OS updates and VPN

evalda

I am wondering how GrapheneOS checks for updates and downloads updates in regards to VPN(s) configured on the phone? Which of the following statements is true?

Updates are checked and downloaded over the VPN configured in the Owner profile
Over the VPN configured in the currently active user profile
Updates bypass the VPN

rustybird

evalda Which of the following statements is true?

This one:

evalda [OS] Updates are checked and downloaded over the VPN configured in the Owner profile

evalda

rustybird Thank you. How do you know that? Are you a GOS dev or tested this on a router?

rustybird

evalda I'm just a peasant looking at router logs. Tried out various combinations of user profiles and VPN settings a couple of months ago.

rustybird

IMO the main gotcha with VPNs on Android is carrier IP traffic: https://discuss.grapheneos.org/d/3158-wifi-calling-bypasses-vpn/7

Everything else feels reasonable to me (OS updater running in the Owner profile, Apps client running independently per profile)