GrapheneOS / os-issue-tracker

Issue tracker for GrapheneOS Android Open Source Project hardening work. Standalone projects like Auditor, AttestationServer and hardened_malloc have their own dedicated trackers.
https://grapheneos.org/
348 stars 19 forks source link

App updates via APK displaying unexpected package name after update completion #2674

Closed antarctic3431 closed 8 months ago

antarctic3431 commented 10 months ago

I previously opened issue #2672, now closed, which pertained to receiving an unexpected message after updating the Proton VPN android application via APK. I was likely too quick to open an issue and should have directed that initial matter to Proton, and apologise for opening an unnecessary issue report.

This issue, though related, does not pertain to a specific app or APK installation/update. I've checked other issue reports, and don't believe this was previously brought up.

Beginning somewhat recently, updating an app via APK (launched from Files - com.android.documentsui) is displaying an unexpected message at the conclusion of the app update process. I have experimented with 5 different app APKs across two separate Pixel 7's running 2023110700 stable release, and results were identical.

Updating the following apps via APK returns the following unexpected messages on conclusion of app update (all were downloaded from their respective official sources of https://proton.me and https://signal.org/android/apk/):

In all cases, in these messages, the app icon does not reflect the actual app, and is instead a generic Android system icon. Furthermore, in the list of apps, accessed via Settings > Apps, no package by any of the above names exist; for example, Signal displays correctly as org.thoughtcrime.securesms.

In all cases, if any of these apps are uninstalled, and subsequently reinstalled fresh from the same APK file, these unexpected package names do not display. On successful clean installation of each app, the Android system message "App installed" is displayed, along with the correct app icon and app name (e.g. Signal, and not org.thoughtcrime.securesms.ApplicationContext).

thestinger commented 10 months ago

As stated in that issue, you have some software installed showing this message.

thestinger commented 10 months ago

This message you're talking about is not part of AOSP or GrapheneOS. Please ask for support on the discussion forum or Matrix chat and provide a screen recording or screenshot. You need to go through the software you have installed in the profile and determine what's showing this.

akc3n commented 10 months ago

@antarctic3431 re: https://github.com/GrapheneOS/os-issue-tracker/issues/2672 I provided an answer for you yesterday already on the GrapheneOS discussion forum here.

antarctic3431 commented 10 months ago

Apologies, I was in the process of gathering screenshots prior to your recent responses. I believe I may have done a poor job at explaining previously, sorry. Per these screenshots, the prompts are coming from the system when launching an APK via the Files app (com.android.documentsui). The package name, on conclusion of update, does not match the package name of what was ultimately installed however.

Screenshot 1 Screenshot 1: Opening the Proton VPN APK in Files to update the app. Icon and App Name are correct.

Screenshot 2 Screenshot 2: Update completed, but the Icon and Package Name are different from what was shown initially.

DLL125 commented 9 months ago

I can confirm this running latest GrapheneOS (stable) Device: Pixel 8 pro

Maybe it has something to do with permissions?

antarctic3431 commented 9 months ago

I contacted Proton about this issue, and sent them the same screenshots. They were able to confirm the following:

They inquired if this behavior had been occurring with other app APKs that weren't Proton, and since Signal is also showing a different package name at the App Installed stage in a similar manner to the screenshots above:

Upon inquiring about this with our developers, it appears that the behavior at hand is indeed related to the recent GrapheneOS update since it's happening with other applications as well. We haven't made any changes recently when it comes to the naming of our applications.

akc3n commented 9 months ago

@antarctic3431 Thanks for looking into this with Proton and getting back to us with this information.

octocorvus commented 9 months ago

The same issue exists on stock OS, unsure if it is due to some change in Android 14.

OfficialMuffin commented 9 months ago

I have the same issue with Forkgram Messenger from the F-Droid store. It displays itself as a generic android app and its name is: org.telegram.Messenger.ApplicationLoaderImpl

antarctic3431 commented 9 months ago

I had another look at several separate app installations / updates, and seem to have found a recurrence. The different package name displayed at the App Installed stage when updating via APK corresponds to the class of each app in their respective source code. I've included several examples, hope this assists:

Signal

Installed as org.thoughtcrime.securesms -- Displays on app update org.thoughtcrime.securesms.ApplicationContext signal https://github.com/signalapp/Signal-Android/blob/19e726a630c1f0aa681cd4e771f01ce5bb0b4148/app/src/main/java/org/thoughtcrime/securesms/ApplicationContext.java#L124

Proton Mail

Installed as ch.protonmail.android -- Displays on app update ch.protonmail.android.core.ProtonMailApplication protonmail https://github.com/ProtonMail/proton-mail-android/blob/215edbf4f9a80efc2f683005a4df36f511d272a9/app/src/main/java/ch/protonmail/android/core/ProtonMailApplication.java#L119-L120

Proton VPN

Installed as ch.protonvpn.android -- Displays on app update com.protonvpn.android.ProtonApplicationHilt protonvpn https://github.com/ProtonVPN/android-app/blob/383af2221203f5cabe457f6030da6d5b155ae676/app/src/main/java/com/protonvpn/android/ProtonApplicationHilt.kt#L37-L38

Proton Drive

Installed as me.proton.android.drive -- Displays on app update me.proton.android.drive.App protondrive https://github.com/ProtonDriveApps/android-drive/blob/cfbfde14d2b76d540e4192bbbb0bc7ed139bef57/app/src/main/kotlin/me/proton/android/drive/App.kt#L25-L26

antarctic3431 commented 8 months ago

Since receiving the 2023120700 release last week, which incorporated the QPR1 quarterly release of Android 14, this issue appears to have been corrected upstream. The class is no longer displayed at the App Installed stage; correct app names and icons display as expected.