Add a ProGuard/R8 rule to keep the (shaded) Protobuf classes as-is.

GitHub issue: #361.

PiperOrigin-RevId: 313043816

java_src/BUILD.bazel

@@ -201,6 +201,9 @@ gen_maven_jar_rules(
 gen_maven_jar_rules(
     name = "tink-android",
     doctitle = "Tink Cryptography API for Android",
+    resources = glob([
+        "src/main/resources/**",
+    ]),
     root_packages = [
         "com.google.crypto.tink",
         # The following package(s) will be shaded by the "tink-android-shaded" target.

java_src/jar_jar_rules.txt

@@ -1,2 +1,6 @@
 # Rules File Format: https://github.com/bazelbuild/bazel/blob/master/third_party/jarjar/java/com/tonicsystems/jarjar/help.txt.
+#
+# Shade protobuf to avoid dependency version conflicts in user projects.
+# WARNING: the shaded package name com.google.crypto.tink.shaded.protobuf must
+# be kept in sync with src/main/resources/META-INF/proguard/tink.pro.
 rule com.google.protobuf.** com.google.crypto.tink.shaded.protobuf.@1

java_src/src/main/resources/META-INF/proguard/protobuf.pro

@@ -0,0 +1,14 @@
+# Recently Protobuf Javalite introduced a change that relies on reflection,
+# which doesn't work with Proguard. This rule keeps the reflection usages in
+# (shaded) Protobuf classes in Tink as-is.
+# The location of this file is determined by
+# - https://developer.android.com/studio/build/shrink-code#configuration-files
+# - https://docs.bazel.build/versions/master/be/java.html#java_library.resources
+# See also:
+# - https://github.com/google/tink/issues/361
+# - https://github.com/protocolbuffers/protobuf/issues/6463
+# WARNING: the shaded package name com.google.crypto.tink.shaded.protobuf must
+# be kept in sync with jar_jar_rules.txt.
+-keepclassmembers class * extends com.google.crypto.tink.shaded.protobuf.GeneratedMessageLite {
+  <fields>;
+}

java_src/tools/gen_maven_jar_rules.bzl

@@ -27,6 +27,7 @@ _TINK_PACKAGES = [
 def gen_maven_jar_rules(
         name,
         deps = [],
+        resources = [],
         root_packages = _TINK_PACKAGES,
         exclude_packages = [],
         doctitle = "",
@@ -41,6 +42,9 @@ def gen_maven_jar_rules(
         name.jar, a source package name-src.jar and a Javadoc package
         name-javadoc.jar.
       deps: A combination of the deps of java_single_jar and javadoc_library
+      resources: A list of resource files. Files must be stored in
+        src/main/resources. Mapping rules: src/main/resources/a/b/c.txt will be
+        copied to a/b/c.txt in the output jar.
       root_packages: See javadoc_library
       exclude_packages: See javadoc_library
       doctitle: See javadoc_library
@@ -52,6 +56,7 @@ def gen_maven_jar_rules(
     java_single_jar(
         name = name,
         deps = deps,
+        resources = resources,
         root_packages = root_packages,
     )
 

java_src/tools/java_single_jar.bzl

@@ -37,6 +37,18 @@ def _java_single_jar(ctx):
     args.add("--output", ctx.outputs.jar)
     args.add("--normalize")
 
+    resource_files = depset(
+        transitive = [resource.files for resource in ctx.attr.resources],
+    ).to_list()
+    args.add("--resources")
+    for resource_file in resource_files:
+        if not resource_file.path.startswith("src/main/resources"):
+            fail("resource %s must be stored in src/main/resources/" % resource_file.path)
+        relative_path = resource_file.path.replace("src/main/resources/", "")
+
+        # Map src/main/resources/a/b/c.txt to a/b/c.txt.
+        args.add(resource_file.path, format = "%s:" + relative_path)
+
     # Maybe compress code.
     if not ctx.attr.source_jar:
         # Deal with limitation of singlejar flags: tool's default behavior is
@@ -55,7 +67,7 @@ def _java_single_jar(ctx):
         args.add("--include_prefixes", p.replace(".", "/"))
 
     ctx.actions.run(
-        inputs = inputs,
+        inputs = inputs.to_list() + resource_files,
         outputs = [ctx.outputs.jar],
         arguments = [args],
         progress_message = "Merging into %s" % ctx.outputs.jar.short_path,
@@ -66,6 +78,10 @@ def _java_single_jar(ctx):
 java_single_jar = rule(
     attrs = {
         "deps": attr.label_list(providers = [JavaInfo]),
+        "resources": attr.label_list(
+            providers = [JavaInfo],
+            allow_files = True,
+        ),
         "_singlejar": attr.label(
             default = Label("@bazel_tools//tools/jdk:singlejar"),
             cfg = "host",
@@ -89,6 +105,9 @@ Args:
       exports) and runtime dependencies (runtime_deps) are collected.
       Resources are also collected. Native cc_library or java_wrap_cc
       dependencies are not.
+  resources: A combination of resource files. Files must be stored in
+      src/main/resources. Mapping rules: src/main/resources/a/b/c.txt will be
+      copied to a/b/c.txt in the output jar.
   compress: Whether to always deflate ("yes"), always store ("no"), or pass
       through unmodified ("preserve"). The default is "preserve", and is the
       most efficient option -- no extra work is done to inflate or deflate.