Create a process for updating proguard rules

[ptornhult]

There seems to be quite a few open R8/Proguard issues, so more people than we are running into repeated issues with your library and obfuscation issues.

I'm not sure this is exactly how/if it works, but maybe you could add:
isMinifyEnabled = true
to the release target of the testapps project to test obfuscation works with the latest library dependency.

If your assembleRelease task fail, you should see the missing rules in: testapps/build/outputs/mapping/release/missing_rules.txt

And those new rules should be added to msal/consumer-rules.pro

Note! Currently the msal version of the testapp is set to "5.10.0", but it should be set to the same/latest version which is now 7.0.3

[github-actions]

Thank you for opening this issue!

Labels Applied:
Feature-Request: The user is requesting an enhancement to the development process for proactively handling R8/Proguard rule updates. This does not indicate an issue with the MSAL library itself but proposes improvements to the project's test and build workflows..

🤖 AI Analysis

To address the user's request for improving the ProGuard rules handling process, the following steps should be considered:

1. Enhance Test Apps for Obfuscation Validation:

   • Modify the build.gradle file of the testapps project to enable minification for release builds. Add the following line in the release build type:

     buildTypes {
         release {
             isMinifyEnabled = true
             proguardFiles getDefaultProguardFile('proguard-android-optimize.txt'), 'proguard-rules.pro'
         }
     }

2. Catch Missing Rules Automatically:

   • Ensure the task assembleRelease is included in the CI/CD pipeline for the testapps module. This will allow catching issues due to missing ProGuard rules in the file generated at testapps/build/outputs/mapping/release/missing_rules.txt.
   • Automate integration of valid missing rules from this file into msal/consumer-rules.pro while ensuring appropriate review by developers.

3. Update Test App Dependencies:

   • Regularly update the MSAL version used in the testapps project to the latest released version. For example, replace the current version 5.10.0 with 8.2.1 (latest as of now).

4. Prevent Recurrences:

   • Establish a process to regularly review and update ProGuard rules as part of each new MSAL release. This can be part of the library's release-testing checklist.
   • Add documentation in the README or CONTRIBUTING guide describing the process to handle ProGuard-related issues and how consumers of the library should address them.

5. Suggested ProGuard Configuration for Reference:
   To prevent common ProGuard or R8-related issues, ensure the following rules are included in consumer-rules.pro:

   -keepclassmembers class * implements javax.net.ssl.SSLSocketFactory { *; }
   -keep class com.microsoft.identity.** { *; }
   -keep class com.microsoft.aad.adal.** { *; }
   -dontwarn com.microsoft.identity.**
   -dontwarn com.nimbusds.**
   -dontwarn net.jcip.annotations.**
   -dontwarn edu.umd.cs.findbugs.annotations.**
   

This would align with similar issues that have been reported in the past and provide a proactive solution to prevent future occurrences.

See also related issues discussing ProGuard/R8 updates and common problems: #1540, #1677, #1695, #2076, #2289, #2355.

Related Issues: #1540, #1677, #1695, #2076, #2289, #2355

---

📦 MSAL Version Update Available

You are using MSAL version 7.0.3. The latest version is 8.2.1.

We recommend updating to the latest version to benefit from bug fixes, security improvements, and new features.

implementation "com.microsoft.identity.client:msal:8.+"

Using 8.+ automatically gets patch updates within the 8.x series.

---

---

Need help? Comment with:

PING-COPILOT: <your question>

Privacy: Do not include credentials, tokens, or PII in PING-COPILOT requests.