Summary
The Tangem Android SDK still depends on SpongyCastle 1.58.0.0 (com.madgag.spongycastle:core / :prov), which is transitively pulled into every consuming app. SpongyCastle has been deprecated/abandoned for years (1.58 dates to 2017). We'd like to request migrating the SDK off it.
Why this matters
- SpongyCastle existed only as a workaround for an old Android issue: the platform ships a stripped-down
org.bouncycastle provider, which used to make the upstream BouncyCastle jar unusable on Android. Modern BouncyCastle now ships an official Android-optimized variant, org.bouncycastle:bcprov-jdk15to18, which resolves exactly that classloader/package-collision problem. So the original reason for SpongyCastle no longer exists.
- SpongyCastle 1.58 no longer receives security updates, so consumers inherit an abandoned crypto library on the classpath of a hardware-wallet SDK.
Why simple exclusion doesn't work (for other consumers hitting this)
The SDK's core bytecode references org.spongycastle.* directly on card-crypto paths — e.g. the secp256k1 curve parameters, the ECDSA signer, and org.spongycastle.jce.provider.BouncyCastleProvider. Excluding the dependency therefore throws NoClassDefFoundError: org.spongycastle.* at runtime on a real card tap; it can't be dropped without an SDK-side migration.
Request
Migrate the SDK's crypto references from org.spongycastle.* to the maintained org.bouncycastle:bcprov-jdk15to18 (org.bouncycastle.*), eliminating the last dependency on the abandoned library. Happy to help test against the migrated build.
Thanks!
Summary
The Tangem Android SDK still depends on SpongyCastle 1.58.0.0 (
com.madgag.spongycastle:core/:prov), which is transitively pulled into every consuming app. SpongyCastle has been deprecated/abandoned for years (1.58 dates to 2017). We'd like to request migrating the SDK off it.Why this matters
org.bouncycastleprovider, which used to make the upstream BouncyCastle jar unusable on Android. Modern BouncyCastle now ships an official Android-optimized variant,org.bouncycastle:bcprov-jdk15to18, which resolves exactly that classloader/package-collision problem. So the original reason for SpongyCastle no longer exists.Why simple exclusion doesn't work (for other consumers hitting this)
The SDK's
corebytecode referencesorg.spongycastle.*directly on card-crypto paths — e.g. the secp256k1 curve parameters, the ECDSA signer, andorg.spongycastle.jce.provider.BouncyCastleProvider. Excluding the dependency therefore throwsNoClassDefFoundError: org.spongycastle.*at runtime on a real card tap; it can't be dropped without an SDK-side migration.Request
Migrate the SDK's crypto references from
org.spongycastle.*to the maintainedorg.bouncycastle:bcprov-jdk15to18(org.bouncycastle.*), eliminating the last dependency on the abandoned library. Happy to help test against the migrated build.Thanks!