Install Referrer Library v1.1 adds permissions

Question

Updating the Install Referrer Library from v1.0 to v1.1 added the following permissions:

WRITE_EXTERNAL_STORAGE

READ_EXTERNAL_STORAGE

READ_PHONE_STATE

Those permissions are not present in the Install Referrer Library manifest.xml:

<?xml version="1.0" encoding="utf-8"?>
<manifest xmlns:android="http://schemas.android.com/apk/res/android"
    package="com.android.installreferrer" >

    <uses-permission android:name="com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE" />

    <application />

</manifest>

Source: https://mvnrepository.com/artifact/com.android.installreferrer/installreferrer/1.1

Why those permissions added to the merged manifest?

Answer 1

Version 1.1 and 1.1.1 are missing "minSdkVersion". This would automatically add those permissions. See similar issue here: Google Play Services 12.0.1.

Solution

Version 1.1.2 solves this issue.

Details

Manifest.xml for v1.0 (from https://mvnrepository.com/artifact/com.android.installreferrer/installreferrer/1.0)

<?xml version="1.0" encoding="utf-8"?>
<manifest xmlns:android="http://schemas.android.com/apk/res/android" package="com.android.installreferrer" >

    <uses-sdk
        android:minSdkVersion="8"
        android:targetSdkVersion="22" />

    <uses-permission android:name="com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE" />

    <application />

</manifest>

Manifest.xml for v1.1 (from https://mvnrepository.com/artifact/com.android.installreferrer/installreferrer/1.1)

<?xml version="1.0" encoding="utf-8"?>
<manifest xmlns:android="http://schemas.android.com/apk/res/android" package="com.android.installreferrer">

    <uses-permission android:name="com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE" />

    <application />

</manifest>

Answer 2

This is because they have added a dependency to

com.google.android.gms:play-services-measurement:17.2.1

Which adds those permissions.

You can find it on the file: manifest-merger-blame-debug-report.txt which is under "yourApp/build/intermediates/manifest_merge_blame_file/debug

It's probably a bug. I currently just downgraded back to 1.0. But if you need this version you can add

<uses-permission android:name="<permission_name>" tools:node="remove" />

To disable it.
Know that if you'll use any API which needs it inside the library it could lead to a crash so i won't recommend doing so.