Maybe a naiive question, but couldn't you request the source code from phone companies? Say you request it from Xiaomi - sure they're not the original writers of the code, but they too "distributing GPL code" and therefore must release the code on request. They may be more amenable to your request since they have leverage with Google and are in an adversarial relationship
reply“Couldn’t you just” couldn’t fucking GOOGLE, the don’t do evil corporation, support one of the few alternative mobile phone OSs use standard development tools, instead of being little shits?
replyYou can request anything from anyone, but compelling a company to follow their GPL obligations requires cooperation from the copyright holders + infinite funds for legal fees
replyDoesn't their change break supply chain security on Google's end?
replyWith git tags, presumably people spoke in terms of cryptographic hashes. Now what prevents them from serving different Google drive contents to different accounts?
deleted
replyIt doesn't break supply chain security for anybody with power to change the situation.
replyIt is an easy to overlook this, but even for someone in position of power to change, creating different code with the same hash is borderline impossible.
replyNon-sequitor? They're not providing a (sha-1) hash, they're providing source code to integration partners using their business channels, not public git providers. Those business channels include contracts etc to "secure their supply chain".
replyYou and I aren't in those business channels, and we're not being given anything with a hash. There's simply no hash to collide with?
A git hash is cryptographically secure. It doesn't matter how you distribute it. That is the entire point you're missing.
reply[flagged]
replyThere is a giant list of reasons here https://grapheneos.org/faq#future-devices
replyAnswered long ago: https://grapheneos.org/faq#future-devices
replydeleted
reply