common:24.7.0 consumer ProGuard rule prevents R8 from obfuscating any com.microsoft.identity.* class app-wide, poisoning renaming for all consuming app code

[RevakoOA]

The consumer proguard.txt bundled in common:24.7.0 keeps every com.microsoft.identity.** class without allowobfuscation, which — because R8 must rename all overrides of a virtual method identically across the whole app — blocks obfuscation of unrelated app code (e.g. every Kotlin coroutine continuation class) that merely shares a base type with an MSAL/common class.

This blocks all my app domain logic from being obfuscated because I heavily rely on coroutines, and so domain classes have the same continuation methods.

Similar issue: #1157.

File location for me ~/.gradle/caches/9.7.1/transforms/215c65c7ecaf375ea055fa1f2de7db9f/transformed/common-24.7.0/proguard.txt.
NOTE: part 215c65c7ecaf375ea055fa1f2de7db9f will differ on other machines.
Proguard file below:

# Add project specific ProGuard rules here.
# By default, the flags in this file are appended to flags specified
# in C:\Program Files\Android\android-sdk/tools/proguard/proguard-android.txt
# You can edit the include path and order by changing the proguardFiles
# directive in build.gradle.
#
# For more details, see
#   http://developer.android.com/guide/developing/tools/proguard.html

# Add any project specific keep options here:

# If your project uses WebView with JS, uncomment the following
# and specify the fully qualified class name to the JavaScript interface
# class:
#-keepclassmembers class fqcn.of.javascript.interface.for.webview {
#   public *;
#}

##---------------Begin: proguard configuration for Common  --------
# keep with optmizations and shrinking, but do not obfuscate
-keep,allowoptimization,allowshrinking class !com.microsoft.identity.common.java.nativeauth.**, !com.microsoft.identity.common.nativeauth.**, com.microsoft.identity.** { *; }
-keep class * extends com.microsoft.identity.common.java.authorities.Authority { *; }
-keep class * extends com.microsoft.identity.common.java.authorities.AzureActiveDirectoryAudience { *; }
-keep class * extends com.microsoft.identity.common.java.cache.ICacheRecord { *; }
-keep class * extends com.microsoft.identity.common.java.cache.ITokenCacheItem { *; }
-keep class * extends com.microsoft.identity.common.java.authscheme.AbstractAuthenticationScheme { *; }
-keep class com.microsoft.identity.common.internal.broker.AuthUxJsonPayload { *; }
-keep class * extends com.microsoft.identity.deviceregistration.java.protocol.IDeviceRegistrationProtocol { *; }
-keep class * extends com.microsoft.identity.deviceregistration.java.api.IDeviceRegistrationRecord { *; }

# Keep WebView JS bridge methods annotated with @JavascriptInterface
-keepclassmembers class com.microsoft.identity.** {
    @android.webkit.JavascriptInterface <methods>;
}

#For Android Credential Manager: https://developer.android.com/training/sign-in/passkeys#proguard
-if class androidx.credentials.CredentialManager
-keep class androidx.credentials.playservices.** {
  *;
}

# Runtime annotations
-keep class net.jcip.annotations.GuardedBy
-keep class net.jcip.annotations.Immutable
-keep class net.jcip.annotations.ThreadSafe

# Compile time annotations
-dontwarn edu.umd.cs.findbugs.annotations.NonNull
-dontwarn edu.umd.cs.findbugs.annotations.Nullable
-dontwarn edu.umd.cs.findbugs.annotations.SuppressFBWarnings

-keepattributes SourceFile,LineNumberTable

##---------------Begin: proguard configuration for Nimbus  ----------
# Intentionally blank, left to consumers of common to implement.

##---------------Begin: proguard configuration for Lombok  ----------
-dontwarn lombok.**

##---------------Begin: proguard configuration for Gson  --------
# Gson uses generic type information stored in a class file when working with fields. Proguard
# removes such information by default, so configure it to keep all of it.
-keepattributes Signature,SourceFile,LineNumberTable

# For using GSON @Expose annotation
-keepattributes *Annotation*

# Gson specific classes
-dontwarn sun.misc.**
#-keep class com.google.gson.stream.** { *; }

# Prevent proguard from stripping interface information from TypeAdapter, TypeAdapterFactory,
# JsonSerializer, JsonDeserializer instances (so they can be used in @JsonAdapter)
-keep class * extends com.google.gson.TypeAdapter
-keep class * implements com.google.gson.TypeAdapterFactory
-keep class * implements com.google.gson.JsonSerializer
-keep class * implements com.google.gson.JsonDeserializer
-keep class com.google.gson.reflect.TypeToken { *; }
-keep class * extends com.google.gson.reflect.TypeToken { *; }

# Prevent R8 from leaving Data object members always null
-keepclassmembers class com.microsoft.identity.** {
  @com.google.gson.annotations.SerializedName <fields>;
  @com.squareup.moshi.Json <fields>;
}

## Other
# Compile time annotation
-dontwarn com.google.auto.value.AutoValue$CopyAnnotations
-dontwarn com.google.auto.value.AutoValue
-dontwarn com.google.auto.value.extension.memoized.Memoized

[github-actions]

Thank you for opening this issue!

