It seems that KotlinX serialization doesn't work well when it comes to obfuscation. Has anyone found...

# serialization

[rkeazor]

It seems that KotlinX serialization doesn't work well when it comes to obfuscation. Has anyone found a resolve to that?

[Tomasz Krakowiak]

What tool are you using for obfuscation? What target(JS/JVM/...)?

[rkeazor]

jvm , dexguard

[rkeazor]

@Tomasz Krakowiak

[rkeazor]

jvm, android

[leandro]

How does your proguard rules that concern kotlinx.serialization look like?

[Tomasz Krakowiak]

Have you tried proguard rules for kotlinx.serialization from their README.md? https://github.com/Kotlin/kotlinx.serialization

[rkeazor]

We used the ones that are written in the documentation , however they are preventing json model classes and generated serialization classes from being obfuscated

[rkeazor]

-keepattributes *Annotation*, InnerClasses
-dontnote kotlinx.serialization.AnnotationsKt # core serialization annotations

# kotlinx-serialization-json specific. Add this if you have java.lang.NoClassDefFoundError kotlinx.serialization.json.JsonObjectSerializer
-keepclassmembers class kotlinx.serialization.json.** {
    *** Companion;
}
-keepclasseswithmembers class kotlinx.serialization.json.** {
    kotlinx.serialization.KSerializer serializer(...);
}

# Change here com.yourcompany.yourpackage
-keep,includedescriptorclasses class com.yourcompany.yourpackage.**$$serializer { *; } # <-- change package name to your app's
-keepclassmembers class com.yourcompany.yourpackage.** { # <-- change package name to your app's
    *** Companion;
}
-keepclasseswithmembers class com.yourcompany.yourpackage.** { # <-- change package name to your app's
    kotlinx.serialization.KSerializer serializer(...);
}

[Tomasz Krakowiak]

I looked into kotlinx.serialization source to understand why those proguard rules are required. I think it's possible, but not trivial to fix it on library and compiler level. If you don't like the challenge, you can try to implement serializer, that wouldn't require reflection lookup. It may work, but no guarantees. You might also reconsider obfuscating model classes, generated serializer implementation contain names of classes and fields which with some additional effort could be extracted from obfuscated code.

[rkeazor]

@Tomasz Krakowiak im not sure I follow what you mean : "lementation contain names of classes and fields which with some additional effort could be extracted from obfuscated code"