Skip to content

chore: android studio agp assistant; 16kb pagesize fix #1107

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 3 commits into from
Sep 20, 2025
Merged

chore: android studio agp assistant; 16kb pagesize fix #1107

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
d701eec
upgrade android agp
transphorm Sep 20, 2025
5557075
update ndk and add manual linker for 16kb
transphorm Sep 20, 2025
2bb13fd
upgarde ndk
transphorm Sep 20, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 18 additions & 4 deletions app/android/app/build.gradle
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -109,6 +109,14 @@ android {
buildToolsVersion rootProject.ext.buildToolsVersion
compileSdkVersion rootProject.ext.compileSdkVersion

compileOptions {
sourceCompatibility JavaVersion.VERSION_17
targetCompatibility JavaVersion.VERSION_17
}
kotlinOptions {
jvmTarget = '17'
}

namespace "com.proofofpassportapp"

// Build optimizations
Expand Down Expand Up @@ -172,13 +180,13 @@ android {
}

packagingOptions {
exclude 'META-INF/LICENSE'
exclude 'META-INF/NOTICE'
exclude 'META-INF/versions/9/OSGI-INF/MANIFEST.MF'
pickFirst '**/libc++_shared.so'
jniLibs {
// Use modern packaging so AGP can 16 KB-align uncompressed .so files
useLegacyPackaging false
pickFirsts += ['**/libc++_shared.so']
}
resources {
excludes += ['META-INF/LICENSE', 'META-INF/NOTICE', 'META-INF/versions/9/OSGI-INF/MANIFEST.MF']
}
Comment on lines +187 to 191
Copy link
Contributor

@coderabbitai coderabbitai bot Sep 20, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue

🧩 Analysis chain

Don’t pickFirst libc++_shared; enforce a single known source.

pickFirst on libc++_shared.so can silently mask version skew from transitive AARs and cause hard‑to‑trace native crashes. Since you already link c++_shared via CMake (ANDROID_STL=c++_shared) and useLegacyPackaging=false, exclude all transitive copies and ship exactly one from your app.

 jniLibs {
   useLegacyPackaging false
-  pickFirsts += ['**/libc++_shared.so']
+  excludes += ['**/libc++_shared.so']
 }

Also verify the merged manifest contains android:extractNativeLibs="false" (see Manifest comment) to keep mmap loading and APK size benefits.

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== Grep for libc++_shared / c++_shared / ANDROID_STL occurrences =="
rg -n --hidden --no-ignore -S "libc\+\+_shared|c\+\+_shared|ANDROID_STL" -C3 || true

echo
echo "== Grep for pickFirsts / jniLibs / useLegacyPackaging in android app dir =="
rg -n --hidden --no-ignore -S "pickFirsts|jniLibs|useLegacyPackaging|excludes \+= \['\*\*/libc\+\+_shared.so'\]" -C4 android || true

echo
echo "== Locate CMakeLists.txt files =="
fd -HI --type f CMakeLists.txt || true

echo
echo "== Show android/app/src/main/AndroidManifest.xml (first 200 lines) if present =="
if [ -f android/app/src/main/AndroidManifest.xml ]; then
  sed -n '1,200p' android/app/src/main/AndroidManifest.xml || true
else
  echo "android/app/src/main/AndroidManifest.xml not found"
fi

echo
echo "== Search for android:extractNativeLibs across repository =="
rg -n --hidden --no-ignore -S "extractNativeLibs" -C3 || true

echo
echo "== Search for externalNativeBuild / cmake / stl references in android dir =="
rg -n --hidden --no-ignore -S "externalNativeBuild|cmake|stl" -C5 android || true

echo
echo "== Print matching build.gradle snippet around any jniLibs occurrences =="
rg -n --hidden --no-ignore -S "jniLibs" -C8 android || true

Length of output: 2976

Remove pickFirst for libc++_shared — exclude transitive copies and ship a single c++_shared

pickFirst masks version skew in transitive AARs and can cause hard‑to‑trace native crashes; you build with ANDROID_STL=c++_shared and useLegacyPackaging=false, so exclude transitive copies and ship exactly one libc++_shared from the app.

