Two Proton VPN apps

1

I note there are now two Proton VPN apps in the repository: one non-reproducible and the other presumably reproducible, but both having the same version number 5.20.74.0

What is the difference between them, and why does the presumably reproducible version on my phone try to update to the non-reproducible version?

2

one non-reproducible and the other is

BEFORE the reproducible one signed by Proton was added yesterday, the one you have is signed by F-Droid

3

Dumb question, is there any use in keeping both versions as F-Droid aims to encourage reproducible builds?

4

users of non-repro would lose updates… so yes… if you can get them to switch, we can take it down

5

So how can I block the non-repro update, and only allow any reproducible update? Do I even need to?

6

Either you installed the reproducible (ch.protonvpn.android.reproducible) one or the non reproducible (ch.protonvpn.android).

7

Which brings us full circle to my original question. Why does the reproducible app that I installed try to update itself with the non-reproducible one?

8

F-Droid shouldn’t as far as i can tell attempt to update an app with an incompatible signature. It should just focus on the one you do have installed if available. As far as i am aware you this shouldn’t happen. Maybe it would pop up as a warning but you should be able to dismiss it. If all maybe you could hit ignore all updates on the not installed one?

This might be a valid issue to raise. Not sure

Edit: I can’t seem to reproduce this. F-Droid indeed only focuses on one for me and ignores the other.

Edit: 2 (keeping the other one for transparency) i stand corrected actually i see the issue. The issue isn’t that it’s focusing on both which is what i originally misinterpreted what you were asking as. No i see it. It’s detecting the wrong version as the installed version for me. My apologies for misreading yes this is definitely a issue and not expected behavior. So i guess the best way to answer your question is i can’t. I do wonder why it happens though. Maybe something server side? The reason why i suspect this is it doesn’t happen with other apps that have two builds for the same reason as far as i can tell.

9

you have the one signed by F-Droid, that one is named “non-reproducible” as it is not signed by Proton

if you want to use the one signed by Proton, the one that is built and verified reproducible, then, uninstall current and install that one

10

Thanks. I uninstalled the app, then took the easy way out of my dilemma by installing the reproducible version. We’ll see what happens next time either of the two versions tries to update.