Missing R8 rule for library obfuscation

[lsuski]

Describe the bug

class (it's not the exact code but similar example):

sealed interface Navigation

@Serializable
@Parcelize
data class Details(val data: Data): Navigation

@Serializable
@Parcelize
sealed class Data: Parcelable

@Serializable
@Parcelize
data class Data1(val id: Int): Data()

@Serializable
@Parcelize
data class Data2(val name: String): Data()

Setup:

• library aar obfuscated using R8 containing @Serializable annotated classes for androix.navigation compose type-safe navigation
• application which has dependency to that library and is also obfuscated using R8

In runtime when I open the screen when navigation classes are used it crashes with Missing serializer exception

To Reproduce

Issue appears only if library and app are obfuscated (independently).
If library is obfuscated and app not then everything works.
If library is not obfuscated and app is then it also works.

Expected behavior

Not crash

Environment

• Kotlin version: 2.1.20
• Library version: 1.8.1
• Kotlin platforms: Android
• Gradle version: 8.13
• androidx.navigation: 2.8.9
• Android Gradle Plugin: 8.9.0

To fix this I added a rule to library obfuscation (not consumer proguard rules so it's not applied in the app obfuscation phase):

-if @kotlinx.serialization.Serializable class **
-keep class <1>$Companion { *; }

[sandwwraith]

Do you have a full reproducer? Rules for R8/proguard are shipped with the core-jvm library and should be picked up automatically by tools:

kotlinx.serialization/core/build.gradle.kts

Line 45 in 35a9edc

from(rootDir.resolve("rules/common.pro")) {

Maybe you've accidentally stripped them away?

[lsuski]

Hi,
The rules are not stripped. I think that the rule I mentioned is not defined in kotlinx serialization library. The issue appears only when I obfuscate the library and then app obfuscates itself with that library. The issue might be also in the R8. Is there any code in kotlinx serialization which relies on Companion objects being not obfuscated? For example if in the generated bytecode there is a string com.example.MyClass$Companion which is not changed to com.exampleMyClass$a after obfuscation.

[shanshin]

We have a rule

-if @kotlinx.serialization.Serializable class **
-keepclassmembers class <1> {
    static <1>$Companion Companion;
}

which could potentially break if class Foo$Companion is renamed.

Could you try adding a rule like

-if @kotlinx.serialization.Serializable class **
-keepclassmembers class <1> {
    static <1>$* Companion;
}

instead of your

-if @kotlinx.serialization.Serializable class **
-keep class <1>$Companion { *; }

?

[sandwwraith]

The issue appears only when I obfuscate the library and then app obfuscates itself with that library

I suspect something is wrong with this process, why you would need double obfuscation in the first place

[lsuski]

@shanshin I'll try this rule but it looks like it should be applied to the app obfuscation or library consumer proguard file while my rule is applied in library obfuscation file.

Regarding double obfuscation: I build a library which is obfuscated before publishing to the clients. I think it's quite common scenario for closed sourced libraries.

[JakeWharton]

The issue appears only when I obfuscate the library and then app obfuscates itself with that library

I suspect something is wrong with this process, why you would need double obfuscation in the first place

Commercial SDKs often run shrinkers to obfuscate their code for security-by-obscurity reasons. They are then delivered to apps which may additionally run a shrinker for similar obscurity reasons, unused code elimination, optimization, etc.

[lsuski]

Adding this rule:

-if @kotlinx.serialization.Serializable class **
-keepclassmembers class <1> {
    static <1>$* Companion;
}

to library consumer proguard file (which is eventually applied to the app obfuscation) fixed the issue.
Do you think that this rule should be included in kotlinx serialization?