When Android Releases Lose Their Signposts

Android’s public source tree is more than a library of code. It is supposed to function as a historical record: a place where builders, security researchers, and alternative operating systems can connect software running on devices to a specific state of development. When release markers vanish, that record may still exist, but its most useful coordinates disappear. GrapheneOS recently warned in [a public post](https://grapheneos.social/@GrapheneOS/117057099753905023) that Google had stopped publishing Git tags for some Android source repositories. The precise scope and permanence of the change remain unclear, and it may reflect a process transition rather than a deliberate retreat from transparency. Even so, the concern exposes an underappreciated truth: Git tags are part of the trust infrastructure of open-source software. A tag is a claim about what shipped A Git repository contains commits, branches, and a graph of changes. In theory, anyone can inspect that graph and reconstruct a release. In practice, the graph does not explain itself. A release tag supplies a stable name for a particular commit. It says, in effect, “this point corresponds to this published version.” Whe