Google's new Pixel kernel source process sparks GPL violation claims

Google has replaced the automatic distribution of Pixel kernel source code with a manual request system, creating a significant bottleneck for the Android developer community. The company now requires developers to submit a Google Form and wait for a Google Drive link to receive code that was previously available instantly via Git tags.

According to reports from Android Authority, this transition has drastically increased delivery times. While the previous system allowed for turnarounds of a few hours, some developers now report waiting several weeks to receive the necessary source files. Beyond the delivery delay, Google is reportedly squashing update history into single files, effectively removing the granular, step-by-step commit history that developers previously relied upon to track changes.

The end of the Pixel reference era

For years, Pixel hardware served as the primary reference platform for the Android Open Source Project (AOSP). This status made the devices highly attractive to security researchers and custom ROM developers, as Google provided the GPL-mandated kernel source alongside full device trees and driver binaries. This openness enabled projects like GrapheneOS to rapidly port security patches and new Android versions to Pixel hardware.

However, this relationship is shifting. With the arrival of Android 16, Google has moved the AOSP reference target away from physical Pixel devices to a virtual device known as "Cuttlefish." This move signals a broader strategic pivot away from treating consumer hardware as the primary open-source blueprint.

Implications for security and transparency

The new distribution hurdles create a critical risk for the ecosystem. Because custom operating systems cannot function without the low-level kernel, multi-week delays in receiving code directly halt the release of essential security patches and OS updates for non-standard builds.

Furthermore, the loss of commit history reduces transparency. Without a detailed log of changes, independent researchers find it significantly harder to audit Google's modifications or trace the origin of specific bug fixes. This lack of visibility undermines the ability of the community to verify the security integrity of the Pixel ecosystem.

Legal friction and what's next

The shift has already triggered legal concerns. GrapheneOS has claimed that Google's new distribution method constitutes a violation of the GNU General Public License version 2 (GPLv2), which governs the Linux kernel. The license generally requires that source code be made available in a manner that allows users to actually use and modify it.

As the community pushes back, the industry will be watching to see if Google restores the automated Git tags or if the manual request system becomes the permanent standard for Pixel hardware. For now, the transition to Cuttlefish suggests that the era of the Pixel as the gold standard for open-source Android development may be coming to an end.