adb: reduce and harden wireless transport

1 files changed, 8 insertions, 41 deletions

diff --git a/app/proguard-rules.pro b/app/proguard-rules.pro
index 5c99914..6d647b4 100644
--- a/app/proguard-rules.pro
+++ b/app/proguard-rules.pro
@@ -1,41 +1,8 @@
-# R8 keep rules. The goal is to let R8 strip everything the project
-# doesn't use while keeping the runtime paths the vendored libraries
-# rely on. We use bouncycastle directly (asn1/crypto/util.encoders)
-# and via :adb (pairing crypto), so its dead weight - pqc, jcajce,
-# pkix, cert, cms, tls, openpgp - is fair game for R8. Packaging
-# excludes drop the matching resources alongside.
-
-# ---- bouncycastle ----
-# asn1 has heavy static OID-to-class lookup; keep the full surface.
--keep class org.bouncycastle.asn1.**       { *; }
-# crypto primitives we call directly + via :adb (SHA256Digest,
-# AESEngine, GCMBlockCipher, HKDF, AEADParameters, KeyParameter).
--keep class org.bouncycastle.crypto.**     { *; }
-# util.encoders.Base64; rest of util/* is also referenced from asn1.
--keep class org.bouncycastle.util.**       { *; }
--dontwarn org.bouncycastle.**
-
-# ---- libadb-android (vendored as :adb) ----
-# AbsAdbConnectionManager + AdbStream + LocalServices are the public
-# surface we touch. Pairing internals reach into Conscrypt/Provider
-# reflectively; keep the package wholesale, it's ~150 KB.
--keep class io.github.muntashirakon.adb.** { *; }
--dontwarn io.github.muntashirakon.adb.**
-
-# Conscrypt is now bundled (org.conscrypt:conscrypt-android) so TLS
-# pairing uses its public exportKeyingMaterial instead of the platform's
-# hidden one. libadb reaches it reflectively (Class.forName +
-# getDeclaredConstructor + getMethod), and Conscrypt self-references via
-# JNI, so keep the package wholesale. The platform conscrypt name still
-# appears in a dead else-branch, so silence that one.
--keep class org.conscrypt.** { *; }
--dontwarn org.conscrypt.**
--dontwarn com.android.org.conscrypt.**
-# Legacy Apache Harmony JSSE; unreachable on minSdk 31 but
-# referenced in libadb's PRNGFixes.
--dontwarn org.apache.harmony.**
-
-# spake2-android (Kotlin) - small native bridge for SPAKE2 pairing.
-# Native methods are looked up by JNI signature; keep the names.
--keep class com.muntashirakon.crypto.spake2.** { *; }
--dontwarn com.muntashirakon.crypto.spake2.**
+# Conscrypt carries a pre-KitKat adapter whose Harmony superclass does not
+# exist on this app's minSdk 31 runtime. R8 still scans the dead reference.
+-dontwarn org.apache.harmony.xnet.provider.jsse.SSLParametersImpl
+-dontwarn com.android.org.conscrypt.SSLParametersImpl
+
+# The small SPAKE2 bridge is native and resolves methods by JNI name.
+-keep class io.github.muntashirakon.crypto.spake2.** { *; }
+-dontwarn io.github.muntashirakon.crypto.spake2.**