IssueTracker

It seems that it's an Android Studio/Android Gradle plugin issue. "installreferrer:1.1" after added to a project automatically adds these permissions:

* android.permission.READ_EXTERNAL_STORAGE
* android.permission.READ_PHONE_STATE
* android.permission.WRITE_EXTERNAL_STORAGE

although they are missing from library's AndroidManifest.

When inspecting in "Merged manifest" tool, "jump to declaration" jumps to applications debug AndroidManifest.
When clicking "remove" from "Merged manifest" it inserts:

```
    <null
        android:name="android.permission.WRITE_EXTERNAL_STORAGE"
        tools:node="remove" />
```

Android Studio: 3.5.3
Android Gradle plugin: 3.5.3
macOS 10.14.6

A workaround, while waiting for an official fix, is to add this to your app's manifest:

    <!-- https://issuetracker.google.com/issues/146115244 -->
    <!-- Remove unnecessary permissions added by install referrer -->
    <uses-permission
        android:name="android.permission.READ_PHONE_STATE"
        tools:node="remove" />
    <uses-permission
        android:name="android.permission.WRITE_EXTERNAL_STORAGE"
        tools:node="remove" />
    <uses-permission
        android:name="android.permission.READ_EXTERNAL_STORAGE"
        tools:node="remove" />

Of course, you shouldn't include a "remove" entry for any of these permissions which your app is already using and needs.

The reason the library is adding READ_PHONE_STATE is because it doesn't have <uses-sdk> in its manifest anymore (in 1.0 it defined minSdk=8 and targetSdk=22). Because it doesn't define a targetSdk, the tools assume the targetSdk=1.

A targetSdk=1 causes the tools to automatically add READ_PHONE_STATE. You can see the effects in the manifest merger logs:

    uses-permission#android.permission.READ_PHONE_STATE
    IMPLIED from /Users/<redacted>/trello-app/src/debug/AndroidManifest.xml:2:1-13:12 reason: com.android.installreferrer has a targetSdkVersion < 4

I've run into this issue before with another library, if you want another example: https://github.com/JakeWharton/ProcessPhoenix/issues/9

How do you solve for it then? Are you using downgraded version 1.0 or overriding permission in manifest?

We are simply sticking with 1.0 for the time being, but if we had to update, we'd override the permission in the manifest.

It's look like nobody from google interest with this issue. So why do you remove a working useful solution (install_referrer intent) and try to chance it with non-testable, problematic library?

Vinita, please take a look

Assigning this to jaslack@ since I have moved teams.

Status update: the new artifacts were approved and we will soon push 1.1.2 with the fix.

I can confirm that it's fixed in 1.1.2. Thanks for the reporter and the team for the fix.

Thanks. Closing as fixed. Thanks for verifying.