  • app/android/app/build.gradle — change in the jniLibs block:
 jniLibs {
   useLegacyPackaging false
-  pickFirsts += ['**/libc++_shared.so']
+  excludes += ['**/libc++_shared.so']
 }
  • packages/mobile-sdk-alpha/android/build.gradle (around line 97) — remove/replace packagingOptions pickFirst '**/libc++_shared.so' so the SDK does not ship its own copy.
  • Verify the merged app manifest has android:extractNativeLibs="false" (check app/android/app/src/main/AndroidManifest.xml and the merged manifest).
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
pickFirsts += ['**/libc++_shared.so']
}
resources {
excludes += ['META-INF/LICENSE', 'META-INF/NOTICE', 'META-INF/versions/9/OSGI-INF/MANIFEST.MF']
}
jniLibs {
useLegacyPackaging false
excludes += ['**/libc++_shared.so']
}
resources {
excludes += ['META-INF/LICENSE', 'META-INF/NOTICE', 'META-INF/versions/9/OSGI-INF/MANIFEST.MF']
}
🤖 Prompt for AI Agents 
In app/android/app/build.gradle lines 186-190, remove the pickFirst rule that
accepts '**/libc++_shared.so' and instead exclude transitive copies so the app
ships exactly one c++_shared: delete the pickFirst entry and add a
jniLibs/packagingOptions exclusion for '**/libc++_shared.so' in library modules
that currently include it (also remove/replace the same pickFirst in
packages/mobile-sdk-alpha/android/build.gradle around line 97), ensure the app
module provides the single libc++_shared (or depends on the NDK/CMake-provided
shared lib) and finally verify android:extractNativeLibs="false" is set in the
merged app manifest (check app/src/main/AndroidManifest.xml and the merged
manifest) to avoid duplicate native extraction.

}
}
Expand Down Expand Up @@ -222,3 +230,9 @@ dependencies {

implementation "com.google.android.play:app-update:2.1.0"
}

java {
toolchain {
languageVersion = JavaLanguageVersion.of(17)
}
}
3 changes: 1 addition & 2 deletions app/android/app/src/main/AndroidManifest.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,8 +17,7 @@
android:label="@string/app_name"
android:icon="@mipmap/ic_launcher"
android:roundIcon="@mipmap/ic_launcher"
android:extractNativeLibs="false"
tools:replace="android:icon, android:roundIcon, android:name, android:extractNativeLibs"
tools:replace="android:icon, android:roundIcon, android:name, android:extractNativeLibs"
Copy link
Contributor

@coderabbitai coderabbitai bot Sep 20, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue

🧩 Analysis chain

Harden manifest: drop privileged permission, restrict cleartext, and verify native libs extraction.

  • android.permission.ACCESS_SURFACE_FLINGER (Line 8) is system-only; requesting it can trigger Play policy review and offers no benefit. Remove it.
  • android:usesCleartextTraffic="true" (Line 23) weakens transport security. Gate it to debug or switch to a Network Security Config that whitelists only development hosts; keep false for release.
  • You removed android:extractNativeLibs while enabling modern JNI packaging in Gradle. That’s fine if the AGP merger injects extractNativeLibs="false"; please verify it’s present in the merged manifest to retain mmap performance and APK size wins.

Suggested minimal changes:

-    <uses-permission android:name="android.permission.ACCESS_SURFACE_FLINGER" />
...
-      android:usesCleartextTraffic="true"
+      android:usesCleartextTraffic="false"
+      android:networkSecurityConfig="@xml/network_security_config"
+      <!-- If the merger doesn't add it, keep this explicitly: -->
+      <!-- android:extractNativeLibs="false" -->

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

echo "Listing AndroidManifest.xml files (repo):"
rg -n --hidden --no-ignore -S "AndroidManifest.xml" || true
echo

MANIFEST="app/android/app/src/main/AndroidManifest.xml"
if [ -f "$MANIFEST" ]; then
  echo "Showing $MANIFEST (first 200 lines with numbers):"
  nl -ba -w3 -s': ' "$MANIFEST" | sed -n '1,200p'
else
  echo "$MANIFEST not found; listing any manifest files found:"
  rg -n --hidden --no-ignore -S '<manifest' --glob '!**/node_modules/**' || true
fi

echo
echo "Searching repo for suspicious entries:"
rg -n --hidden --no-ignore -S "ACCESS_SURFACE_FLINGER|usesCleartextTraffic|extractNativeLibs|android:extractNativeLibs|networkSecurityConfig" || true
echo

echo "Searching for network security config xml (res/xml):"
rg -n --hidden --no-ignore -S '<network-security-config|res/xml' --glob '!**/node_modules/**' || true
echo

echo "Searching Gradle files for packaging / legacy packaging settings:"
rg -n --hidden --no-ignore -S 'useLegacyPackaging|packagingOptions|extractNativeLibs|jniLibs|jni' || true
echo

echo "Done."

