> GrapheneOS had to sign some sort of non-disclosure for them, in order to roll them into updates.

So doesn't this mean GrapheneOS is effectively controlled by Google now?

Also, how is keeping anything secret under NDA possible at all if you want to know what's in a security update and be actually able to build that update yourself from source?

Controlled? No. It's about security updates being patched before disclosure.

That said. it is indeed annoying, and there was a lot of uproar when it happened.

For the nuance of it, I'd suggest GrapheneOS docs, you'll get more accurate info.

https://discuss.grapheneos.org/d/27068-grapheneos-security-p...