Can't Update GrapheneOS

Joyride

When I go to System > System Updates > Check for Updates I immediately get a notification "Unable to resolve host releases.grapheneos.org": no address associated with hostname. If I try navigating to that in Vanadium it works fine, suggesting it isn't a problem with my VPN (Proton), firewall, network connectivity, etc. I have the phone heavily locked down, and it is likely that if there is an app that I have the ability to deny network access to I did so. I scrolled through the System > Apps list and didn't see anything like "GrapheneOS Updater" but maybe I missed something?

I am unwilling to turn off my VPN, and I don't have the time available to backup and restore everything from a factory reset, so I'm hoping someone can help suggest troubleshooting steps. I saw https://grapheneos.org/usage#updates-sideloading but I'm trying to avoid that as it seems notably more complicated than clicking an update button inside the OS.

Johnnyloans

didn't see anything like "GrapheneOS Updater" but maybe I missed something?

You'd have to tap on the 3 dots at the top right and then show system
It's called 'system updater'

it is likely that if there is an app that I have the ability to deny network access to I did so

Many people have unexpected issues arise from changing system apps. These shouldn't be changed. There is lots of code running that isn't bundled in a nice "app" for you to restrict settings. This code has access to network and you can't stop it. It isn't a secret hack or trick to change system app settings that'll gain you security that security researchers have overlooked

For example, this user's phone calling was broken due to a system app change

https://discuss.grapheneos.org/d/35472-cannot-makereceive-phone-calls-pixel-10-pro/8

Joyride

Johnnyloans You'd have to tap on the 3 dots at the top right and then show system
It's called 'system updater'

Thanks, this fixed it!

As for why I disabled it, I don't want any app periodically phoning home for any reason. Anytime an app makes a network connection I want it to be because I (the user) initiated it intentionally. I recognize that sometimes this breaks features (like updates) but that is an acceptable cost to minimizing metadata leakage problems (which are very often easy for developers to overlook).

I pretty strongly disagree with the user in the linked thread that the user should not be able to disable network access from everything. The threat model of every user is different, and while I agree that for many users disabling network access that is required to make phone calls makes sense, I think there exist a set of users where fine control over what apps send and when is valuable.

Johnnyloans

Joyride

You should probably disable network connectivity checks and keep in mind that wifi calling as well as a few other things bypass a vpn

Joyride

Johnnyloans You should probably disable network connectivity checks and keep in mind that wifi calling as well as a few other things bypass a vpn

Just disabled WiFi connectivity checks (didn't even know the option existed previously) and I never use my mobile device to make phone calls of any kind, though it is worrying that it bypasses the VPN (IMO, nothing should bypass an always-on VPN unless the user explicitly requests it).

If there is a guide that shows all of the things to disable if you want to minimize metadata leakage and phoning home, I would love to read it!