Sensors and power management. All of those are always closed source binary blobs running in the background.

codedokode 28d ago
You should be using open-source firmware without any "untrusted" zones.
- D4Ha 25d ago
  its not always possible to flash your trust zone firmware, you get what the vendor forces on you.

palata 28d ago

> Android has always been more source-open than “open source”. I hate Google as much as the next person, and the only way with those companies would be to fine them heavily, quickly and systematically. But it is important that we are clear about what Google does bad and what it does well. And I believe that understanding what "open source" means is important when one wants to talk about a violation of an open source licence. Open source does not mean that they take contributions. Many firmwares used by Android are not open source, but AOSP is open source. It is licenced under a permissive licence (Apache 2, I think for everything), which makes it open source, period.

ahoka 28d ago

The intent is obviously to make it hard to get the source code, which violates the license.

maybewhenthesun 28d ago

> Everything else is essentially all the work of Google Well,large parts of the linux kernel are emphatically not the work of google, of course. And I don't doubt there's tons of other software in android that originates outside of google. Which makes it that they are at least violating the spirit of the GPL.