I'm trying to setup proguard for my Android project. My application project has very little code in it, but references a library project which has the vast majority of the code and any other external jars. That being said, I'm not sure how to setup proguard to take this into account. Right now my proguard config file is just the Android example from the ProGuard site. I've been searching around, but haven't found a lot or any documentation on using proguard with library projects, just jars. I'm new to proguard, so any push in the right direction would be great. Thanks.
It makes sense to me to specify proguard settings for a library (like which library files shouldn't be obfuscated) in the library project. I've found that I also need to include proguard configurations from my library modules in my application. To do this, I added the following to the defaultConfig section in my library's build.gradle
apply plugin: 'com.android.library'
android {
defaultConfig {
consumerProguardFiles 'proguard-rules.pro'
}
}
and then configured the proguard-rules.pro file in my library module to keep the names of important serialized classes.
See also consumerProguardFiles gradle reference
Edit
As #BornToCode points out, a different answer (originally posted here) better explains how library projects are handled by Proguard. Additionally, this referenced question has more interest and more overall reputation than that linked in my original response. The quote:
Library projects by themselves don't run ProGuard, so they don't use
any configuration.
Application projects obfuscate the entire code base, including any
referenced libraries, so they need proper configuration for the
application code and for the library code.
Old Answer (not wrong, just probably not the best approach)
The library projects is more of a convenient way of linking a project to its jar in Eclipse. When you build the project, the only component of the library project that is visible to your compiler is the jar file.
If you want to obfuscate that jar, check out this post:
How to obfuscate an Android library (.jar file) using Proguard in Eclipse
Related
I have an android library hosted on jitpack, but due to its dependencies requirements it is not built to and AAR file. It just a basic project that you can pull the methods from.
I want to hide the names for the classes, methods, and variables within the project itself without compilation. I understand that I could minify it in the gradle but that would only work once the project is built into and apk or bundle.
Is there a way to post process the code to have the same effect?
I have found the answer I was looking for. Jitpack pre-builds the project after you commit changes. In this compilation process it does take the minification in the gradle and proguard rules into account. Even though I don't distribute an AAR or Jar file, the code still gets hidden in the same way.
In conclusion, Just set up the minification and proguard rules as your normally would and Jitpack will handle the rest.
A project I'm working on contains a lot of external dependencies on 3rd party libraries. While analyzing compiled apk I found out that a package within the app that is supposed to be obfuscated remains clean. When I dived deeper I figured out that merged ProGuard configuration contains a rule breaking obfuscation logic.
None of the project's ProGuard configurations contain this rule. So I assume that it was gotten from one of the dependencies and merged to final configuration.
I look through this question but it seems that the answer is no longer valid for Android Plugin for Gradle 3.0.1 that I'm using because build/intermediates/exploded-aar folder no longer contains any ProGuard configurations.
So I'm wondering:
Is there a way to find what library causes the problem?
Is it still possible to disable a rule from consumer proguard file?
I am using a third party .aar project and they have enabled the proguard in the aar project. And in my Application Project i am enabling Proguard as well and its giving me errors.
So, do i need their(.aar project) proguard rules to be included in my proguard config files or is there any other possibility?
I have read in blogs and posts that the best approach is to include the .aar project without proguard and then run the proguard on aar and application project as a whole.
If i run proguard on Application will it affect the imported library's(already proguarded) code ?
So, do i need their(.aar project) proguard rules to be included in my proguard config files or is there any other possibility?
Quoting the documentation:
You can enable code shrinking on your library by adding a ProGuard configuration file to your library that includes its ProGuard directives. The build tools embed this file within the generated AAR file for the library module. When you add the library to an app module, the library's ProGuard file gets appended to the ProGuard configuration file (proguard.txt) of the app module.
So, if the library module has consumerProguardFiles 'lib-proguard-rules.txt' in its defaultConfig (see the docs), in principle, those rules will get applied automatically.
I have read in blogs and posts that the best approach is to include the .aar project without proguard and then run the proguard on aar and application project as a whole.
AFAIK, that's the typical plan. So, the AAR is left alone, with ProGuard applied on the app.
If i run proguard on Application will it affect the imported library's(already proguarded) code ?
AFAIK, the library's code should not be run through ProGuard.
Hi I developed one android library and Now I want to obfuscate it for redistribution. I develop my library with eclipse and android version 4.1.2. I tried obfuscating with eclipse and pro-guard. I do export and and also put proguard.config = proguard-project.text in project-properties but it not generating any jar file. It shows me result as its not allowing to library projects.
So I don't know how to obfuscating android library project. I need help regarding how to obfuscating of android library projects.
Need Help Thank you.
The Android SDK doesn't apply ProGuard to library projects; it only applies ProGuard to final applications (including their libraries). The latter is more effective in terms of shrinking, optimization, and obfuscation, because it can work on a larger body of code and it doesn't need to preserve the public API of the libraries.
If you want to distribute your library as an end-product, you can post-process it, as discussed in the ProGuard manual > Examples > A typical library.
Alternatively, DexGuard, ProGuard's commercial sibling for Android, can also process library projects out of the box.
(I am the developer of ProGuard and DexGuard)
In order to obfuscate your library what you need to do is:
Make sure gradle settings for lib module state minifyEnabled true .
run ./gradlew assemble{flavor}Release
Suppose i am developing an application using android api 16, my app will include android.jar. I would be importing few classes from the jar file.
I would enable proguard in release mode by configuring proguard. Does proguard remove unused classes in android.jar also?
Edit:
properties file for my project
android.library.reference.1=../actionbarsherlock
So does proguard remove unused classes from my library project included when packaging everything to .apk ?
Proguard does NOT remove anything from libraries. See the diagram and quote from the Proguard website.
ProGuard requires the library jars (or wars, ears, zips, or
directories) of the input jars to be specified. These are essentially
the libraries that you would need for compiling the code. ProGuard
uses them to reconstruct the class dependencies that are necessary for
proper processing. The library jars themselves always remain
unchanged. You should still put them in the class path of your final
application.
Android.jar would be referenced as a library jar (-libraryjars, see Proguard documentation) as opposed to an input jar. That means it would not be included in the output APK anyway. After all you don't want to redistribute the Android system libraries along with your app.