Google replaces Git tags with Google Drive downloads for some source code
Original: Google replaced Git tags for certain source code with obtaining via Google Drive
Why This Matters
The shift away from Git tags raises transparency and supply-chain security concerns for open-source Android ecosystem developers.
GrapheneOS reported via Mastodon that Google has replaced the practice of pushing Git tags for certain source code repositories, instead requiring developers to obtain the source through Google Drive links.
GrapheneOS, the privacy-focused Android-based OS project, posted on Mastodon that Google has changed how it distributes certain source code. Instead of pushing Git tags to public repositories — a standard version-control practice that allows developers to track, verify, and reference specific code versions — Google is now directing users to download the source via Google Drive. GrapheneOS flagged this as a notable and concerning shift, as Git tags provide cryptographic traceability and transparency, while Google Drive links offer no equivalent auditability or integrity guarantees. No official statement from Google explaining the rationale for the change was cited in the post.