Post by @GrapheneOS@grapheneos.social

The latest version of our App Store adds support for delta updates. It drastically reduces the bandwidth for package updates by only shipping the changes. It's particularly high impact for our Vanadium browser and WebView. We've used deltas for OS updates for over 10 years.

https://grapheneos.social/@GrapheneOS/117534282698424102

GrapheneOS

@GrapheneOS@grapheneos.social 16 hr. ago

GrapheneOS App Store version 37 released:

https://github.com/GrapheneOS/AppStore/releases/tag/37

See the linked release notes for a summary of the improvements over the previous release and a link to the full changelog.

Forum discussion thread:

https://discuss.grapheneos.org/d/43210-grapheneos-app-store-version-37-released

#GrapheneOS #privacy #security #android

0 Boosts

0 Likes

GrapheneOS

@GrapheneOS@grapheneos.social 2 hr. ago

We're using the Ina library from the Accrescent project to generate and use deltas. We're also using Dropbox's brotli-decompressor library to replace gzip compression using Android's DEFLATE implementation. Both are pure Rust libraries fully avoiding unsafe code other than the exported C FFI API.

GrapheneOS

@GrapheneOS@grapheneos.social 2 hr. ago

Our App Store has always used a signed JSON file for metadata with a timestamp for downgrade protection. That has cryptographic hashes of each APK for verification. There's also the standard OS package manager verification via whole file signatures in each APK and version code downgrade protection.

GrapheneOS

@GrapheneOS@grapheneos.social 2 hr. ago

The latest version extends the cryptographic hashes to covering the compressed APKs and deltas to verify those prior to decompression. This means a compromised update server can't use the new Rust Brotli decompression library and Rust delta library as additional attack surface to exploit the client.

GrapheneOS

@GrapheneOS@grapheneos.social 2 hr. ago

The latest arm64 Vanadium browser APK is 325MB. It was previously downloaded as a 131MB gzip file created with zopfli. It's now downloaded as a 17MB update for users who were on one of the most recent 2 Vanadium releases. It's down to 95MB via Brotli for users on older versions without deltas.

2 more replies