Google Shifts Some Android Source From Git Tags to Google Drive Downloads

GrapheneOS reports that Google has stopped publishing certain source code through tagged releases in its git repositories, instead distributing it as files hosted on Google Drive. Git tags anchor a specific release to an immutable commit inside the version-control history, so builders can fetch, diff, and verify exactly what changed between versions. Routing the same code through a Drive download strips away that provenance: the files arrive detached from commit history, without the review trail or straightforward integrity checks that a tagged repository provides.

For projects that build directly from Android’s public source, such as GrapheneOS, the change adds friction and weakens verifiability. Manually posted archives are harder to track across releases, easier to alter or replace unnoticed, and complicate reproducible builds. Beyond the immediate inconvenience, the move fits a broader concern about the transparency of Android’s open-source pipeline — when release artifacts leave a proper VCS for ad hoc file hosting, downstream maintainers and security researchers lose a meaningful layer of supply-chain assurance.