Also, I note that they can set access levels based on email addresses, but I am unsure how that would work? Would those emails have to be linked to a Google account so that Upspin could check the currently logged in Google account to allow/disallow access to the files?
The email addresses are Upspin user names whose public keys are registered with a central server, key.upspin.io. To act as an Upspin client, you need to sign up: https://upspin.io/doc/signup.md
Requests made by Upspin users are signed with those public keys. Servers validate those users by validating the signatures against the key published by key.upspin.io.
There is an "all" permission that shares with the world (see https://upspin.io/doc/access_control.md) but in most cases we expect people will share with a specific set of named users.
It sounds like the project code is all publisgedcthough, so it should be possible to operate a private or alternative upspin network.
Edit: looking at the LICENSE file, scratch that, it appears Google doesn't even own the copyright.
In order to contribute you have to sign the standard Google Contributor License Agreement (either [0] or the corporate version) which gives Google a perpetual irrevocable copyright and patent license. Since the project is BSD licensed anyway, unless you're contributing something you intend to patent, you're giving Google nothing by signing the CLA: you still own the actual copyright. (Based on my skimming the agreement; IANAL)
[0] https://cla.developers.google.com/about/google-individual [1] https://github.com/upspin/upspin/blob/master/AUTHORS
> Does it mean that people don't work on it full-time and it's a 20% project?
That there are a few of us paid full-time to work on this, plus some 20% contributors.
> Does it mean that it was developed at home without using Google's resources, so they don't have an ownership interest in it, but they are letting it be hosted on their infrastructure and announced on their blog to be nice?
No, this was developed by Google employees on Google's time.
> Does it mean that Google isn't sure how long it will want to continue to contribute resources?
I'm not sure what "Google" thinks about this, but I do know that the foreseeable future this is what I and my other teammates will be working on.
> Does it mean that support is only available on an ad-hoc basis (isn't that the case with all free Google products)?
There is definitely no support for Upspin beyond us and the community helping people on the mailing list.
> Does it mean that serious customers shouldn't rely on it to work reliably?
As is stated in the README, Upspin is still very rough. It's early days.
> Does it not really mean anything, and just thrown on there for legal protection (against what?)?
I'm not sure what "unofficial" means in this case but I hope I have answered your questions sufficiently.
Okay, so since i wrote this disclaimer, and the policy that requires it, let me try to explain this simply.
Historically, people were discovering projects were made by googlers, etc, and thinking this somehow meant it was an official google thing that google was supporting (though, admittedly, i have no better idea of what that really means at heart than anyone else). You'd even see tons of press stories about how Google had done x, y, or z, and worse, people would take it as a sign of strategy or best practices or whatever. IE "Google released j2objc, and thus thinks you shuold write your ios apps in java". But Google hadn't done anything. A bunch of people who worked there had done something, and someone discovered they were googlers (usually. There were a number of cases of people trying to associate their project with google in order to try to gain publicity, etc, but this was significantly more rare)
So I got asked to go solve this problem, and tried to do so in the lowest effort (for everyone involved) and simplest way:
Anything that was not an official google product, was marked as such. Now press, etc, can't claim they thought it was official anything :) People look at it get the right impression, even if they don't know precisely what it means. It raises a few questions sometimes (what does it mean to be official), but for over 5000 projects, i think the number of questions of people trying to understand what i means is "small".
In that regard, i believe doing this was a resounding success. [1]
This was simple back in the day. These days, there are projects, like upspin, that seem to be like they are are somewhere in the middle (honestly, i haven't looked at all to determine it).
So maybe i'll reevaluate.
[1] Almost as successful as me marking Chromium "copyright the chromium authors" (now copied everywhere), with nobody really understanding why that was done.