Labels Applied:
Other: .
needs-more-info: .

To help us assist you, please provide:

• MSAL version (latest: 8.5.0)
• Android version and device
• Complete error message/stack trace
• Steps to reproduce

---

Need help? Comment with:

PING-COPILOT: <your question>

Privacy: Do not include credentials, tokens, or PII in PING-COPILOT requests.

[RevakoOA]

MSAL version: 8.5.0 (com.microsoft.identity.client:msal:8.5.0), which transitively pulls in com.microsoft.identity:common:24.7.0 — that's where the offending rule now lives (it used to be bundled directly in msal's own proguard.txt prior to this version; see #1157/#1161 for the precedent).

Android version and device: Not applicable — this isn't a runtime bug tied to any OS version or device. It's a static R8/ProGuard build-time issue: the bundled consumer proguard rules keep the wrong classes during the release/minified build, before the app ever runs. It reproduces identically on any device, or with no device at all — it's visible directly in the build's mapping.txt / configuration.txt.

Build tooling for reference: AGP 9.2.1, Kotlin 2.2.10, Gradle 9.7.1, kotlinx.coroutines 1.11.0.

Complete error message/stack trace: There is no exception or crash. The evidence is R8's -whyareyoukeeping keep-rule trace, which shows why an unrelated app class is being kept/renamed-consistently because of this rule:

com.sample.data.repository.AgreementRepositoryImpl
|- is referenced from:
| void com.sample.data.repository.AgreementRepositoryImpl$signAgreement$2.(com.sample.data.repository.AgreementRepositoryImpl,java.lang.String,java.lang.String,java.lang.String,java.lang.String,kotlin.coroutines.Continuation)
|- is invoked from:
| kotlin.coroutines.Continuation com.sample.data.repository.AgreementRepositoryImpl$signAgreement$2.create(java.lang.Object,kotlin.coroutines.Continuation)
|- is overriding method:
| kotlin.coroutines.Continuation kotlin.coroutines.jvm.internal.BaseContinuationImpl.create(java.lang.Object,kotlin.coroutines.Continuation)
|- is referenced in keep rule:
| common-24.7.0/proguard.txt

The class named above (AgreementRepositoryImpl$signAgreement$2, one of my app's own Kotlin coroutine continuation classes) has nothing to do with MSAL — it's kept only because it overrides BaseContinuationImpl.create(), and R8 must rename all overrides of a shared virtual method consistently across the whole program, or not at all. Since common's rule keeps some class in that same override family (via the blanket com.microsoft.identity.** keep), R8 can't safely rename any class in that family — including mine.

The rule itself, extracted from the bundled consumer proguard.txt inside the published common-24.7.0 AAR (~/.gradle/caches/9.7.1/transforms//transformed/common-24.7.0/proguard.txt, merged into my app's R8 configuration under the section header # The proguard configuration file for the following section is com.microsoft.identity:common:24.7.0):

# keep with optmizations and shrinking, but do not obfuscate
-keep,allowoptimization,allowshrinking class !com.microsoft.identity.common.java.nativeauth.**, !com.microsoft.identity.common.nativeauth.**, com.microsoft.identity.** { *; }

Steps to reproduce:

1. Create (or take) a minimal Android app with minifyEnabled true and R8 enabled for the release/stage build.
2. Add a dependency on com.microsoft.identity.client:msal:8.5.0 (or just com.microsoft.identity:common:24.7.0 directly, since that's where the rule actually lives).
3. Add any Kotlin suspend fun anywhere in the app, in any class unrelated to MSAL — the Kotlin compiler generates a continuation class extending kotlin.coroutines.jvm.internal.BaseContinuationImpl for it.
4. Build the minified variant, then run R8 with a temporary -whyareyoukeeping class <your.package.YourClass$suspendFun$1> rule (or ./gradlew :app:minifyReleaseWithR8 --info).
5. Observe the trace above: the class is kept, tracing back to the common-24.7.0/proguard.txt rule quoted here — not to anything in the app's own proguard rules.
6. For blast-radius confirmation: compare class-rename rates across mapping.txt for packages that never touch MSAL vs. packages that do. In my app, packages with no MSAL-adjacent inheritance (data/domain layers) show only 0.5–1.0% of classes renamed, vs. 17–31% in layers with no such dependency — the difference tracks almost exactly with whether R8 can freely rename that virtual-method family.

Impact: Because BaseContinuationImpl is extended by essentially every Kotlin coroutine continuation class the Kotlin compiler generates app-wide, this single blanket rule suppresses obfuscation for a large fraction of an app's own code — not just MSAL/common code — whenever minifyEnabled + coroutines + this dependency are combined. It's the same class of problem already fixed once for msal itself in #1157/#1161; the fix just needs to be reapplied here now that the rule has moved into common.

Suggested fix: Add allowobfuscation to the rule (matching the pattern already used for the msal module's own rules post-#1161), i.e.:

-keep,allowobfuscation,allowoptimization,allowshrinking class !com.microsoft.identity.common.java.nativeauth., !com.microsoft.identity.common.nativeauth., com.microsoft.identity.** { *; }