@fireborn @mpldr Allowing a user to install third party apps from another source is substantially legally different to bundling/aggregation/distribution of a mix of licenses.

I'm amending this post with saying that I'd hope they could find a work-around - merely pointing out that the example cited doesn't imply they're being malicious, because they're not the same thing.

@larsmb @mpldr But what I’m saying is, could they not post it on the third-party source, and then, at install time, prompt the user to check a box if they are okay with, require, or otherwise want to install the specific component from the specific third-party source? Like certain Linux distributions do with non-free applications and firmware. See debian/ubuntu/mint installers. I'd say just "not caring" as they are doing currently, is malicious. Everything they've said at the moment is passing the torch onto someone else. Someone needs to make an engine. Someone needs to update a component. Someone needs to configure it. They are accepting absolutely none of the responsibilities themselves.

@j_j @larsmb @mpldr I fully understand they want purity. That's fine. If they want that, then they need to propose the solution.

@fireborn @j_j @larsmb @mpldr Purity is not the issue, see https://grapheneos.org/faq.

They are inherently pro DRM (that is what "immutable root of trust" means), and GPLv3 is anti DRM (see section 3).

@divVerent @j_j @larsmb @mpldr Which is fine, they can be whatever they want to be. It goes back to my point in my post, you either trust your users to make decisions about what software they want to run on their device, or you don’t.

@fireborn
No, that is not fine, that is exactly the point.
They do not trust their users. They hate user freedom. They want to provide their software for Anti-User DRM, they even try to get their OS signature key included by Google so their OS would work with play integrity and other DRM services.
Anyone else modifying and compiling Open Source GrapheneOS would then not be able to use it in the same way.
That is what GPLv3 forbids, @divVerent @j_j @larsmb @mpldr

@thomas @fireborn @divVerent @j_j @larsmb @mpldr it seems to me that GOS could choose between GPLv3 and accessible by default, or a less free license that makes them more compatible with Google play integrity -- and they are siding with Google. Is that an accurate read?

@semitones @thomas @fireborn @divVerent @j_j @larsmb @mpldr No, that's completely false. It has nothing to do with Play Integrity API or Google. GPLv3 is overly restrictive and would reduce the sustainability of GrapheneOS and partnerships available to us by making it into a more niche project more companies would want to avoid. eSpeak NG is not the best open source text-to-speech implementation and most of them are permissively licensed. It is ONE of the reasons eSpeak NG is not bundled.

@GrapheneOS @semitones @thomas @fireborn @j_j @larsmb @mpldr Do those partnerships preclude offering a second system image with GPL3 components?

Or is it merely practical / product direction reasons?

@divVerent @fireborn @larsmb @semitones @thomas @mpldr @j_j Multiple companies have made it clear that having any GPLv3 code would be a significant barrier to working with them. Their legal departments do not want to have even the possibility of it being included. They want a policy against using it as AOSP has. That's why AOSP has that policy. Google doesn't have that policy themselves elsewhere. They use GPLv3 code in ChromeOS. It's not in AOSP because of what other companies want.

@GrapheneOS @fireborn @larsmb @semitones @thomas @mpldr @j_j Then maybe GrapheneOS has to remain disabled hostile because these companies are, and the solution could be a community spinoff based on GrapheneOS source releases.

Kinda sad though.

@divVerent @fireborn @larsmb @semitones @thomas @mpldr @j_j GrapheneOS is not disabled hostile. A post pushing a bunch of fabrications and spin about us doesn't make that the case. It will certainly result in a worse experience for disabled people going forward due to discouraging contributions in these areas, demotivating our development team and piling on further harm to the project from attacks on it which take away the resources and support we need to even continue without adding more.

@divVerent @larsmb @GrapheneOS @semitones @thomas @mpldr @j_j I'm not sure what companies they are working with, but the companies might not be disabled-hostile, just gplv3 hostile. I'm currently discussing with one of the maintainers in another thread about what's going on, and what could be improved.

@divVerent @fireborn @larsmb @semitones @thomas @mpldr @j_j Do you think what you're doing accelerates our existing work on it? Do you think it's going to motivate our developers and make things happen faster? If you believe any of that, you couldn't be more wrong. This has massively demotivated the team and harm the project in ways that are going to make progress on this slower. You think driving away help from the project is going to speed it up? It's an open source project. You could help.

@GrapheneOS @divVerent @larsmb @semitones @thomas @mpldr @j_j See this thread. https://infosec.exchange/@matchboxbananasynergy/114570624717710963. In short, I was deeply frustrated at the general FOSS messaging seeming to be applied in the posts that I quoted, which reads generally like "we gave you half the car. Go build the rest of it." I've been dealing with this for years, in almost every project I actively use. Starting a conversation with this wasn't productive.

@fireborn @divVerent @larsmb @semitones @thomas @mpldr @j_j GrapheneOS didn't have network location, something many people consider a basic feature, from 2014 through 2024 until near the end of the year. There are many things we need to implement ourselves. Most third party implementations of features usually don't meet our requirements and we either need to make our own or heavily fork them.

Open source TalkBack is in a bad state from Google and we have to deal with that ourselves.