Hacker News Reader

Comment by smoldesu | Hacker News Reader

It's a shame this guy can't easily roll back to an earlier version of the app. This is one of the reasons why Android users back up APK files of the apps they like. That way, you're still free to use the software you already use, license withstanding.

View on HN

The thing is, it used to be possible on iOS but along the way Apple crippled it. Back in the days you'd connect iOS devices to your computer and sync them, the syncing can involve transferring *.ipa files from the device to the computer, and can also install new apps. If you wanted to roll back, just delete the installed app on the device and ask iTunes to reinstall it using the file from the computer.

Eventually other features (app thinning?) got prioritized and this is no longer possible.

Starting in August, Google is requiring new apps in the Play Store to start using app bundles instead of APKs; I have never tried to work with these .apkm files, but I would be concerned Android is moving in the same direction here.

The big difference is that Android doesn't require apps to go through Google.

They may not require it, but if companies the size of Epic can't survive away from the Play store[1], I don't hold much hope for indie apps.

[1]https://www.theverge.com/2020/4/21/21229943/epic-games-fortn...

I believe what the parent comment is saying is that since you can sideload apps on Android, if you want to roll back an update, all you need to do is grab the apk from a website such as apkmirror and then install it. The Play Store moving to app bundles shouldn't affect this.

Yeah it's this. Android itself has no idea about Google Play requirements.

edit: just tried to back up an app that was definitely installed as a bundle, and yes, the result was a regular apk

That doesn't make any sense at all, even merely cryptographically (as you would need the signing key to merge the bundle back into a normal apk file and sign that new different file), and doesn't match the behaviors people talk about on various blogs and stack overflow.

Well, the app I tested — YouTube Vanced — is installed as a bundle, you can see Vanced Manager download its parts. I did check with jadx, that apk is validly signed with v1, v2, and v3 signatures.

Now, as far as my own knowledge of apk signing goes, v1 signature should definitely be fine because it operates on files inside the archive, so naturally merging multiple apks signed with the same certificate would keep it valid. But v2 signs the archive itself, which means merely repacking it would render the signature invalid. I don't have much of an idea about v3. Maybe there's some algorithm to merge multiple apks such that signatures remain valid.

Related question that needs research: how are bundle apps stored after installation? I know that installing a regular apk copies it into /data/app, extracts native libraries from it, and adds its metadata to some XML files I forgot names of. Again, it's been too much time since I did something serious for Android, so I'm not quite up to date on this stuff.

(are you the guy behind Cydia btw?)

edit again: apparently it doesn't back up the additional parts

    $ pm path com.vanced.android.youtube
    package:/data/app/~~JVhMJHpiRhB5U1ZM1MHNmw==/com.vanced.android.youtube-iqpVMVaXRD4XezgeqdjBHQ==/base.apk
    package:/data/app/~~JVhMJHpiRhB5U1ZM1MHNmw==/com.vanced.android.youtube-iqpVMVaXRD4XezgeqdjBHQ==/split_config.arm64_v8a.apk
    package:/data/app/~~JVhMJHpiRhB5U1ZM1MHNmw==/com.vanced.android.youtube-iqpVMVaXRD4XezgeqdjBHQ==/split_config.en.apk
    package:/data/app/~~JVhMJHpiRhB5U1ZM1MHNmw==/com.vanced.android.youtube-iqpVMVaXRD4XezgeqdjBHQ==/split_config.ru.apk

The apk I backed up earlier is base.apk, so that mystery is solved. It probably just adds them all to the classpath in runtime like regular JVM does with a bunch of jars.

there seem to be edge cases where the bundle isn't extractable back into an apks but despite packaging my apps as bundles and downloading from the play store they still end up as useable apks in the end.

as far as I've gathered bundles are a way of adding multiple ABI's into a smaller shared apk that then is split into per abi by google but I may be entirely off base here

...but the APK file never existed if the app was shipped as an app bundle. The APKMirror people seem to claim you will at least need a special installation app to install the bundle components, which is fine for now as that app can be an APK, but... this is feeling sketch.

https://www.apkmirror.com/apk/apkmirror/apkmirror-installer-...

While having to use either a custom installer, or if you don't trust any third party app [1] alternatively using ADB (or possibly the package manager directly if you have root) to install split APKs, is somewhat of a hassle [2], the more annoying part is that grabbing an APK from a random device is no longer enough to cover all screen densities, languages and whatever other criteria Google uses to split APKs [3], so good luck finding an older APK version if you're using some exotic screen density or (more likely) language.

Curiously enough by the way, Google themselves only recently added a feature to the Play Store which officially allows directly sharing (free) apps with nearby devices. I wonder how that is supposed to work going forward when app bundles will become more and more widespread – can you then only share apps with somebody having the same screen density and language setting? Or can apps at least still fall back to dynamically using the assets for whatever language/screen density was available just like they would today with a monolithic APK?

[1] As a perhaps more trustworthy alternative, there's SAI on FDroid (https://f-droid.org/de/packages/com.aefyr.sai.fdroid/), which a quick search indicates that it might be able to read and install APKMirror's bundle format, too.

[2] Also the fact that it makes Titanium Backup semi-useless for those apps, even though in other respects I still like it better than any of the other alternative backup apps I've tried.

[3] CPU architecture at least, although there's less variation there because almost everything will be either 32- or 64-bit ARM, and even before App Bundles some apps would already ship separate APKs for different CPU architectures.

> They may not require it, but if companies the size of Epic can't survive away from the Play store[1], I don't hold much hope for indie apps.

What does this have to do with backing up your apps? You can still install APKs even if they do that.

Up until recently you could modify network requests to download earlier versions of an app, but it seems Apple has patched that :(

Is it possible to fix this (badly) by backing up prior to an update and then then rolling back the whole phone?

It's horrible but it may work, I haven't paid attention to whether apps are restored to a previous state or just data.

In theory, but in my experience when restoring a backup most apps don’t actually get fully restored, it’s more like a metadata pointer which downloads it from the App Store. But sometimes you’ll actually get your older version of the app from the backup this way. I successfully used this technique to restore an old copy of Slack on my phone for a year after they changed the app logo, purely out of spite. But it doesn’t seem to work consistently, I think it’s dependent on something about the way the app is published which I don’t fully understand.

> I successfully used this technique to restore an old copy of Slack on my phone for a year after they changed the app logo, purely out of spite

Someone after my own heart!

Steam has the steamdb listing all versions of packages that are available for download. As long as you have a steam account that "owns" a license for the software you can use that info to download any listed version through steam.

Really? I've seen developers add old versions as "beta"s as a workaround to continue saves after a big patch so I assumed downloading old versions wasn't normally possible.

It's not possible through the Steam interface, but there are third party apps on github that let you download old bundles. I used one recently, but I forget the name, sorry.

I am not sure if every old version stays available. However I had to binary search through versions of their VR tools once because only a few versions ran on my dev. system. The normal steam UI doesn't really expose the versions or provide an option to prevent updates, so the beta workaround might be necessary to tag these versions for end users.

Wouldn’t that put an undue burden on app developers who have a server-side API if their users were running a bunch of different old versions, en masse?

I think of backwards compatibility in production as a responsibility (to an extent!)

Reply on news.ycombinator.com