Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Version 4.3.10 does not add a google-services data to AAB files, but adds google-services data to APK files #225

Open
hborders opened this issue May 3, 2022 · 0 comments

Comments

@hborders
Copy link

hborders commented May 3, 2022

Describe the bug
I upgraded com.google.gms.google-services from 4.3.5 to 4.3.10, and now my bundleRelease build crashes on startup with the following:

2022-04-28 12:07:11.456 13536-13536/? W/FirebaseApp: Default FirebaseApp failed to initialize because no default options were found. This usually means that com.google.gms:google-services was not applied to your gradle project.
2022-04-28 12:07:11.468 13536-13536/? W/FirebaseApp: Default FirebaseApp failed to initialize because no default options were found. This usually means that com.google.gms:google-services was not applied to your gradle project.

java.lang.RuntimeException: Unable to create application tv.twitch.android.app.consumer.TwitchApplication: java.lang.IllegalStateException: Default FirebaseApp is not initialized in this process tv.twitch.android.qa. Make sure to call FirebaseApp.initializeApp(Context) first.
        at android.app.ActivityThread.handleBindApplication(ActivityThread.java:6767)
        at android.app.ActivityThread.access$1500(ActivityThread.java:256)
        at android.app.ActivityThread$H.handleMessage(ActivityThread.java:2091)
        at android.os.Handler.dispatchMessage(Handler.java:106)
        at android.os.Looper.loopOnce(Looper.java:201)
        at android.os.Looper.loop(Looper.java:288)
        at android.app.ActivityThread.main(ActivityThread.java:7870)
        at java.lang.reflect.Method.invoke(Native Method)
        at com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:548)
        at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:1003)

I then reverted back to 4.3.8 and my bundleRelease build works fine.

To Reproduce
Steps to reproduce the behavior:

  1. Run the build
./gradlew clean --rerun-tasks --no-daemon --info --stacktrace lintRelease bundleRelease
  1. Unzip the resulting .aab file
unzip myapp-release.aab
  1. Search for my apk key from google-services.json:
grep -R 'my-api-key-redacted' . || echo no results
no results

Expected behavior
My apk key should exist in my .aab file, just like it exists when I build a .apk file directly:

./gradlew clean --rerun-tasks --no-daemon --info --stacktrace assembleRelease
unzip myapp-release.apk
grep -R 'my-api-key-redacted' . || echo no results
Binary file ./resources.arsc matches
Binary file ./myapp-release.apk matches

Desktop (please complete the following information):
From the Android Studio about screen:

Android Studio Bumblebee | 2021.1.1 Patch 3
Build #AI-211.7628.21.2111.8309675, built on March 16, 2022
Runtime version: 11.0.11+0-b60-7590822 x86_64
VM: OpenJDK 64-Bit Server VM by JetBrains s.r.o.
macOS 12.3.1
GC: G1 Young Generation, G1 Old Generation
Memory: 3072M
Cores: 12
Registry: external.system.auto.import.disabled=true, debugger.watches.in.variables=false
Non-Bundled Plugins: org.jetbrains.kotlin (211-1.6.21-release-334-AS7442.40)

Other versions:

Gradle 7.4.2
Plugin version 4.3.10
anthonymonori added a commit to thirdwavelist/android that referenced this issue May 15, 2022
The `google-services` plugin is plagued with issues if you are on the latest tooling features. For example it has issues [with configuration caching on](https://issuetracker.google.com/issues/221191604), [when used in conjunction with latest Gradle](google/play-services-plugins#221), [not adding expected output in AAB files](google/play-services-plugins#225), [and so on...](https://github.com/google/play-services-plugins/issues). The latest version of **4.3.10** was last released on [August 09, 2021](https://developers.google.com/android/guides/releases#august_09_2021). Generally speaking, committing the metadata generated (or the json itself) has been debunked many times now to be more friction to developers than actually being useful in securing your application. I recommend this article by Martin Bonnin to understand this a bit more: https://blog.mbonnin.net/about-the-android-makers-app-security-and-google-servicesjson

Note: I've made sure to implement platform restrictions on the keys used by the apps to ensure what services and which APIs can be used specifically by these signed apps.

Since the `google-services` gradle plugin is open sourced, it was quite easy to recreate the behavior and just simply create the xml entries manually from the `google-services.json` instead: https://github.com/google/play-services-plugins/blob/56c2c5609ee5d1ee9e3cd925a08f31ab4ecd3372/google-services-plugin/src/main/groovy/com/google/gms/googleservices/GoogleServicesTask.java

This PR:
- Removed the `google-services` plugin and the associated entries in `libs.versions.toml`
- Removed the google-services.json files
- Removed redundant gitignores
- Added values from google-services.json into relevant debug|release\res\values\strings.xml

Signed-off-by: Antal János Monori <anthonymonori@gmail.com>
anthonymonori added a commit to thirdwavelist/android that referenced this issue May 15, 2022
The `google-services` plugin is plagued with issues if you are on the latest tooling features. For example it has issues [with configuration caching on](https://issuetracker.google.com/issues/221191604), [when used in conjunction with latest Gradle](google/play-services-plugins#221), [not adding expected output in AAB files](google/play-services-plugins#225), [and so on...](https://github.com/google/play-services-plugins/issues). The latest version of **4.3.10** was last released on [August 09, 2021](https://developers.google.com/android/guides/releases#august_09_2021). Generally speaking, committing the metadata generated (or the json itself) has been debunked many times now to be more friction to developers than actually being useful in securing your application. I recommend this article by Martin Bonnin to understand this a bit more: https://blog.mbonnin.net/about-the-android-makers-app-security-and-google-servicesjson

Note: I've made sure to implement platform restrictions on the keys used by the apps to ensure what services and which APIs can be used specifically by these signed apps.

Since the `google-services` gradle plugin is open sourced, it was quite easy to recreate the behavior and just simply create the xml entries manually from the `google-services.json` instead: https://github.com/google/play-services-plugins/blob/56c2c5609ee5d1ee9e3cd925a08f31ab4ecd3372/google-services-plugin/src/main/groovy/com/google/gms/googleservices/GoogleServicesTask.java

This PR:
- Removed the `google-services` plugin and the associated entries in `libs.versions.toml`
- Removed the google-services.json files
- Removed redundant gitignores
- Added values from google-services.json into relevant debug|release\res\values\strings.xml

Signed-off-by: Antal János Monori <anthonymonori@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant