For the vast majority of people, OSS in 2021 means having a public repo hosted somewhere that all commits are pushed to, or PRs are made to. Periodically updating a public repo with changes made to a private repo is not really what people have in mind.
You can't sue the copyright holder for infringing their own copyright.
That's like requiring a developer to push their local changes hourly/daily for a task that's been committed to but not completed.
When you're using a product for which you can't get the source code, the product is not open source.
Commits: https://github.com/signalapp/Signal-Server/commits/master No push between: April 20, 2020 and April 6, 2021.
You can't say affirmatively that yes they deployed but then say it's an assumption.
Either they did or they didn't.
If they didn't deploy the code to production prior to the commit then I see no problem with what they did.
There's no good option here.
The readme.md on the repo doesn't really clarify one way or another on the matter.
Why?
> I can't say affirmatively that anyone is running anything exactly
Signal provides a means for reproducing Android builds so you can affirmatively determine what you're running.
https://signal.org/blog/reproducible-android/
> but they now claim they did.
Signal claims they shipped server updates without releasing code? Do you have a link to that?
When others were complaining about the lack of an update to server, they're complaining about the client and server APIs being out of sync. Reading through these comments, I don't get the impression that the server code published is what's actually running. In fact the following comment even refers to it as a reference implementation:
https://github.com/signalapp/Signal-Server/commit/3432529f9c...
At the end of the day, it doesn't really matter much what server code is running since the Clients manage encryption and the Server has no insight into the messages being exchanged.