Too many methods in the SDK prevent from being able to build app

[ata-n]

Summary

As we know Android allows 65k methods in a single dex file. As of version 9.3.0 (with 3Ds2) the Stripe SDK has a dependency on bouncycastle for encryption (defacto Java encryption library). The issue is this library alone introduces 22k methods. I have noticed the proguard rules also contain a keep line for anything in bouncycastle which prevent them from being and or shrunk.

Code to reproduce

1. Create a brand new project in the latest version of Android Studio.
2. Add Stripe as a gradle dependency
3. Compile and debug

Android version

API 28

Impacted devices

All devices

Installation method

Gradle

SDK version

9.3.0 +

Other information

Here is a sample build.gradle that produces the error:

apply plugin: 'com.android.application'

apply plugin: 'kotlin-android'

apply plugin: 'kotlin-android-extensions'

android {
    compileSdkVersion 29
    buildToolsVersion "29.0.2"
    defaultConfig {
        applicationId "com.example.newapplication"
        minSdkVersion 19
        targetSdkVersion 29
        versionCode 1
        versionName "1.0"
        testInstrumentationRunner "androidx.test.runner.AndroidJUnitRunner"
    }
    buildTypes {
        release {
            minifyEnabled false
            proguardFiles getDefaultProguardFile('proguard-android-optimize.txt'), 'proguard-rules.pro'
        }
    }
}

dependencies {
    implementation fileTree(dir: 'libs', include: ['*.jar'])
    implementation"org.jetbrains.kotlin:kotlin-stdlib-jdk7:$kotlin_version"
    implementation 'androidx.appcompat:appcompat:1.1.0'
    implementation 'androidx.core:core-ktx:1.1.0'
    implementation 'androidx.constraintlayout:constraintlayout:1.1.3'
    implementation "com.stripe:stripe-android:11.0.0"
    testImplementation 'junit:junit:4.12'
    androidTestImplementation 'androidx.test:runner:1.2.0'
    androidTestImplementation 'androidx.test.espresso:espresso-core:3.2.0'
}

Unfortunately multidexing is not an option since our product is an SDK itself and we would like to introduce minimal number of methods to play nice with other existing apps. Multidexing also has its own set of issues and complexities and as Google recommends it should be avoided.

It just seems to me that Stripe is bringing in an unreasonable amount of methods which will ultimately force all consumers down a multidex approach which may or may not work for everyone.

[mshafrir-stripe]

@ata-n thanks for filing. There like isn't anything we can do in the short-term to fix this, but I'd like to put this on our backlog.

Can you help me understand
(a) how much above the DEX limit you are when integrating with the latest Stripe SDK?
(b) how you use the Stripe SDK?

[ata-n]

Thanks for the response @mshafrir-stripe

1. With a blank app the count hits 71k (Thats with the above mentioned gradle file and no code written in the project)

2. We have an SDK ourselves (2k methods) and we process payments within it using Stripe (Our SDK offers purchases), so the Stripe SDK is included as a dependency in ours. For our development our workspace consists of our own SDK module together with a development app module to test our product. The gradle file for that also looks like above with the addition of GooglePlay-AuthServices for user authentication.

Again I like to emphasize that after examination of the dex file, it is believed that the culprit is BouncyCastle which is a dependency of stripe-3ds2.

[mshafrir-stripe]

I simplified the BouncyCastle Proguard rules and reduced the count for BouncyCastle to 3800

[ata-n]

Thank you @mshafrir-stripe for the fix! I see there have been changes to the rules for Material as well. Wonderful!

May I ask that these changes be applied to the 10.x version as well? :) We use the Stripe SDK in our own SDK as a dependency and we have a strict no AndroidX policy for maximum compatibility.

[mshafrir-stripe]

@ata-n yes, I can do a 10.x release next week with the Proguard changes

[Alvtag]

@mshafrir
I tried out the 10.4.6 release on a blank app, still seeing 21~22k methods under org.bouncycastle.

There seems to be many packages other than jcajce and jce:

Is there any way to reduce this count to the 3800 above?

[mshafrir-stripe]

@Alvtag you need to specify minifyEnabled true to take advantage of the Proguard rules.

[Alvtag]

@mshafrir Thanks, I updated minify to true, cleared caches and restart, and rebuilt the APK but still seeing the high number. Are there any Proguard files that I might have to update?

[mshafrir-stripe]

What version of Gradle and AGP are you using?

[Alvtag]

I have
Gradle 5.1.1
Android Gradle Plugin 3.4.2
Android Studio 3.5.1

[mshafrir-stripe]

@Alvtag try upgrading to the latest version of Gradle and AGP. The SDK's Proguard rules is referenced via consumerProguardFiles 'proguard-rules.txt', so it should be pulled in automatically.

[Alvtag]

It works! in addition to updating Gradle and AGP, I found that I only had minifyEnabled on release flavor. When I either built under release, or added minifyEnabled to debug, I see the 3800 method count

kudos for the help @mshafrir-stripe