Android 出海aab的资源混淆(兼容gradle7.0+)

由于项目出海, 需要对app进行各方面的混淆,避免马甲包,以及规避被恶意攻击的风险;  其中一方面就是对资源的混淆, 发现了一个可用的库

https://github.com/bytedance/AabResGuard

但但是, 这个插件github上最新版本是 0.1.9, Gradle插件7.0+会报错: 

• Type 'com.bytedance.android.plugin.tasks.AabResGuardTask' property 'aabResGuard' is missing an input or output annotation.

• Try:
  Run with --stacktrace option to get the stack trace. Run with --info or --debug option to get more log output. Run with --scan to get full insights.

不用担心, 网上已经有人给出了解决方式:

[Gradle issue] Gradle 7.0 编译问题 · Issue #75 · bytedance/AabResGuard · GitHub 

 没错,有人已经适配了gradle7.0并发布了0.1.10版本, 需要到特有的仓库去下载;

下面就是完整的接入流程:

1.首先添加插件依赖:

root/build.gradle

buildscript {
    repositories {
        google()
        mavenCentral()
        mavenLocal()
        maven { url 'https://raw.githubusercontent.com/martinloren/AabResGuard/mvn-repo' }
    }
 
    dependencies {
        //......
        //AabResGuard
        classpath "com.bytedance.android:aabresguard-plugin:0.1.10"
    }
}

2.自定义一个aab_proguard.gradle

apply plugin: "com.bytedance.android.aabResGuard"
aabResGuard {
    mappingFile = file("mapping.txt").toPath() // Mapping file used for incremental obfuscation
    whiteList = [ // White list rules
                  "*.R.raw.*",
                  "*.R.drawable.icon",
                  "*.R.string.default_web_client_id",
                  "*.R.string.firebase_database_url",
                  "*.R.string.gcm_defaultSenderId",
                  "*.R.string.google_api_key",
                  "*.R.string.google_app_id",
                  "*.R.string.ga_trackingId",
                  "*.R.string.google_crash_reporting_api_key",
                  "*.R.string.google_storage_bucket",
                  "*.R.string.project_id",
                  "*.R.string.*google*"
    ]
    obfuscatedBundleFileName = "duplicated-app.aab" // Obfuscated file name, must end with '.aab'
    mergeDuplicatedRes = true // Whether to allow the merge of duplicate resources
    enableFilterFiles = true // Whether to allow filter files
    filterList = [ // file filter rules
//                   "*/arm64-v8a/*",
                   "META-INF/*"
    ]
 
    enableFilterStrings = false // switch of filter strings
    unusedStringPath = file("unused.txt").toPath() // strings will be filtered in this file
    languageWhiteList = ["en", "zh"] // keep en,en-xx,zh,zh-xx etc. remove others.
}

3.引入插件以及配置:

app/build.gradle

    apply from:'aab_res_proguard.gradle'

4.执行打包aab, 生成的混淆后的aab在 build/output/bundle/xxxx/duplicated_app.aab

其他参考:

AabResGuard添加依赖总结_碧云天丶的博客-CSDN博客

AabResGuard from sebthom - DevPick.io