Unwanted permissions added by manifest merger because targetSdkVersion is not definied

[pawelmarchewka]

Hi.

We use MergeAdapter in one of our application and noticed that APK built with Android Studio/Gradle has more permissions than we declared in our AndroidManifest.xml.

In "...\build\outputs\apk" manifest merger generates files (manifest-merger-[debug|release]-report.txt) with information why and from each element was added to the final manifest. In these files you can see something like below:

android:uses-permission#android.permission.WRITE_EXTERNAL_STORAGE
IMPLIED from AndroidManifest.xml:2:1 reason: com.commonsware.cwac.merge has a targetSdkVersion < 4

android:uses-permission#android.permission.READ_PHONE_STATE
IMPLIED from AndroidManifest.xml:2:1 reason: com.commonsware.cwac.merge has a targetSdkVersion < 4

android:uses-permission#android.permission.READ_EXTERNAL_STORAGE
IMPLIED from AndroidManifest.xml:2:1 reason: com.commonsware.cwac.merge requested WRITE_EXTERNAL_STORAGE

which is true because CWAC's manifest doesn't specify minSdkVersion or targetSdkVersion so both defaults to 1.

Steps to reproduce:

1. Using latest Android Studio (1.0.0-rc4) create simple project with empty Activity.
2. Add dependency: compile 'com.commonsware.cwac:merge:1.0.4'
3. Build project: gradlew build
4. Go to "...\build\outputs\apk" and check manifest-merger-[debug|release]-report.txt or examine final APK files using tools like ApkTool.

It would great if you can specify some minimal targetSdkVersion like "4" to prevent manifest merger from automatically adding permissions which have nothing in common with MergeAdapter :)

Thanks.

[commonsguy]

I will attempt to get to this on the weekend -- my apologies.

[talklittle]

👍 came here to report this. @pawel-marchewka thank you for reporting.

[commonsguy]

Addressed in v1.1.0 -- let me know if you encounter further problems.

[talklittle]

Confirmed fixed in v1.1.0. Thank you @commonsguy!

[pawelmarchewka]

Yes, it works. Thank you very much for the very fast fix of the problem :)