Two Proton VPN apps

1

I note there are now two Proton VPN apps in the repository: one non-reproducible and the other presumably reproducible, but both having the same version number 5.20.74.0

What is the difference between them, and why does the presumably reproducible version on my phone try to update to the non-reproducible version?

2

one non-reproducible and the other is

BEFORE the reproducible one signed by Proton was added yesterday, the one you have is signed by F-Droid

3

Dumb question, is there any use in keeping both versions as F-Droid aims to encourage reproducible builds?

4

users of non-repro would lose updates… so yes… if you can get them to switch, we can take it down

5

So how can I block the non-repro update, and only allow any reproducible update? Do I even need to?

6

Either you installed the reproducible (ch.protonvpn.android.reproducible) one or the non reproducible (ch.protonvpn.android).

7

Which brings us full circle to my original question. Why does the reproducible app that I installed try to update itself with the non-reproducible one?

8

F-Droid shouldn’t as far as i can tell attempt to update an app with an incompatible signature. It should just focus on the one you do have installed if available. As far as i am aware you this shouldn’t happen. Maybe it would pop up as a warning but you should be able to dismiss it. If all maybe you could hit ignore all updates on the not installed one?

This might be a valid issue to raise. Not sure

Edit: I can’t seem to reproduce this. F-Droid indeed only focuses on one for me and ignores the other.

Edit: 2 (keeping the other one for transparency) i stand corrected actually i see the issue. The issue isn’t that it’s focusing on both which is what i originally misinterpreted what you were asking as. No i see it. It’s detecting the wrong version as the installed version for me. My apologies for misreading yes this is definitely a issue and not expected behavior. So i guess the best way to answer your question is i can’t. I do wonder why it happens though. Maybe something server side? The reason why i suspect this is it doesn’t happen with other apps that have two builds for the same reason as far as i can tell.

9

you have the one signed by F-Droid, that one is named “non-reproducible” as it is not signed by Proton

if you want to use the one signed by Proton, the one that is built and verified reproducible, then, uninstall current and install that one

10

Thanks. I uninstalled the app, then took the easy way out of my dilemma by installing the reproducible version. We’ll see what happens next time either of the two versions tries to update.

11

Clarify. Are there now two slots in the F-Droid repo for ProtonVPN? Has the F-Droid build moved to .reproducible and the standard is a dummy slot that names it with (non-reproducible builds). Or is there two F-Droid builds and one conflicts with standard namespace and adds (non-reproducible builds)? Then (non-reproducible builds) name is only a special case for ProtonVPN?

12

A reproducible application was pushed to F-Droid Data and they changed the previous non-reproducible one’s name to keep both.

13

you’ve read the posts above and that is not clear?

there are no dummy “slots”, what is a slot anyway?

there’s no conflict, each has its own app id

no

14

Not to me it isn’t, not in the slightest. I thought I had grasped the concept of reproducible builds, but evidently I do not because I still don’t understand why there are two similarly named apps in F-droid with identical version numbers (5.20.74.0). If the two apps are truly identical why are there two of them in the repository? Conversely if they differ from each other why do they have identical version numbers?

15

when the app was added, years ago, they could not make it reproducible, so it was signed by F-Droid

in the meantime they rewrote it, and now it’s repro, but Android security does not allow updates between signers

so they added a separate appid version that is signed by them

and old users still get the updates signed by F-Droid

/PS: the apps are identical, use which one you want

16

Thank you for a clearer explanation which I understand now, I hope.

17

They don’t do repros right fully. If you have questions about repros see David A. Wheeler’s Fully countering trusting trust through diverse double compiling thesis, you may also ask me yet this is my source. They have been doing a halfway hack of Wheeler’s D.D.C. which is pretty much meaningless. My email is marqueandreprisal_at_duck.com replace at with @

18

Which slot (app namespace) is signed by f-droid if they are both identical now they are both repro. According to what you have said the only difference is the signing key and by your online documentation the reproducibility does not include the signature which you hack and splice afterwards therefore you are saying these are both repro but with different signatures.

19

@cliffcoggin Agreed. @Licaon_Kter seems to be speaking within the confines of F-Droid however it has been said clearly by the way they have adopted the use of developers signatures they scope beyond the domain of F-Droid. He is neglecting to take into account the somewhat chaotic habit of developers releasing three or more versions of an app using the same namespace F-Droid, GitHub, and Play. Developers will modify an app to comply with Google’s terms and release yet another version and sometimes an open version for F-Droid while having another GitHub release.

20

Afaik, yes, signature aside and appid aside.