Remove HMS core from SDK and use it as .aar

[AlirezaDaryani]

Description:

For some reason, I need to remove HMS core from onesignal SDK, I did it now and I want use the sdk as .aar file.

Please help me to export and use .aar file. Environment

I am using the main branch of android SDK in this repo.

[jkasten2]

@AlirezaDaryani

For some reason, I need to remove HMS core from onesignal SDK,

OneSignal doesn't include Huawei or HMS as a dependency, see these lists:

• https://search.maven.org/artifact/com.onesignal/OneSignal/4.7.1/aar
• https://mvnrepository.com/artifact/com.onesignal/OneSignal/4.7.1

OneSignal does have references to HMS push and location, however they are compileOnly in this library. This means no code created by Huawei gets built into your app by default, you have to add directly to your build.gradle as outlined by the setup instructions.

Please help me to export and use .aar file.

I wouldn't recommend using the OneSignal .aar as dependencies can change between minor versions, not just major versions and you would have to check them each time you upgrade. However if you choose you can download it from Maven Central directly: https://repo1.maven.org/maven2/com/onesignal/OneSignal/4.7.1/

[AlirezaDaryani]

@jkasten2
Thank you for your help, but we have some problem in our company:

In this image, you can see that some tool detect HMS on our application.

Now, I need to remove HMS libraries from gradle and build new .aar from your SDK and use it in application. Actually I did it, but app crash on onesignal commands start.

I think these crashes related to some removed codes, So how can I do it? Can you make an aar without HMS libraries? Or can you help me to create correct aar from project?

[jkasten2]

@AlirezaDaryani Can you share how you imported OneSignal and the crash stack trace?

[AlirezaDaryani]

@jkasten2 I add .aar file :

dependencies { api files('libs/onesignal.aar') }

And here is the stack trace :

    --------- beginning of crash
E/AndroidRuntime: FATAL EXCEPTION: OS_REST_SUCCESS_CALLBACK
    Process: tech.dotswan.somi, PID: 7071
    java.lang.NoClassDefFoundError: Failed resolution of: Landroidx/work/Worker;
        at com.onesignal.OSNotificationRestoreWorkManager.beginEnqueueingWork(OSNotificationRestoreWorkManager.java:42)
        at com.onesignal.OneSignal.handleActivityLifecycleHandler(OneSignal.java:952)
        at com.onesignal.OneSignal.init(OneSignal.java:828)
        at com.onesignal.OneSignal.setAppId(OneSignal.java:711)
        at com.onesignal.OneSignal.reassignDelayedInitParams(OneSignal.java:1158)
        at com.onesignal.OneSignal.onRemoteParamSet(OneSignal.java:865)
        at com.onesignal.OneSignal$6.complete(OneSignal.java:1099)
        at com.onesignal.OneSignalRemoteParams.processJson(OneSignalRemoteParams.java:206)
        at com.onesignal.OneSignalRemoteParams.access$100(OneSignalRemoteParams.java:12)
        at com.onesignal.OneSignalRemoteParams$1.onSuccess(OneSignalRemoteParams.java:151)
        at com.onesignal.OneSignalRestClient$5.run(OneSignalRestClient.java:292)
        at java.lang.Thread.run(Thread.java:920)
     Caused by: java.lang.ClassNotFoundException: Didn't find class "androidx.work.Worker" on path: DexPathList[[zip file "/data/app/~~M5SoPdtZ81DT5RtenDuWNg==/tech.dotswan.somi-OCzSqViweXOqoT65wzYcmA==/base.apk"],nativeLibraryDirectories=[/data/app/~~M5SoPdtZ81DT5RtenDuWNg==/tech.dotswan.somi-OCzSqViweXOqoT65wzYcmA==/lib/x86_64, /data/app/~~M5SoPdtZ81DT5RtenDuWNg==/tech.dotswan.somi-OCzSqViweXOqoT65wzYcmA==/base.apk!/lib/x86_64, /system/lib64, /system_ext/lib64]]
        at dalvik.system.BaseDexClassLoader.findClass(BaseDexClassLoader.java:218)
        at java.lang.ClassLoader.loadClass(ClassLoader.java:379)
        at java.lang.ClassLoader.loadClass(ClassLoader.java:312)
        at com.onesignal.OSNotificationRestoreWorkManager.beginEnqueueingWork(OSNotificationRestoreWorkManager.java:42) 
        at com.onesignal.OneSignal.handleActivityLifecycleHandler(OneSignal.java:952) 
        at com.onesignal.OneSignal.init(OneSignal.java:828) 
        at com.onesignal.OneSignal.setAppId(OneSignal.java:711) 
        at com.onesignal.OneSignal.reassignDelayedInitParams(OneSignal.java:1158) 
        at com.onesignal.OneSignal.onRemoteParamSet(OneSignal.java:865) 
        at com.onesignal.OneSignal$6.complete(OneSignal.java:1099) 
        at com.onesignal.OneSignalRemoteParams.processJson(OneSignalRemoteParams.java:206) 
        at com.onesignal.OneSignalRemoteParams.access$100(OneSignalRemoteParams.java:12) 
        at com.onesignal.OneSignalRemoteParams$1.onSuccess(OneSignalRemoteParams.java:151) 
        at com.onesignal.OneSignalRestClient$5.run(OneSignalRestClient.java:292) 
        at java.lang.Thread.run(Thread.java:920) 

