Google replaced Git tags for certain source code with obtaining via Google Drive

In the grand, cosmic ballet of the tech universe, we've just witnessed a move that would make even the most jaded systems administrator spit out their cold brew. Google, the company that literally wrote the book on scalable infrastructure, has reportedly decided that Git tags—those beautiful, cryptographic chains of custody that tell us exactly who changed what and when—are somehow less trustworthy than a file icon that might as well have a "Click here for virus" label on it. The implications here are staggering. We've built our entire digital civilization on the bedrock of reproducible builds and verifiable hashes, and now we're supposed to be okay with "trust me bro, I shared it from my personal Drive folder"? This is the kind of story that makes you want to check your own supply chain for spiders. When GrapheneOS, the privacy-focused Android offshoot, flags this, you know it's not just a minor inconvenience—it's a fundamental breakdown in the social contract of open source. Git tags are the digital equivalent of a notary public's stamp, a cryptographic handshake that says, "Yes, this is the real deal, and here's the entire history to prove it." Replacing that with a Drive link is like replacing the Library of Congress's cataloging system with a game of telephone played by drunk archivists. The whole point of version control is that you can trace every single change back to its source, and now Google is saying, "Nah, let's just wing it." But let's step back and look at the bigger picture, because this is Weird & Wild, and we're not here to just complain about corporate missteps. This is a perfect microcosm of the fundamental tension in our digital age: the battle between convenience and verifiability. Google's move, if true, suggests a corporate mindset that prioritizes internal workflow over the community's need for transparency. It's the same impulse that makes a website use a "Download our app" popup while you're already on the mobile site—a fundamental disconnect between what the user needs and what the corporation wants to provide. The fact that this involves the Android Open Source Project (or whatever specific codebase is in question) makes it even more egregious, because this is the code that runs on billions of devices. And yet, we must pause and consider the possibility that this is all a misunderstanding, a mischaracterization of a niche internal process. But the very fact that this report feels plausible is a testament to how far we've strayed from the ideal of peer-to-peer trust. In a universe where we're increasingly reliant on software for everything from our heart monitors to our nuclear launch codes, the idea that a critical piece of the puzzle is being handed over via a consumer file-sharing service is the kind of absurdist humor that would make Douglas Adams do a double-take. So we ask the question: if the robots are going to take over, can they at least do it with a proper checksum and a signed commit? Is that too much to ask? Apparently, yes. Source: https://grapheneos.social/@Gplos/117057099753905023