APK installation conflict between Owner and Private Space

ErnestThornhill

There can still be a conflict even if it's installed in another profile.

https://discuss.grapheneos.org/d/16670-private-space-on-android-15-grapheneos/21

de0u

boarim From what I understand, it looks like AntennaPod is conflicting with the one in the Owner profile. How is this possible?

Each device has only one version of an APK, as identified by the app-name string (often com.xxx.yyy). It is possible to build two versions of an app with different app-name strings, in which case those can be installed on a device side by side. But the package manager won't allow two versions of the same app in two different user profiles, and Private Space is a kind of user profile.

ErnestThornhill

de0u Yeah. Apps from F-Droid are notorious for this sort of issue.

boarim

de0u Thank you for the explanation. I have to find another podcast app to install in this private space then!

de0u

boarim I have to find another podcast app to install in this private space then!

There is a theory according to which the developer should use different app names when different builds with different signatures are used. You might try raising the issue with the developer.

ErnestThornhill

boarim Not really. Replace the one you downloaded from F-Droid and download it from somewhere else like APKMirror. That's where I get my apps from when they aren't available on GitHub and/or the developer's website. I've had zero issues.

boarim

ErnestThornhill I’m not really fond of this. The devs of the app explicitly wrote that it’s only available through the GStore and F-droid and that any other place in the wild should be avoided, security-wise.

DeletedUser87

ErnestThornhill going to APKMirror instead of using Aurora Store is wild to me.

Tl4W4rEtsV7HsB81Or8U

boarim Use apkextractor and save the already installed apk in the private space. Regardless, it doesn't matter where you source the apk because the signature has to match what's already installed, non genuine apks won't be installable.

ErnestThornhill

boarim and that any other place in the wild should be avoided, security-wise.

Proof?

ErnestThornhill

DeletedUser87 They can use Aurora Store. I was simply using APKMirror as an example.

boarim

ErnestThornhill After reading again their download page, I realized what I wrote is not accurate. Nevertheless, it implies that anything outside the two stores are not their responsibility, and should be treated with caution.

boarim

Considering all of this, I have a question: if I install the same app (that is already installed in Owner with GStore for instance) in the private space with Obtainium, I don't need to verify the hash of the APK signature, right? If they mismatch, I won't be able to install it in the Private Space anyway if I understood correctly.