Length of output: 814

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

MANIFEST="app/android/app/src/main/AndroidManifest.xml"
if [ -f "$MANIFEST" ]; then
  echo "=== $MANIFEST ==="
  awk '{printf "%4d: %s\n", NR, $0}' "$MANIFEST" | sed -n '1,200p'
else
  echo "Manifest not found: $MANIFEST"
fi

echo
echo "Searching repo for target strings:"
rg -n --hidden --no-ignore -S "ACCESS_SURFACE_FLINGER|usesCleartextTraffic|android:extractNativeLibs|extractNativeLibs|networkSecurityConfig" || true

echo
echo "Searching for network security config XML files under res/xml:"
rg -n --hidden --no-ignore -S "res/xml|network_security_config" || true

echo
echo "Searching Gradle files for packaging / JNI settings:"
rg -n --hidden --no-ignore -S "useLegacyPackaging|packagingOptions|extractNativeLibs|jniLibs|jni" || true

Length of output: 318519

Harden manifest: drop privileged permission, restrict cleartext, and verify native libs extraction.

  • Remove android.permission.ACCESS_SURFACE_FLINGER — present in app/android/app/src/main/AndroidManifest.xml (line 8) and debug manifests; system-only and can trigger Play policy action.
  • Disable cleartext in release — android:usesCleartextTraffic="true" is set in app/android/app/src/main/AndroidManifest.xml (line 23) (also in debug manifests); set false for release and use a Network Security Config that only whitelists dev hosts — keep true only in debug.
  • Verify native libs extraction — main manifest’s tools:replace includes android:extractNativeLibs (line 20). app/android/app/build.gradle sets jniLibs/useLegacyPackaging false; confirm the merged RELEASE manifest contains android:extractNativeLibs="false" and, if it does not, add it explicitly.

Suggested minimal changes:

-    <uses-permission android:name="android.permission.ACCESS_SURFACE_FLINGER" />
...
-      android:usesCleartextTraffic="true"
+      android:usesCleartextTraffic="false"
+      android:networkSecurityConfig="@xml/network_security_config"
+      <!-- If the merger doesn't add it, keep this explicitly: -->
+      <!-- android:extractNativeLibs="false" -->

Committable suggestion skipped: line range outside the PR's diff.

🤖 Prompt for AI Agents 
In app/android/app/src/main/AndroidManifest.xml around lines 8 and 20–23, remove
the system-only permission android.permission.ACCESS_SURFACE_FLINGER from the
manifest and any debug manifests; set android:usesCleartextTraffic="false" in
the release manifest (keep true only in debug) and reference a Network Security
Config that whitelists dev hosts for debug builds; ensure the merged RELEASE
manifest contains android:extractNativeLibs="false" (since build.gradle sets
jniLibs/useLegacyPackaging=false) and if the merged release manifest does not
include it, add android:extractNativeLibs="false" explicitly in the release
manifest or via tools:replace in the main manifest so the release APK will not
extract native libs.

android:theme="@style/AppTheme"
android:supportsRtl="true"
android:usesCleartextTraffic="true"
Expand Down
2 changes: 1 addition & 1 deletion app/android/build.gradle
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@ buildscript {
}
}
dependencies {
classpath("com.android.tools.build:gradle:8.6.0")
classpath('com.android.tools.build:gradle:8.11.2')
Copy link
Contributor

@coderabbitai coderabbitai bot Sep 20, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue

🧩 Analysis chain

AGP 8.11.2 OK; remove jcenter() and the forced firebase-iid to avoid supply‑chain and compat risks.

  • jcenter() (Lines 36) is read‑only and a supply‑chain/availability risk. Remove unless you have a hard requirement and mirror artifacts.
  • Forcing com.google.firebase:firebase-iid:21.1.0 (Lines 53–55) is obsolete and can conflict with modern Firebase Messaging. Let the Firebase BoM manage versions.

