I'm fairly new to Android and I'm flashing a custom ROM so I want to install Open GApps. The project looks great, but where do they obtain the source code? I thought GApps were closed source owned by Google. Is it legal to distribute this code?
Also, is it safe? Theoretically, Mallory could contribute some code to the project which eavesdrops communication in Bob's Gmail app, right?