ProGuard: duplicate definition of library class?

Question

I run my ProGuard for my Android project and get the following warnings:

Note: duplicate definition of library class [org.apache.http.conn.scheme.HostNameResolver]
Note: duplicate definition of library class [org.apache.http.conn.scheme.SocketFactory]
Note: duplicate definition of library class [org.apache.http.conn.ConnectTimeoutException]
Note: duplicate definition of library class [org.apache.http.params.HttpParams]
Note: duplicate definition of library class [android.net.http.SslCertificate$DName]
Note: duplicate definition of library class [android.net.http.SslError]
Note: duplicate definition of library class [android.net.http.SslCertificate]

Note: there were 7 duplicate class definitions.

I found here to fix this with ignoring it with:

-keep class org.apache.http.** { *; }
-dontwarn org.apache.http.**
-keep class android.net.http.** { *; }
-dontwarn android.net.http.**

I do not see a way to remove the duplicates from the used libraries. Even after using dontwarn the warnings do not vanish.

Is this the right way of handling this warning in just ignoring it or could this lead to problems?

Answer 1

Probably, you have mentioned "-injars" and -libraryjars" in your proguard-project.txt,considering the latest build system takes care of mentioning them for you ..so you dont need to mention it again.

source: http://proguard.sourceforge.net/manual/troubleshooting.html#duplicateclass

I think this will help.:)

Answer 2

If you add a proguard option -printconfiguration config.txt you'll see proguard adds

-libraryjars 'D:\tools\android\platforms\android-23\android.jar'

-libraryjars 'D:\tools\android\platforms\android-23\optional\org.apache.http.legacy.jar'

your duplicated classes (e.g. SslError) are presented in both android.jar and org.apache.http.legacy.jar

Proguard adds second jar even if you don't useLibrary 'org.apache.http.legacy' Here is an open bug describing the problem.

So now we can't do anything with the issue. Just ignore it:

-dontnote android.net.http.*
-dontnote org.apache.commons.codec.**
-dontnote org.apache.http.**

There is no need to keep the classes as long as they are located in library jar (phone's library actually). dontwarn doesn't work because it's not a warning, it's a note.

Answer 3

You can tell gradle not to allow duplicate classes (take only the first) by adding the following to your build.gradle:

jar {
    duplicatesStrategy = DuplicatesStrategy.EXCLUDE
}

Answer 4

You can try this in your build.gradle for everything that is indicated as duplicate in the logs. I am not sure if this will work, so try it out and inform if it works or not.

packagingOptions {
        exclude 'android.net.http.SslCertificate'
    }