- wow, this is an exact case Apple more or less won in Apple v Epic. They got some minor slap on the wrist about steering but they still got around that. Apple must have paid their judge off big time

- Yup, this is the steering that Apple "lost".

>Starting January 16, developers can apply for an entitlement to provide a link within their app to a website the developer owns or is responsible for. The entitlement can only be used for iOS or iPadOS apps in the United States App Store.

There's so many stipulations to getting this approved that it's hard to call it a win. Just more delays

- good, but ofc irrelevant on Apple for now.

- And good. Somewhat relevant for Apple but the stipulations above make this hard.

I mostly hope this precedent can be used against future Apple proceedings to get that store opened up.

- 3rd party store auto updates (you need to install some stuff as root in order to get this working on f-droid)

Since Android 12, third party app stores can auto-update apps

This might explain (or be related to) why when I installed an Amazon app through Amazon's store it would get hijacked by the Play Store version eventually.

Generally no that doesn't happen. It may be very specific to Amazon though. Android uses signing keys to validate updates, and if the signing key doesn't match, it is impossible to install the update. My guess is Amazon (was?) using the same signing keys between the two stores.

Most developers use Google's app signing service to ensure that a loss of the signing key will not strand their users on old versions. In that case, it would not have been possible for Amazon distributed apps to use the same signing keys. I say would not have, because these new requirements mean it will actually now be possible since Amazon could distribute the updates published to Google Play, and doing resigning shenanigans would throw the baby out with the bathwater (allowing users to seamlessly switch app stores)

Interesting. I assumed there was some kind of internal identifier, which was the same between the two variants of the app, but I guess that identifier is just (a hash of?) the public key. Nevertheless, it seems like the Play Store had priority for providing updates.

Tangentially, how does Android handle signing key rotation/expiration?

The identifier would be the package name baked into the APK, "com.amazon.mshop.android.shopping" in this case, likely the same for both versions. I'm sure there's several ways that issue could have happened but my first guess would be some OEM nonsense, a lot of them bundle Amazon and probably have poorly written updaters that can't tell you've modified the install.

This happened on Pixel devices, so the OEM is Google (which might be related). As I recall, no Amazon apps come preinstalled, but I have installed them from the Play Store first, then removed them, so maybe that could have flipped some flag too.

Interesting, yeah could be. Disabling Play Store auto-updates for the app if enabled might help.

Actually I'm not sure how you installed Amazon Shopping from the Amazon store anyways? I installed it a while back assuming they would have versions of Shopping and Kindle that would let me buy books, but they didn't seem to distribute those apps at all which I thought was strange. Still not seeing them there now.

Wow, you're right. Now I'm not sure of my own memory on this. I remember installing Kindle (or pre-Kindle Comixology...?) from somewhere and being able to buy on it, but then it got replaced with the version where you couldn't. Maybe that was because it got discontinued on the third-party app store (which I thought was Amazon's)?

This is not true, I get automatic updates with F-Droid just fine.