I've been trying to wrap my head around the android app installation process for a while now.
This is what i think i know about the process of installing apps in android.
What do you think, did i get it right?
Did i miss something?
Insert your thoughts please.
On install of a new app android trusts it and its public key without question as long as there isn't another app with the same package name ex.
"id=org.thoughtcrime.securesms"
When upgrading an app with the same package name ex. "id=org.thoughtcrime.securesms" android checks the public key of the apk and as long as it matches the previously known and trusted key android permits the upgrade.
Caveats
The package name is not the same as the app nicknames as seen in the app drawer.
examples
"id=org.thoughtcrime.securesms" is currently known as signal in the app drawer.
"id=im.vector.app" is currently known as Element
Nicknames are not unique, multiple apps can have the same nickname and icon.
Example
app.grapheneos.camera is nicknamed "Camera" in the app drawer just as well as com.google.android.GoogleCamera also has the same nickname "Camera".
In short, apps can impostor other apps without invoking any sort of error from the android system as long as the they use a different package name compared to the original app.