How to use ProGuard with your Android library
Used widely in the Java world to shrink code and prevent reverse engineering, ProGuard is a tool familiar to many Android developers. However, using ProGuard with Android has never been an easy ride — and trying to do so in complex projects means developers will encounter many obstacles in determining what to preserve and what to obfuscate.
In Android, you can share your code in the form of a jar (Java Archive Resources) file for standard java codebase, or in aar (Android Archive Resource) form if you intend to include Android specific resources. Either way, when trying to use ProGuard on the library alone, you’ll run across a few problems because libraries in nature are built to be used by other projects. Renaming certain functions as part of an obfuscation process will result in an unwanted behavior.
Currently, the most recommended and effective approach for minimizing these problems is to include your library in the project and then run ProGuard on top of it.
While some developers suggest not obfuscating library projects with ProGuard at all because of these inherent complexities, there are scenarios where it makes sense to obfuscate a library. For example, you would need to add ProGuard if you wanted to distribute a library that included proprietary algorithms. (This is by no means the most secure way to distribute code, but it’s still a valid reason for using ProGuard with a library.)
Fortunately, our Android team, after much research, discovered a set of ProGuard configurations that allow you to set your library up for such scenarios.
Preparing your Android library
Example ProGuard files live under android-sdk/tools/proguard/examples — in this case, the file we’re looking for is library.pro.
Start by moving that script into proguard-project.txt of your library project and remove the lines -injars in.jar, -outjars out.jar, -libraryjars. Then, add it to the gradle configuration of the library as you normally would.
If your library contains specific items that need to be preserved, review the comments at the bottom of the configuration file.
Here is the full ProGuard working file for an Android library.
And voilà, others should now be able to use your obfuscated library.
