Upspin is one of Google's many Open Source projects. It's not really skunkworks, per se, just something that we wanted to work on and were lucky enough to be supported by Google in doing so.

The email addresses are Upspin user names whose public keys are registered with a central server, key.upspin.io. To act as an Upspin client, you need to sign up: https://upspin.io/doc/signup.md

Requests made by Upspin users are signed with those public keys. Servers validate those users by validating the signatures against the key published by key.upspin.io.

Gotcha, thanks for the extra info. So you still have to sign up with the Upspin service to be able to consume shared files? I was under the impression from the post that it was an 'account free' type of service, in as much as you can publish a URL where people can grab files, but still provided a level of access control, and I was having a hard time reconciling that in my head.

You need to register your public key with key.upspin.io in order to speak to any Upspin servers, so in that sense it is not "account free". You need to prove to others that you are who you say you are.

There is an "all" permission that shares with the world (see https://upspin.io/doc/access_control.md) but in most cases we expect people will share with a specific set of named users.

Will Upspin key servers be operated by a non-Google entity so as to allow the global filesystem to continue to function after Google decides to no longer support the project?

What happens when that non-Google entity decides to no longer support the project? Now you're dependent on two organisations continuing support instead of just one.

It sounds like the project code is all publisgedcthough, so it should be possible to operate a private or alternative upspin network.

This doesn't really clarify what an "unofficial" Google project is. Does it mean that people don't work on it full-time and it's a 20% project? Does it mean that it was developed at home without using Google's resources, so they don't have an ownership interest in it, but they are letting it be hosted on their infrastructure and announced on their blog to be nice? Does it mean that Google isn't sure how long it will want to continue to contribute resources? Does it mean that support is only available on an ad-hoc basis (isn't that the case with all free Google products)? Does it mean that serious customers shouldn't rely on it to work reliably? Does it not really mean anything, and just thrown on there for legal protection (against what?)?

I didn't write the "unofficial" part, but I can answer the questions:

> Does it mean that people don't work on it full-time and it's a 20% project?

That there are a few of us paid full-time to work on this, plus some 20% contributors.

> Does it mean that it was developed at home without using Google's resources, so they don't have an ownership interest in it, but they are letting it be hosted on their infrastructure and announced on their blog to be nice?

No, this was developed by Google employees on Google's time.

> Does it mean that Google isn't sure how long it will want to continue to contribute resources?

I'm not sure what "Google" thinks about this, but I do know that the foreseeable future this is what I and my other teammates will be working on.

> Does it mean that support is only available on an ad-hoc basis (isn't that the case with all free Google products)?

There is definitely no support for Upspin beyond us and the community helping people on the mailing list.

> Does it mean that serious customers shouldn't rely on it to work reliably?

As is stated in the README, Upspin is still very rough. It's early days.

> Does it not really mean anything, and just thrown on there for legal protection (against what?)?

I'm not sure what "unofficial" means in this case but I hope I have answered your questions sufficiently.

"This doesn't really clarify what an "unofficial" Google project is."

Okay, so since i wrote this disclaimer, and the policy that requires it, let me try to explain this simply.

Historically, people were discovering projects were made by googlers, etc, and thinking this somehow meant it was an official google thing that google was supporting (though, admittedly, i have no better idea of what that really means at heart than anyone else). You'd even see tons of press stories about how Google had done x, y, or z, and worse, people would take it as a sign of strategy or best practices or whatever. IE "Google released j2objc, and thus thinks you shuold write your ios apps in java". But Google hadn't done anything. A bunch of people who worked there had done something, and someone discovered they were googlers (usually. There were a number of cases of people trying to associate their project with google in order to try to gain publicity, etc, but this was significantly more rare)

So I got asked to go solve this problem, and tried to do so in the lowest effort (for everyone involved) and simplest way:

Anything that was not an official google product, was marked as such. Now press, etc, can't claim they thought it was official anything :) People look at it get the right impression, even if they don't know precisely what it means. It raises a few questions sometimes (what does it mean to be official), but for over 5000 projects, i think the number of questions of people trying to understand what i means is "small".

In that regard, i believe doing this was a resounding success. [1]

This was simple back in the day. These days, there are projects, like upspin, that seem to be like they are are somewhere in the middle (honestly, i haven't looked at all to determine it).

So maybe i'll reevaluate.

[1] Almost as successful as me marking Chromium "copyright the chromium authors" (now copied everywhere), with nobody really understanding why that was done.

Looks like it's an open source project by individuals who also happen to be employed by Google, and the extent of Google's involvement is the copyright.

Edit: looking at the LICENSE file, scratch that, it appears Google doesn't even own the copyright.

Not really. Google owns the copyright for all code contributed by Google employees on Google time, and currently they are the only copyright holder [1].

In order to contribute you have to sign the standard Google Contributor License Agreement (either [0] or the corporate version) which gives Google a perpetual irrevocable copyright and patent license. Since the project is BSD licensed anyway, unless you're contributing something you intend to patent, you're giving Google nothing by signing the CLA: you still own the actual copyright. (Based on my skimming the agreement; IANAL)

[0] https://cla.developers.google.com/about/google-individual [1] https://github.com/upspin/upspin/blob/master/AUTHORS

Is there a list anywhere of these unofficial Google Open Source projects?

Kudos to you for asking this question. I was under the same impression that it was an official Google product but the repos didn't show any sign of this.