Start with the installed build plugin
Record the Android Gradle Plugin, Gradle, Java and SDK versions used by the release job. Optimization configuration has evolved, so copying the newest documentation example into an older project may not work. Follow the official guide for the actual plugin version rather than forcing a universal snippet.
Check each shipping variant, including paid, enterprise or regional builds. A flag in one build type does not establish that the exported artifact uses it. Save the resolved release configuration and identify which keep-rule sources are contributed by the application and its dependencies.
Inventory indirect entry points
List reflection-based serializers, dependency injection, SDK callbacks, JNI functions and dynamically loaded components. Classify the exact types or members each mechanism requires. Start from an observed contract, not a broad instruction to preserve the entire application namespace.
For example, a serializer that discovers fields by name may need a narrower preservation rule than a plugin that instantiates classes from configuration. Write a fixture that exercises the actual mechanism and expected names. This makes the purpose of each exception understandable when a later dependency update changes the requirements.
Treat broad rules as review items
An entire-package keep rule may restore a failing build quickly while disabling much of the intended optimization. Keep the working baseline, then narrow that exception with targeted tests. Do not remove vendor-provided consumer rules merely because the output remains large. They may preserve a runtime contract invisible to your application code.
Review new warnings and removed-code reports in the context of reachable behavior. A successful compilation is insufficient if the first sign-in flow or background callback fails only after optimization. Include startup, deep links, persistence restoration and relevant SDK integrations in the release validation set.
Preserve diagnosis and signing order
Retain the exact mapping and build identity before cleanup. Test a representative obfuscated crash report with the matching mapping, then package and sign through the supported Android workflow. Avoid patching signed DEX or APK bytes after the fact.
CloneGuard can screen supported APK or AAB members and identify exposed debug resources. It does not generate semantic keep rules, verify DEX equivalence or certify device behavior. Document those toolchain checks separately. R8 name shortening also does not make all algorithms or UI workflows inaccessible to a reverse-engineering agent.
Use package-size and startup measurements only for the same variant and device conditions. Report any reconstruction experiment independently of optimization results, so reduced bytes or shorter class names are not presented as a measured REA failure.
Practical checklist
- Record exact release toolchain and variant.
- Inventory reflection, JNI and serialization contracts.
- Explain and test every broad keep exception.
- Retain mappings and validate the signed release.
Sources and further reading
Primary references support the technical details. Procedures here are guidance; only explicitly recorded project results describe tests we ran.
Prepared with AI assistance. How this library is produced. Suggest a correction; keep private code and credentials out of public issues.