Suggested edits:

 allprojects {
   repositories {
     google()
     mavenCentral()
-    jcenter()
+    // jcenter() removed (read-only; avoid supply-chain risk)
     maven {
       url("$rootDir/../../node_modules/react-native/android")
     }
...
-  configurations.all {
-    resolutionStrategy {
-      force 'com.google.firebase:firebase-iid:21.1.0'
-    }
-  }
+  // Do not force firebase-iid; rely on the Firebase BoM.
 }

🏁 Script executed:

#!/bin/bash
set -euo pipefail
echo "1) Searching repo for jcenter(), firebase-iid and forced resolutionStrategy..."
rg -n --hidden --no-ignore -S "jcenter\(|com.google.firebase:firebase-iid|resolutionStrategy|configurations\.all" || true

echo
echo "2) Show likely android build.gradle files if present:"
for f in app/android/build.gradle android/build.gradle android/app/build.gradle; do
  if [ -f "$f" ]; then
    echo "----- $f -----"
    nl -ba "$f" | sed -n '1,240p'
    echo
  fi
done

echo "3) Show any gradle files that contain 'firebase-iid' or 'jcenter' (full context)"
rg -n --hidden --no-ignore -S "jcenter\(|com.google.firebase:firebase-iid" -g '!*node_modules/*' || true

echo
echo "4) Search for firebase BoM usage"
rg -n --hidden --no-ignore -S "firebase-bom|com.google.firebase:firebase-bom" || true

Length of output: 938

AGP 8.11.2 OK — remove jcenter() and stop forcing firebase‑iid

  • app/android/build.gradle: remove jcenter() (line 36) — jcenter is read‑only and a supply‑chain/availability risk.
  • app/android/build.gradle: remove the configurations.all resolutionStrategy forcing 'com.google.firebase:firebase-iid:21.1.0' (line 54). Let the Firebase BoM manage versions to avoid conflicts with modern Firebase Messaging.
  • Also note: resolutionStrategy.force 'com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava' (line 50) — confirm this shim is still required.

Suggested edits:

 allprojects {
   repositories {
     google()
     mavenCentral()
-    jcenter()
+    // jcenter() removed (read-only; avoid supply-chain risk)
     maven {
       url("$rootDir/../../node_modules/react-native/android")
     }
...
-  configurations.all {
-    resolutionStrategy {
-      force 'com.google.firebase:firebase-iid:21.1.0'
-    }
-  }
+  // Do not force firebase-iid; rely on the Firebase BoM.
 }
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
classpath('com.android.tools.build:gradle:8.11.2')
buildscript {
repositories {
google()
mavenCentral()
}
dependencies {
classpath('com.android.tools.build:gradle:8.11.2')
}
}
allprojects {
repositories {
google()
mavenCentral()
// jcenter() removed (read-only; avoid supply-chain risk)
maven {
url("$rootDir/../../node_modules/react-native/android")
}
}
// Do not force firebase-iid; rely on the Firebase BoM.
}
🤖 Prompt for AI Agents 
In app/android/build.gradle around lines 23–60, remove the deprecated jcenter()
repository entry at line 36 and delete the configurations.all resolutionStrategy
that force‑pins 'com.google.firebase:firebase-iid:21.1.0' at line 54 so Firebase
versions are governed by the Firebase BoM; also inspect the
resolutionStrategy.force entry for
'com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava' at
line 50 and either keep it with a comment explaining why the shim is still
required or remove it if no longer necessary.

Copy link
Member Author

@transphorm transphorm Sep 20, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

upgrade gradle

classpath("com.facebook.react:react-native-gradle-plugin")
classpath "org.jetbrains.kotlin:kotlin-gradle-plugin:$kotlinVersion"
classpath 'com.google.gms:google-services:4.4.0'
Expand Down
2 changes: 1 addition & 1 deletion app/android/gradle/wrapper/gradle-wrapper.properties
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
#Mon Feb 03 16:12:34 CET 2025
distributionBase=GRADLE_USER_HOME
distributionPath=wrapper/dists
distributionUrl=https\://services.gradle.org/distributions/gradle-8.12-all.zip
distributionUrl=https\://services.gradle.org/distributions/gradle-8.13-all.zip
networkTimeout=600000
validateDistributionUrl=true
zipStoreBase=GRADLE_USER_HOME
Expand Down
Loading