Develop Reference

Amplify.Auth.fetchAuthSession() userPoolTokens is null when shrinking the apk

I am using the amplify libraries for flutter to connect to my aws backend. After a successful call to Amplify.Auth.signIn() I use Amplify.Auth.fetchAuthSession() to access the current credentials. Like that:
final result = await Amplify.Auth.fetchAuthSession(
options: CognitoSessionOptions(getAWSCredentials: true),
);
if (!result.isSignedIn) return const None();
if (result is CognitoAuthSession) {
return Some(result.userPoolTokens.idToken);
}
But when I build an apk with flutter using the following command my code breaks.
flutter build apk
Because result.userPoolTokens is suddenly null and I get a NoSuchMethodError. The getter 'idToken' was called on null. But if I disable shrinking and build the apk with the following command everything works again.
flutter build apk --no-shrink
So I think it has something to do with the shrinking and I would prefer to shrink my app because the shrinked apk is significantly smaller.
Would appreciate any help.

This is likely due to inadequate rules being applied for the R8 shrinker.
The Amplify Android library did not vend any consumer-rules.pro until version 1.6.10 (see release notes), which was just released January 22nd, 2021.
The latest version of Amplify Flutter is 0.0.2-dev.1, and it consumes version 1.6.8 of the Android library. I've raised an issue on their GitHub repository, to update to 1.6.10.
In the meantime, you could try to apply these rules in your top-level application project.
-keep class com.amazon.** { *; }
-keep class com.amazonaws.** { *; }
-keep class com.amplifyframework.** { *; }

Is there any proguard rules should use while using EncryptedSharedPreferences?

before using EncryptedSharedPreferences my app works fine in release mode with (minifyEnabled = true), After adding the security library (version 1.0.0-rc01) to my application the app crash while opening and if i use (minifyEnabled = false) the app works fine, i think i missing something to add it in proguard-rules.pro but i have searched a lot did not found anything.

Looks like something wrong with Tink obfuscation. My current workaround is add this rule to proguard:
-keep class com.google.crypto.tink.** { *; }
But also keep track of updates of issue here.
UPDATE - 06.01.2020
There is more effective solution (thanks #jtsalva to pointing out):
-keepclassmembers class * extends com.google.crypto.tink.shaded.protobuf.GeneratedMessageLite {
<fields>;
}
UPDATE - 08.19.2020
This issue should now fixed in Version 1.0.0-rc03

This issue has been answered with a more targeted proguard rule here
-keepclassmembers class * extends com.google.crypto.tink.shaded.protobuf.GeneratedMessageLite {
<fields>;
}
This saves my app ~0.2MB compared to the currently accepted answer

i try all above . not working for my case.
this what i do and work perfect:
-keepclassmembers class * extends com.google** {
<fields>; }

Mapbox's LocationLayerPlugin not updating location when Proguard is enabled

I'm using Mapbox's LocationLayerPlugin v0.6.0 with Proguard enabled.
In release builds, the location layer isn't requesting location updates: no GPS usage icon when in foreground, and the location becomes stale a few seconds after the first launch and never updates. I'm building the plugin without providing a LocationEngine, using public LocationLayerPlugin(MapView mapView, MapboxMap mapboxMap).
It doesn't happen in debug builds (no Proguard) or if I explicitly disable Proguard in the release build (minifyEnabled=false). The proguard-rules.pro file doesn't have any specific rules for Mapbox (both SDK and plugin), I've tried adding the ones from https://github.com/mapbox/mapbox-plugins-android/blob/master/app/proguard-rules.pro but the issue remains.
Are there other rules to be added? I couldn't find anything in the documentation.

If you are using google play location services, and the GoogleLocationEngine, you can try adding
-keep class com.google.android.gms.** { *; }
-dontwarn com.google.android.gms.**
to your proguard-rules.pro file.
I was able to reproduce the issue and above setup helped.
However, if you are only using the AndroidLocationEngine there has been some issues with that engine recently, you can follow the issue tracker for more info.
For more context, if you will not manually add the google play location services dependency to your project, the LocationEngineProvider#obtainBestLocationEngineAvailable used by the default constructor will return the AndroidLocationEngine, otherwise, it will return the GoogleLocationEngine.

Removing uses of TestFlight SDK with ProGuard

How can I automatically remove all uses of TestFlight SDK from my app? For example, all passCheckpoint calls:
TestFlight.passCheckpoint("FreemiumDialog opened");
My (ProGuard-obfuscated) release builds should not even attempt to send any info to TestFlight, yet I do not want to manually toggle between having TestFlight jar & its uses in my codebase.

This ProGuard configuration removes all calls to TestFlight SDK:
# Remove all TestFlight SDK calls, e.g. TestFlight.takeOff( ... );
# and TestFlight.passCheckpoint( ... );
-assumenosideeffects class com.testflightapp.lib.TestFlight { *; }
-dontwarn org.msgpack.**
Note: without the last line, ProGuard fails with a bunch of warnings like:
Warning: org.msgpack.template.builder.BeansBuildContext: can't find
referenced class javassist.CtClass
Warning: org.msgpack.util.json.JSONUnpacker: can't find referenced class > org.json.simple.parser.JSONParser
This is because the TestFlightLib jar (at least version 1.3) contains and uses a library called MessagePack. We need to either -keep it or mute the warnings. Above I'm muting warnings, since the whole point here is not to use TestFlight in release builds.

Phonegap 2.4 Android Proguard config

I've upgraded a build from Phonegap (Cordova) 2.0 to 2.4 and everything was working fine in dev until I actually came to testing the final release apk. What I'm finding, after a lot of time wasted, is that for some reason now when I run the build my proguard config is breaking the phonegap build in some way that means that when it runs the deviceready is never called. There seem to be no errors when building, nor running and nothing as far as I can see but I'm guessing something is silently failing in the cordova js as i'm not getting compile / log errors on the device.
As I say this is ONLY when having ran the Proguard obfs in the build process. If i turn off Proguard it all works fine. I reverted all my code back to 2.0 to be sure and that is all fine so somewhere along the way there has been a stuble change that is seemingly not documented / or nobody has hit just yet (2.4 only came out a few weeks ago - at time of writing 26th feb 2013).
My Proguard config contains the following for phonegap (as well as some other standard config)
-keep public class * extends com.phonegap.api.Plugin
-keep public class * extends org.apache.cordova.api.Plugin
-keep public class org.apache.cordova.DroidGap
-keep public class org.apache.cordova.**
-keep public class org.apache.**
-dontwarn android.webkit.*
-dontwarn org.apache.**
and decompiling the dex doesn't seem to throw any light - everything looks ok at a glance...
Anyone have any ideas???

Try replacing the Cordova "keep" settings in your proguard-project.txt with the following line, which should maintain all Cordova classes, fields, and methods, both public and private (and thus reenable deviceready):
-keep class org.apache.cordova.** { *; }
Then you just need to include your class(es) (presumably extending CordovaPlugin, not just Plugin) e.g.
pre-v3:
-keep public class * extends org.apache.cordova.api.CordovaPlugin
v3+:
-keep public class * extends org.apache.cordova.CordovaPlugin

Phonegap Plugins are being excluded from the final APK I guess. Cordova.js probably doesn't even exist to give errors.