[jkasten2]

@AlirezaDaryani

OneSignal Dependencies

If you include the .aar directly it won't pull in any required dependences. The one in the stack trace is androidx.work:work-runtime however there is a number of others as I listed above.

However I don't recommend using the .aar directly, as you have to recheck the dependences every time you change the version of OneSignal. Using implementation 'com.onesignal:OneSignal:VERSION instead takes care of all this for you.

Huawei / HMS

@jkasten2 Thank you for your help, but we have some problem in our company:

In this image, you can see that some tool detect HMS on our application.

Now, I need to remove HMS libraries from gradle and build new .aar from your SDK and use it in application. Actually I did it, but app crash on onesignal commands start.

I think these crashes related to some removed codes, So how can I do it? Can you make an aar without HMS libraries? Or can you help me to create correct aar from project?

As noted above, OneSignal doesn't include HMS or Huawei dependencies definitions. The warning you shared above says "code signature", this would be code calling HMS libraries, not the libraries themselves. In the code OneSignal has written this (such as PushRegistratorHMS.java) it is calling HMS libraries however if you don't include HMS libraries in your app this code won't do anything. These API calls would still be in the .aar too so using that won't remove that warning you are seeing.

Could you let us know the tool you are using that is reporting the warning?

[AlirezaDaryani]

@jkasten2

this is the tool that we use for privacy check:

https://reports.exodus-privacy.eu.org/en/

Can you provide some release on maven without HMS libraries and codes?

Because there is HMS libraries in gradle of project in here and here.

[jkasten2]

this is the tool that we use for privacy check: https://reports.exodus-privacy.eu.org/en/

Thanks for the link.

Can you provide some release on maven without HMS libraries and codes?

Libraries are not automatically included today. For the code referencing HMS, it will require use to modularizing the required parts of our SDK to pull out all references. Something we plan to do in the future but this won't be available in the short turn.

There are 3 options I can think of for you:

1. Ignore the warning, evaluate to confirm if needed - It is about "code signatures" and doesn't includes the actually code from Huawei to send any data so this can be Ignored. You can confirm by using the network monitor in Android Studio no requests are made.
2. Remove unused code via obfuscation tools - Some tools like R8 and Proguard might be able to remove all HMS code reference with the right settings since HMS libraries themselves are missing.
3. Clone or fork this SDK and remove all HMS references

Because there is HMS libraries in gradle of project in here and here.

Under dependencies the HMS entries are compileOnly so they only used to compile against for the SDK, they are not included in your app when using OneSignal.

[kunwar97]

anyone able to solve this issue by adding proguard-rules?