Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Reduce APK size #5879

Closed
seadowg opened this issue Dec 18, 2023 · 1 comment · Fixed by #5896
Closed

Reduce APK size #5879

seadowg opened this issue Dec 18, 2023 · 1 comment · Fixed by #5896
Assignees
Milestone

Comments

@seadowg
Copy link
Member

seadowg commented Dec 18, 2023

Adding Bouncy Castle has increase the APK ~1MB in size. We had to include this as Ed25519 signature verification is not supported in standard Java/Android until Java 15 (or API 33). We should investigate whether we can drop this in some way. Here's some options I've thought of:

  1. It looks like the majority of the size increase comes from some .properties files used by Bouncy Castle for Picnic which we're not currently using. We might be able to exclude these from the APK.
  2. We could look at forking Bouncy Castle and only including the bits we need (currently just Ed25519 signature verification).
  3. We could make Ed25519 signature verification an Android 13+ feature and use the java.security implementation (which ironically we'll probably be Bouncy Castle under the hood).

1 and 2 are pretty risky as messing around with a trusted crypto library feels like a bad path to go down.

3 isn't something we've done a lot of, but I think the use case that initially wanted extract-signed might be using Android 13 devices. If we do limit the XPath function to newer OSes, definitely think we should change the signature to always take an algorithm so that the "default" isn't a special case in the future.

@seadowg
Copy link
Member Author

seadowg commented Jan 5, 2024

@lognaturel and I discussed this and decided that attempting to exclude parts of Bouncy Castle is the way to go. We should look into it, but I'm pretty sure ProGuard will already be excluding classes we don't use, so it might be best to just exclude the .properties files (referenced in 1).

@seadowg seadowg self-assigned this Jan 5, 2024
@seadowg seadowg mentioned this issue Jan 5, 2024
5 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
Status: done
Development

Successfully merging a pull request may close this issue.

1 participant