whyoleg / cryptography-kotlin

Kotlin Multiplatform cryptography / crypto library
https://whyoleg.github.io/cryptography-kotlin/
Apache License 2.0
331 stars 20 forks source link

Proguard removes jdk providers #51

Open acmpo6ou opened 2 weeks ago

acmpo6ou commented 2 weeks ago

Hello.

I have a KMP project with Desktop and Android as target OSes. I have this in my dependencies (the latest 4.0.0 version):

implementation(libs.cryptography.core)
implementation(libs.cryptography.provider.jdk)

I'm using ProGuard:

compose.desktop {
    application {
        // ...
        buildTypes.release.proguard {
            obfuscate = true
        }
    }
}

If I compile a release uber jar:

./gradlew packageReleaseUberJarForCurrentOS

Running it will result in this error message (the app doesn't crash, but the decryption doesn't happen either):

Exception in thread "AWT-EventQueue-0" java.lang.IllegalStateException: No providers registered. Please provide a dependency or register provider explicitly
    at dev.whyoleg.cryptography.e.b(Unknown Source)
    at kotlin.SynchronizedLazyImpl.getValue(Unknown Source)
    at d.d.e.k.a(Unknown Source)
    at d.d.e.k.a(Unknown Source)
    at d.d.e.p.invokeSuspend(Unknown Source)
    at kotlin.coroutines.jvm.internal.BaseContinuationImpl.resumeWith(Unknown Source)
    at kotlinx.coroutines.W.run(Unknown Source)
    at kotlinx.coroutines.c.a.a(Unknown Source)
    at kotlinx.coroutines.c.d.run(Unknown Source)
    Suppressed: kotlinx.coroutines.internal.h: [CoroutineName(d.d.e.a:d.d.e.k:default), aU{Cancelling}@2ab8b3b7, Dispatchers.Main]

The debug build works perfectly fine, as well as a release build for Android.

To fix the above issue, I had to add this to my proguard file (compose-desktop.pro):

-keep class dev.whyoleg.cryptography.*
-keep class dev.whyoleg.cryptography.providers.jdk.*

and this to my build.gradle.kts:

compose.desktop {
    application {
        // ...
        buildTypes.release.proguard {
            obfuscate = true
            configurationFiles.from(project.file("compose-desktop.pro"))
        }
    }
}
whyoleg commented 6 days ago

Hey! Thanks for filling the issue, yeah, we will need to provide pro guard rules for the library out of the box, similar to have it's done in kotlinx.coroutines or similar. The reason for this, is that providers are loaded via JDK ServiceLoader, and so class name is important.

Additionally integration test will need to be added