[firebase-appdistribution:16.0.0-beta18] In-app updater crashes after download: malformed FileProvider authority in InstallActivity

[rudivice]

[REQUIRED] Step 2: Describe your environment

• Android Studio version: Narwhal | 2025.2 (irrelevant for this bug — caused by a string constant baked into the AAR)
• Firebase Component: App Distribution
• Component version: com.google.firebase:firebase-appdistribution:16.0.0-beta18 (regression vs. beta17)

[REQUIRED] Step 3: Describe the problem

In firebase-appdistribution:16.0.0-beta18, the in-app updater fails silently after the APK has been downloaded. InstallActivity crashes in onResume() because it looks up its own FirebaseAppDistributionFileProvider under a malformed authority string. Beta17 works correctly.

Steps to reproduce

1. Set up a project that uses firebase-appdistribution:16.0.0-beta18 and the in-app updater (firebase-appdistribution-api).
2. Install an old build on a real device.
3. Distribute a newer build via Firebase App Distribution.
4. Open the app → accept the in-app update prompt.
5. Let the APK download finish (the FAD notification reads "Download complete").
6. Expected: the system package installer dialog opens.
7. Actual: the activity crashes silently, the process dies, the user is dropped back to the launcher.

The merged manifest of any consumer app correctly registers the authority ${applicationId}.FirebaseAppDistributionFileProvider, which is what the AAR's <provider> entry expects:

<provider
    android:name="com.google.firebase.appdistribution.impl.FirebaseAppDistributionFileProvider"
    android:authorities="${applicationId}.FirebaseAppDistributionFileProvider"
    android:exported="false"
    android:grantUriPermissions="true">

But InstallActivity constructs a different authority string at runtime and the lookup fails.

Logcat

E AndroidRuntime: java.lang.RuntimeException: Unable to resume activity
    {com.example.app/com.google.firebase.appdistribution.impl.InstallActivity}
E AndroidRuntime: Caused by: java.lang.IllegalArgumentException: Couldn't find
    meta-data for provider with authority
    com.example.appcom.google.firebase.appdistribution.impl..FirebaseAppDistributionFileProvider
E AndroidRuntime:     at com.google.firebase.appdistribution.impl.InstallActivity
    .startAndroidPackageInstallerIntent(InstallActivity.java:149)
I ActivityManager: Process com.example.app has died

Note the authority string the SDK is searching for:

com.example.appcom.google.firebase.appdistribution.impl..FirebaseAppDistributionFileProvider
              ^                                       ^^
              no dot after packageName                double dot before provider name

Root cause — bytecode diff between beta17 and beta18

I downloaded both AARs from Google Maven, extracted classes.jar, and disassembled InstallActivity with javap -p -c. The method startAndroidPackageInstallerIntent has one changed instruction:

       64: invokevirtual ... getApplicationContext:()Landroid/content/Context;
       67: invokevirtual ... android/content/Context.getPackageName:()Ljava/lang/String;
       70: invokevirtual ... java/lang/StringBuilder.append:(Ljava/lang/String;)…
-      73: ldc_w  // String .FirebaseAppDistributionFileProvider
+      73: ldc_w  // String com.google.firebase.appdistribution.impl..FirebaseAppDistributionFileProvider
       76: invokevirtual ... java/lang/StringBuilder.append:(Ljava/lang/String;)…

In short, packageName + ".FirebaseAppDistributionFileProvider" (beta17) was changed to packageName + "com.google.firebase.appdistribution.impl..FirebaseAppDistributionFileProvider" (beta18) — the separator dot was dropped and a double dot slipped in before the provider name. The merged manifest still declares only the short authority, so the lookup fails.

InstallActivity.onResume() is also not robust against this — the IllegalArgumentException propagates out and crashes the process instead of being reported as a failed update.

Workaround

Downgrade to 16.0.0-beta17. Both firebase-appdistribution and firebase-appdistribution-api have working beta17 artifacts and can be pinned independently of firebase-bom.

Relevant code

The defect lives in:

firebase-appdistribution/src/main/java/com/google/firebase/appdistribution/impl/InstallActivity.java

in startAndroidPackageInstallerIntent(), around the getUriForFile(...) / authority construction.

[lehcar09]

Hi @rudivice, thank you for reaching out and sharing the result of your investigation. I was able to reproduce the issue. I'll raise this to our engineers and see what we can do here. Thanks!