terl / lazysodium-android

An Android implementation of the Libsodium cryptography library. For the lazy dev.
https://github.com/terl/lazysodium-java/wiki
Mozilla Public License 2.0
108 stars 25 forks source link

Proguard rules? #32

Closed AndroidDeveloperLB closed 4 years ago

AndroidDeveloperLB commented 4 years ago

I've signed an app that uses this repository, but when the app uses it, it got an exception:

    java.lang.UnsatisfiedLinkError: Can't obtain class com.sun.jna.Pointer
        at com.sun.jna.Native.initIDs(Native Method)
        at com.sun.jna.Native.<clinit>(Native.java:23)
        at com.sun.jna.Native.a(Native.java:111)
        at com.goterl.lazycode.lazysodium.c.<init>(SodiumAndroid.java:4)
        at com.goterl.lazycode.lazysodium.c.<init>(SodiumAndroid.java:1)

How come? Are there any special Proguard rules to use?

AndroidDeveloperLB commented 4 years ago

I tried this:

#for https://github.com/terl/lazysodium-android#1-install
-keepclassmembers class * extends com.sun.jna.** {
    <fields>;
    <methods>;
}

Got from here: https://stackoverflow.com/a/10588578/878126

I even tried:

-keep public class com.sun.jna.** {
  public protected *;
}

And then I got a bit different error:

    java.lang.UnsatisfiedLinkError: Can't obtain static method dispose from class com.sun.jna.Native
        at com.sun.jna.Native.initIDs(Native Method)
        at com.sun.jna.Native.<clinit>(Native.java:24)
        at com.sun.jna.Native.register(Native.java:3)
        at com.goterl.lazycode.lazysodium.c.<init>(SodiumAndroid.java:4)
        at com.goterl.lazycode.lazysodium.c.<init>(SodiumAndroid.java:1)

Please update the repository with the file and with documentation about this.

AndroidDeveloperLB commented 4 years ago

I think I got it this way:

-keep class com.sun.jna.** { *; }
-keep class * implements com.sun.jna.** { *; }

Please let me know if that seems right, and that maybe I forgot anything.

gurpreet- commented 4 years ago

Hello @AndroidDeveloperLB, thank you for the question. Yes there are some proguard rules to apply as you have found out. The ones you commonly need to put down are the ones from the JNA library.

I am glad you have found the solution. I should really write this down in the documentation 🙂

gurpreet- commented 4 years ago

I've added this to the installation pages.

AndroidDeveloperLB commented 4 years ago

@gurpreet- I can't access the link Are those rules that I've made seem ok? Are they correct? Please update the repository itself, with Proguard rules so that whoever uses it won't even need to bother changing his own rules.

Also, I don't understand about the license here, and whether using Proguard affects it: https://github.com/terl/lazysodium-android/issues/33

This repository has one license, but the other that it uses somehow 2 other licenses, and that I can choose. It is very confusing...

gurpreet- commented 4 years ago

Yes I saw your other question posted, no need to mention it in this thread 🙂

Sorry I posted the wrong link above, I've updated it. You should add this to your proguard rules basically:

-dontwarn java.awt.*
-keep class com.sun.jna.* { *; }
-keepclassmembers class * extends com.sun.jna.* { public *; }

Proguard is essentially a way of saying when obfuscating the app, please don't do anything to the following classes.

AndroidDeveloperLB commented 4 years ago

I asked there about it, and some people say that using Proguard might affect the license:

https://groups.google.com/forum/?utm_medium=email&utm_source=footer#!msg/jna-users/FPyExuBlb7o/EbANy0bvAgAJ

That's why I'm worried...

gurpreet- commented 4 years ago

I believe you have very little to worry about 🙂 JNA is under APL2.0 as far as we're concerned.

Remember this is just saying please do not obfuscate (i.e modify) JNA classes (which is APL2.0 as far as we're concerned) using proguard:

-keep class com.sun.jna.* { *; }
-keepclassmembers class * extends com.sun.jna.* { public *; }
AndroidDeveloperLB commented 4 years ago

"Remember this is just saying please do not obfuscate (i.e modify) JNA classes (which is APL2.0 as far as we're concerned) using proguard:"

You say that according to the license I'm not allowed, or because of the crashes? I excluded it from being obfuscated because of the crashes. Didn't know it could violate the terms. Are you sure it can?

I tried the rules you've provided. Seems to work fine. Please consider adding these into your repository, so that whoever uses it won't have to set it.

gurpreet- commented 4 years ago

No there are no violations in terms if you add those proguard rules. Because you brought up licenses in this thread, I was saying even if you add those rules there would be no violations as everything is licensed APL2. Yes add those rules to also fix the problem.

AndroidDeveloperLB commented 4 years ago

I meant that if we ignore that it crashes, if I don't put the rules, would that be an issue because it obfuscates the code?

I think the answer is that it doesn't matter at all.

gurpreet- commented 4 years ago

In terms of licenses, it doesn't matter if you do or don't obfuscate. I just read that even the GPL doesn't regard obfuscated code as real source code so you are free to obfuscate. Plus I'm pretty sure, but not certain, that the APL2 allows obfuscation.

In order for freedoms 1 and 3 (the freedom to make changes and the freedom to publish the changed versions) to be meaningful, you need to have access to the source code of the program. Therefore, accessibility of source code is a necessary condition for free software. Obfuscated “source code” is not real source code and does not count as source code.

https://www.gnu.org/philosophy/free-sw.html

In terms of fixing the crash, you have to put those rules in to keep those JNA classes to stop them from being obfuscated. To be clear, let me reiterate, because you're getting confused, those rules stop JNA classes from being obfuscated. So therefore if you are not obfuscating them, then you are not modifying them, so there is no cause for concerns in terms of licensing as you are not doing anything to JNA.

However your concerns about obfuscation are unfounded because, as mentioned in the first paragraph of this comment, obfuscated code does not count as "real" code in terms of the APL/GPL/LGPL, so you can obfuscate freely.

AndroidDeveloperLB commented 4 years ago

Sure. Thank you very much for your time. Please do update the repository though.