[AGP 3.6.0-beta01] SecurityException: SHA1 digest error for BouncyCastleProvider when using Robolectric [142580430]

Fixed

Bug

Status Update

No update yet.

Description

ch...@gmail.com

created issue #1

Oct 12, 2019 11:43PM

All of my Robolectric tests are now failing due to a SecurityException. These previously worked fine with AGP 3.6.0-alpha12.

Log:
java.lang.SecurityException: SHA1 digest error for org/bouncycastle/jce/provider/BouncyCastleProvider.class
at sun.security.util.ManifestEntryVerifier.verify(ManifestEntryVerifier.java:223)
at java.util.jar.JarVerifier.processEntry(JarVerifier.java:243)
at java.util.jar.JarVerifier.update(JarVerifier.java:230)
at java.util.jar.JarVerifier$VerifierStream.read(JarVerifier.java:484)
at java.io.FilterInputStream.read(FilterInputStream.java:133)
at java.io.FilterInputStream.read(FilterInputStream.java:107)
at org.robolectric.util.Util.copy(Util.java:46)
at org.robolectric.util.Util.readBytes(Util.java:63)
at org.robolectric.internal.bytecode.SandboxClassLoader.getByteCode(SandboxClassLoader.java:167)
at org.robolectric.internal.bytecode.SandboxClassLoader.maybeInstrumentClass(SandboxClassLoader.java:119)
at org.robolectric.internal.bytecode.SandboxClassLoader.lambda$findClass$0(SandboxClassLoader.java:112)
at org.robolectric.util.PerfStatsCollector.measure(PerfStatsCollector.java:53)
at org.robolectric.internal.bytecode.SandboxClassLoader.findClass(SandboxClassLoader.java:111)
at java.lang.ClassLoader.loadClass(ClassLoader.java:424)
at java.lang.ClassLoader.loadClass(ClassLoader.java:357)
at java.lang.Class.getDeclaredConstructors0(Native Method)
at java.lang.Class.privateGetDeclaredConstructors(Class.java:2671)
at java.lang.Class.getConstructors(Class.java:1651)
at org.robolectric.util.inject.Injector.findConstructor(Injector.java:249)
at org.robolectric.util.inject.Injector.inject(Injector.java:232)
at org.robolectric.util.inject.Injector.lambda$new$0(Injector.java:115)
at org.robolectric.util.inject.Injector$MemoizingProvider.get(Injector.java:485)
at org.robolectric.util.inject.Injector.getInstanceInternal(Injector.java:213)
at org.robolectric.util.inject.Injector.getInstance(Injector.java:197)
at org.robolectric.util.inject.Injector.getInstance(Injector.java:191)
at org.robolectric.internal.AndroidSandbox.lambda$new$0(AndroidSandbox.java:51)
at java.util.concurrent.FutureTask.run(FutureTask.java:266)
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
at java.lang.Thread.run(Thread.java:748)

Repro:
git clone -b cb/agb-3.6.0-beta01

https://github.com/chrisbanes/tivi.git
cd tivi
./gradlew testDebug

Comments

ga...@google.com <ga...@google.com> Oct 14, 2019 10:51AM

Assigned to ga...@google.com.

ga...@google.com <ga...@google.com> #2Oct 14, 2019 02:39PM

Also we need to add following for activities and fragments using VIewModel with to start:

## Android architecture components: ViewModel
-keepclassmembers class * extends android.arch.lifecycle.ViewModel {
<init>(...);
}

Message last modified on Oct 14, 2019 02:52PM

pa...@google.com <pa...@google.com> Oct 14, 2019 02:54PM

Reassigned to pa...@google.com.

ga...@google.com <ga...@google.com> #3Oct 14, 2019 03:12PM

Update:

Managed to get

https://github.com/googlesamples/android-architecture-components/tree/master/BasicSample working with the following set of rules:

## Android architecture components: Lifecycle
# generated GenericLifecycleObserver and it's empty constructor is considered to be unused by proguard
-keepclasseswithmembers class * implements android.arch.lifecycle.GenericLifecycleObserver {
<init>(...);
}
# keep Lifecycle State and Event enums with fields
-keepclassmembers class android.arch.lifecycle.Lifecycle$* { *; }
# keep methods annotated with @OnLifecycleEvent even if they seem to be unused
# (Mostly for LiveData.LifecycleBoundObserver.onStateChange(), but who knows)
-keepclassmembers class * {
@android.arch.lifecycle.OnLifecycleEvent *;
}
# ViewModel's empty constructor is considered to be unused by proguard
-keepclassmembers class * extends android.arch.lifecycle.ViewModel {
<init>(...);
}

Not quite sure if it's the final version (I think we can prettify it a bit), but everything seems to work fine.

ch...@gmail.com <ch...@gmail.com> #4Oct 14, 2019 08:28PM

Update:

https://github.com/googlesamples/android-architecture-components/tree/master/GithubBrowserSample also works fine with the same set of rules, added Okio, okHttp3, GSON and Dagger2 for Android rules

Please confirm it works fine for everyone.

I have a pull request for googlesamples/android-architecture-components ready, waiting for your feedback on this issue.

pa...@google.com <pa...@google.com> #5Oct 25, 2019 05:37PM

Accepted by pa...@google.com.

It's working fine for me, thanks a lot!

mi...@aexp.com <mi...@aexp.com> #6Nov 25, 2019 11:18PM

Update:

slightly modified the config I proivided:

## Android architecture components: Lifecycle
# LifecycleObserver's empty constructor is considered to be unused by proguard
-keepclassmembers class * implements android.arch.lifecycle.LifecycleObserver {
<init>(...);
}
# ViewModel's empty constructor is considered to be unused by proguard
-keepclassmembers class * extends android.arch.lifecycle.ViewModel {
<init>(...);
}
# keep Lifecycle State and Event enums values
-keepclassmembers class android.arch.lifecycle.Lifecycle$State { *; }
-keepclassmembers class android.arch.lifecycle.Lifecycle$Event { *; }
# keep methods annotated with @OnLifecycleEvent even if they seem to be unused
# (Mostly for LiveData.LifecycleBoundObserver.onStateChange(), but who knows)
-keepclassmembers class * {
@android.arch.lifecycle.OnLifecycleEvent *;
}

It turns out that generated GenericLifecycleObserver is unreachable after obfuscation because it is created using reflection by adding "_LifecycleAdapter" to LifecycleObserver class name (which is definitely changed). This leads to Lifecycle using fallback ReflectiveGenericLifecycleObserver (a little slower because of looking for your callback methods with reflection in order to call them). So we might just as well lose GenericLifecycleObserver generated by apt.

Another option is to keep both LifecycleObserver and generated GenericLifecycleObserver to improve performance. In that case replace
-keepclassmembers class * implements android.arch.lifecycle.LifecycleObserver {
<init>(...);
}

with

-keep class * implements android.arch.lifecycle.LifecycleObserver {
<init>(...);
}

pa...@google.com <pa...@google.com> #7Nov 26, 2019 02:33PM

This is still broken for me in alpha 2. I still need to specify ProGuard rules myself.

hu...@google.com <hu...@google.com> #8Nov 27, 2019 05:29PM

Marked as fixed.

Looks like I missed part in our .gradle file.