Missing target SDK field in aar causes AGP to add implicit permissions to apps using the aar [391763861]

Assigned

Bug

Status Update

No update yet.

Description

vv...@gmail.com

created issue #1

Jan 23, 2025 03:09PM

STEPS TO REPRODUCE:

1. aar!/AndroidManifest.xml

<manifest xmlns:android="http://schemas.android.com/apk/res/android"
    package="org.lsposed.hiddenapibypass.library" >

    <uses-sdk
        android:minSdkVersion="1"
        android:targetSdkVersion="35" />

</manifest>

use this aar and build app.

New AGP does not allow developers to set the target SDK for library, so the aar is like this: aar!/AndroidManifest.xml

<manifest xmlns:android="http://schemas.android.com/apk/res/android"
    package="org.lsposed.hiddenapibypass.library" >

    <uses-sdk android:minSdkVersion="1" />

</manifest>

use this new aar and build app, compared with step 1, the new apk has the following additional permissions：

    <uses-permission
        android:name="android.permission.WRITE_EXTERNAL_STORAGE" />

    <uses-permission
        android:name="android.permission.READ_PHONE_STATE" />

    <uses-permission
        android:name="android.permission.READ_EXTERNAL_STORAGE" />

more info: https://github.com/LSPosed/AndroidHiddenApiBypass/issues/53

Comments

bl...@google.com <bl...@google.com> Jan 24, 2025 07:41PM

Assigned to an...@google.com.

je...@google.com <je...@google.com> #2Jan 28, 2025 06:38PM

Reassigned to je...@google.com.

Disregard - after adding

enableUnitTestCoverage = false
enableAndroidTestCoverage false

Thinks started to work again.

But for what it is worth - the error message could have been more helpful.

vv...@gmail.com <vv...@gmail.com> #3Jan 29, 2025 12:31PM

Well the error message is that it tried to configure jacoco task and failed, so it works for you because you disabled the feature.

So the error message is indicative of a bigger problem. Oviously, 8.2 is pretty old for us, not sure you are interested in trying 8.8.

The easiest would be to have a project reproducing the issue, if that's possible, we'll look into it.

vv...@gmail.com <vv...@gmail.com> #4Jan 29, 2025 12:33PM

We tried bumping things up to 8.8 but that causes other problems that we need to resolve first. There was a long list of issues with name spaces and what not due to clashes across different 3rd part integrations that we have in the app.
Unfortunately we haven't had the resources to keep things up to date for a long time - and now every possible problem is just piling up...

I'll get back once we manage to upgrade to 8.8...

Message last modified on Jan 29, 2025 12:35PM

vv...@gmail.com <vv...@gmail.com> #5Jan 29, 2025 12:43PM

If you want to reproduce this issue, create a new empty application project with target sdk 35 and add org.lsposed.hiddenapibypass:hiddenapibypass:5.0 dependency.

Issue 391763861