Hi wanted to know where does the firmware for GrapheneOS come from and what is the license? How is it updated?

Thank you

It's the stock Google Pixel firmware, ripped straight from Google's system images for each phone. It gets updated as soon as possible with each GrapheneOS system update. Not sure about licensing, but this has been done for ages and Google couldn't complain. They are aware of this, and have been for long.

The firmware has to come from the device OEM since no community effort may possibly culminate in usable device firmware (there are no phones with open source, community-made firmware), and they are the only trustworthy source since they pretty much made it themselves and have their own security to take care of.