You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Exitsitng minimize() feature is very important for library authors to allow ship smaller as possible library.
But current implementation is very limited, doesn't provide enough control for unused dependencies control, doesn't support code optimization, obfuscation or code hardening (and it's understandable, all of those are out of scope for shadow plugin).
Because it obviously not realistic to include all potential features to shadow plugin, I propose to instead work on a pluggable API, which allows to write an additional plugin which will integrate shadow with existing obfuscation tools: ProGuard R8 DexGuard
Many other security and optimization tools, too niche to support officially
It would be beneficial to have at least one official plugin for ProGuard or/and R8, so it would be easy for shadow users to find it and enable in their code. R8 is a good candidate, because it works for any JVM language (not only for Android), on active support, has Kotlin specific optimisations and probably even more globally adopted than ProGuard.
Alternative solutions
Run external tools against shadow jar
So do not integrate it on level of Shadow plugin but run them on top of jar.
The main issue is that it requires fully custom setup and anyway requires own gradle plugin, and it's not so trivial to do correctly. It doesn't improve shadow minimize feature, if any of external tools is used, it will be disabled anyway
Built-in support of r8/proguard
Integrated solution: do not focus on API, but include r8/proguard as part of shadow plugin and completely replace minimize().
It could be a good solution, shadow may provide way nicer API and also it could be easier for end user.
Still, API could be beneficial, so it possible to write custom Unused tracker and custom optimisation step for final library.
It's unclear in terms of license (for me), Proguard is GPL
But R8 is under Apache 2.0, so should be fine. But R8 dependency is hosted on Google repository, so it cannot be directly used by most users who use only Maven Central
gildor
changed the title
Extend minimize() feature with support shrinkers/obfuscators like ProGuard/R8
Extend minimize() feature with support of shrinkers/obfuscators like ProGuard/R8
Jan 22, 2025
What feature do you want to see added?
Exitsitng minimize() feature is very important for library authors to allow ship smaller as possible library.
But current implementation is very limited, doesn't provide enough control for unused dependencies control, doesn't support code optimization, obfuscation or code hardening (and it's understandable, all of those are out of scope for shadow plugin).
Because it obviously not realistic to include all potential features to shadow plugin, I propose to instead work on a pluggable API, which allows to write an additional plugin which will integrate shadow with existing obfuscation tools:
ProGuard
R8
DexGuard
Many other security and optimization tools, too niche to support officially
It would be beneficial to have at least one official plugin for ProGuard or/and R8, so it would be easy for shadow users to find it and enable in their code. R8 is a good candidate, because it works for any JVM language (not only for Android), on active support, has Kotlin specific optimisations and probably even more globally adopted than ProGuard.
Alternative solutions
Run external tools against shadow jar
So do not integrate it on level of Shadow plugin but run them on top of jar.
The main issue is that it requires fully custom setup and anyway requires own gradle plugin, and it's not so trivial to do correctly. It doesn't improve shadow minimize feature, if any of external tools is used, it will be disabled anyway
Built-in support of r8/proguard
Integrated solution: do not focus on API, but include r8/proguard as part of shadow plugin and completely replace minimize().
It could be a good solution, shadow may provide way nicer API and also it could be easier for end user.
Still, API could be beneficial, so it possible to write custom Unused tracker and custom optimisation step for final library.
It's unclear in terms of license (for me), Proguard is GPL
But R8 is under Apache 2.0, so should be fine. But R8 dependency is hosted on Google repository, so it cannot be directly used by most users who use only Maven Central
Related issues
Related PRs
The text was updated successfully, but these errors were encountered: