1 files changed, 41 insertions, 0 deletions
diff --git a/app/proguard-rules.pro b/app/proguard-rules.pro
new file mode 100644
index 0000000..a2c74bf
--- /dev/null
+++ b/app/proguard-rules.pro
@@ -0,0 +1,41 @@
+# R8 keep rules. The goal is to let R8 strip everything the project
+# doesn't use while keeping the runtime paths the vendored libraries
+# rely on. We use bouncycastle directly (asn1/crypto/util.encoders)
+# and via :adb (pairing crypto), so its dead weight - pqc, jcajce,
+# pkix, cert, cms, tls, openpgp - is fair game for R8. Packaging
+# excludes drop the matching resources alongside.
+
+# ---- bouncycastle ----
+# asn1 has heavy static OID-to-class lookup; keep the full surface.
+-keep class org.bouncycastle.asn1.**       { *; }
+# crypto primitives we call directly + via :adb (SHA256Digest,
+# AESEngine, GCMBlockCipher, HKDF, AEADParameters, KeyParameter).
+-keep class org.bouncycastle.crypto.**     { *; }
+# util.encoders.Base64; rest of util/* is also referenced from asn1.
+-keep class org.bouncycastle.util.**       { *; }
+-dontwarn org.bouncycastle.**
+
+# ---- libadb-android (vendored as :adb) ----
+# AbsAdbConnectionManager + AdbStream + LocalServices are the public
+# surface we touch. Pairing internals reach into Conscrypt/Provider
+# reflectively; keep the package wholesale, it's ~150 KB.
+-keep class io.github.muntashirakon.adb.** { *; }
+-dontwarn io.github.muntashirakon.adb.**
+
+# Conscrypt is now bundled (org.conscrypt:conscrypt-android) so TLS
+# pairing uses its public exportKeyingMaterial instead of the platform's
+# hidden one. libadb reaches it reflectively (Class.forName +
+# getDeclaredConstructor + getMethod), and Conscrypt self-references via
+# JNI, so keep the package wholesale. The platform conscrypt name still
+# appears in a dead else-branch, so silence that one.
+-keep class org.conscrypt.** { *; }
+-dontwarn org.conscrypt.**
+-dontwarn com.android.org.conscrypt.**
+# Legacy Apache Harmony JSSE; unreachable on minSdk 35 but
+# referenced in libadb's PRNGFixes.
+-dontwarn org.apache.harmony.**
+
+# spake2-android (Kotlin) - small native bridge for SPAKE2 pairing.
+# Native methods are looked up by JNI signature; keep the names.
+-keep class com.muntashirakon.crypto.spake2.** { *; }
+-dontwarn com.muntashirakon.crypto.spake2.**