4 ms·

VideoLAN unable to update VLC on Android

MaximilianEmel 3y ago
The Tweet: > If you wonder why we can’t update the VLC on Android version, it’s because Google refuses to let us update: > - either we give them our private signing keys, > - or we drop support for Android TV before API-30, and all our users on TV API<30 can’t get fixes.
- _ea1k 3y ago
  I don't understand why that is an "or"? How does dropping support for older Android TV versions fix the problem for updating on regular Android?
  - SAI_Peregrinus 3y ago
    Google doesn't allow apps on the Play Store that support deprecated API versions.
    - _ea1k 3y ago
      But they do if you give them your signing keys? I still don't understand the "or".
      - SAI_Peregrinus 3y ago
        When Google signs your app, they build the .apk bundle. JVM bytecode can be optimized without needing the source (Java or Kotlin). They actually build & sign several different bundles for different devices, optimizing each for the particular target (API level), and then serve the correct one when it's installed via the Play store. When they do this, they optimize out any calls to legacy API functions, and don't build bundles for those API versions.
daveoc64 3y ago
Seems more like they are unwilling to update VLC on Android, as they don't want to use the Play App Signing feature.
- gkbrk 3y ago
  > they don't want to use the Play App Signing feature It's not a feature that you enable with a button and it's good to go. It's basically giving up control of your own app, even for people getting this app from non-Google app stores. You need to give your signing key to Google and accept that Google employees (or any government asking Google nicely) can release updates to your own apps without going through you, and the user phones will accept those updates as being from the original developer because the signatures match. With an update installed with matching signatures, the system doesn't wipe existing data from the storage and the fake update can read all of it. As a user of VLC I would not want them to use app signing keys that Google has access to.
  - m-p-3 3y ago
    I believe it's the only way that Google can make the App Archive feature works within the current architecture: the replace the existing app by a small shim with the same AppId to save space, and that allows the system to retain the local user-data since it's not actually uninstalled. And when you load the shim, it redownload the app to be used again. The only way to achieve that currently is to "upgrade" or replace the app by a shim with the same digital signature, on the system will block it.
    - eYrKEC2 3y ago
      You can but a 1TB microsd card for $21 on amazon.com. Maybe app archiving feature should be eol'd.
      - acidburnNSA 3y ago
        Seems like many phones these days come kneecapped with no SD card reader.
deleted 3y ago
[deleted]
bhaak 3y ago
A perfect opportunity for advertising F-Droid as an open-source app store and software repository for Android which has an always uptodate version of VLC.
- glenstein 3y ago
  Was thinking the same thing. For better or worse, F-Droid lists it's latest VLC version 3.5.4 from Feb 23, 2023. I don't suppose there's a custom repo with newer versions?
  - bhaak 3y ago
    F-Droid allows to install development versions but it seems there aren't any for VLC. But there are nightlies on VLC's site itself: https://nightlies.videolan.org/ https://nightlies.videolan.org/

The Tweet: > If you wonder why we can’t update the VLC on Android version, it’s because Google refuses to let us update: > - either we give them our private signing keys, > - or we drop support for Android TV before API-30, and all our users on TV API<30 can’t get fixes.

_ea1k 3y ago
I don't understand why that is an "or"? How does dropping support for older Android TV versions fix the problem for updating on regular Android?
- SAI_Peregrinus 3y ago
  Google doesn't allow apps on the Play Store that support deprecated API versions.
  - _ea1k 3y ago
    But they do if you give them your signing keys? I still don't understand the "or".
    - SAI_Peregrinus 3y ago
      When Google signs your app, they build the .apk bundle. JVM bytecode can be optimized without needing the source (Java or Kotlin). They actually build & sign several different bundles for different devices, optimizing each for the particular target (API level), and then serve the correct one when it's installed via the Play store. When they do this, they optimize out any calls to legacy API functions, and don't build bundles for those API versions.

daveoc64 3y ago

Seems more like they are unwilling to update VLC on Android, as they don't want to use the Play App Signing feature.

gkbrk 3y ago
> they don't want to use the Play App Signing feature It's not a feature that you enable with a button and it's good to go. It's basically giving up control of your own app, even for people getting this app from non-Google app stores. You need to give your signing key to Google and accept that Google employees (or any government asking Google nicely) can release updates to your own apps without going through you, and the user phones will accept those updates as being from the original developer because the signatures match. With an update installed with matching signatures, the system doesn't wipe existing data from the storage and the fake update can read all of it. As a user of VLC I would not want them to use app signing keys that Google has access to.
- m-p-3 3y ago
  I believe it's the only way that Google can make the App Archive feature works within the current architecture: the replace the existing app by a small shim with the same AppId to save space, and that allows the system to retain the local user-data since it's not actually uninstalled. And when you load the shim, it redownload the app to be used again. The only way to achieve that currently is to "upgrade" or replace the app by a shim with the same digital signature, on the system will block it.
  - eYrKEC2 3y ago
    You can but a 1TB microsd card for $21 on amazon.com. Maybe app archiving feature should be eol'd.
    - acidburnNSA 3y ago
      Seems like many phones these days come kneecapped with no SD card reader.

deleted 3y ago

[deleted]

bhaak 3y ago

A perfect opportunity for advertising F-Droid as an open-source app store and software repository for Android which has an always uptodate version of VLC.

glenstein 3y ago
Was thinking the same thing. For better or worse, F-Droid lists it's latest VLC version 3.5.4 from Feb 23, 2023. I don't suppose there's a custom repo with newer versions?
- bhaak 3y ago
  F-Droid allows to install development versions but it seems there aren't any for VLC. But there are nightlies on VLC's site itself: https://nightlies.videolan.org/ https://nightlies.videolan.org/