Develop Reference

Is it possible to extract google-services.json from the apk file?

New to android development. When we distribute the .apk file, can the receiver extract the google-services.json and use our database or authentication database.
I looked
I have apk file, Is it possible to get android studio project from apk?
and Is google-services.json confidential?
and Is it possible to decompile an Android .apk file?
but don't directly relate

I tried to extract an apk of mine which has google-services.json file and I couldn't find the google-services.json file in extracted folder .
Edit : Here is more info I found
The google-services plugin has two main functions:
1 - Process the google-services.json file and produce Android resources that can be used in your application's code. See Adding the
JSON File more information.
2 - Add dependencies for basic libraries required for the services you have enabled. This step requires that the apply plugin:
'com.google.gms.google-services' line be at the bottom of your
app/build.gradle file so that no dependency collisions are introduced.
You can see the result of this step by running ./gradlew
:app:dependencies.
This means that the google-services.json file will be converted to android resources by google-services plugin during build process .
You can find how google-services.json works over here
can the receiver extract the google-services.json and use our database or authentication database.
Even if the receiver extracts credentials from apk , he cannot access database as the SHA-1 will be different .

Android library .aar file contents

We are evaluating a third party SDK to integrate with our Android app but the problem is that the third party company doesn't have any repo (eg: Maven) support. They are providing an Android module that needs to be imported (which consists of several .aar files, .java files, .manifest file and few assets). I don't understand why they are not providing a single .aar file that includes all of these, are there any technical challenges in doing that? The problem at our side is that we are using a local Nexus repository and we will have to manually upload this module and unzip the contents every time we do a build. Looking for any ideas on how to deal with this problem, thanks.

Load google-services.json from local file system

The google-services.json file used by the Firebase Android plugin is usually put in the app's module folder.
What I do want to do instead is put this file somewhere on the filesystem completely outside the project folder and let gradle / the Firebase plugin read it from there.
I thought about putting it's location in the local.properties and somehow 'tell' the Firebase plugin to get the location of the google-services.json from there.
How can I achieve this?

According to offical documentation, the google-services.json file is generally placed in the app/ directory (at the root of the Android Studio app module). As of version 2.2.0 the plugin supports build type and product flavor specific JSON files. All of the following directory structures are valid:
// dogfood and release are build types.
app/
google-services.json
src/dogfood/google-services.json
src/release/google-services.json
...
Note: Providing a google-services.json file in the release directory allows you to maintain a separate Firebase project for your production APKs.
When product flavors are in use these more complicated directory structures are also valid.
// free and paid are product flavors.
app/
google-services.json
src/dogfood/paid/google-services.json
src/release/free/google-services.json
...
As a conclusion, you cannot add google-services.json file outside your project.
Hope it helps.

Include a file when building Android AAR

I have an android project which I can already package into an AAR file using gradle. Now I want to be able to add a license file to the AAR. How can I do this?

Not entirely sure if it fits your needs but I would suggest you use a different solution. Instead of trying to include license information as a separate file, include license information in all of your files. That's a typical way to do it (e.g. look how Google does it in their I/O app: here or here).
This way you will make sure the user of your library will see license information (which you cannot be sure of if you put an external license file in the aar).

if you want to add a LICENSE.txt into your android library (aar), there are two things should be done:
add your LICENSE.txt to your project, path: src/main/resources/META-INF/LICENSE.txt(other resources folders are acceptable as well)
add following code into your module/build.gradle file.
android {
packagingOptions{
merge '**/LICENSE.txt'
}
}
the keyword merge means add all matching files to your aar

How to create Android library jar if not using resources?

I am creating an Android library, and I would like to create a distributable jar without revealing source code. The library does not use resources like layouts, images, etc. I understand that I can just copy the .jar automatically generated in the bin folder of an Eclipse Android project if I check 'is Library' under project properties.
Is there anything else I should be aware of? How does the client project know which permissions my library requires. Should I include those permissions in the Manifest of my library?

I understand that I can just copy the .jar automatically generated in the bin folder of an Eclipse Android project if I check 'is Library' under project properties.
I wouldn't, as you don't know how that JAR was created, and you don't know how that JAR might change as the tools change. That JAR is a side-effect of Android's internal build process and is not designed to be a production artifact. Create your own production JAR yourself (e.g., Ant <jar> task).
How does the client project know which permissions my library requires.
You tell them via well-written documentation.
Should I include those permissions in the Manifest of my library?
Since your JAR does not contain your manifest, that will not help.