`NoClassDefFoundError` for FingerprintJS classes when using freeRASP 17.0.0-NO_DB with ProGuard/R8

[YMonnier]

Problem

When using freeRASP-Community version 17.0.0-NO_DB with ProGuard/R8 minification enabled in a release build, the app crashes at startup with a NoClassDefFoundError for FingerprintJS classes.

Crash Log

Fatal Exception: java.lang.NoClassDefFoundError: Failed resolution of: Lcom/fingerprintjs/android/fingerprint/FingerprinterFactory;
    at com.aheaditec.talsec.security.e0.a(SourceFile:1)
    at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1154)
    at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:652)
    at java.lang.Thread.run(Thread.java:1563)

Caused by java.lang.ClassNotFoundException: com.fingerprintjs.android.fingerprint.FingerprinterFactory
    at com.aheaditec.talsec.security.e0.a(SourceFile:1)
    at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1154)
    at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:652)
    at java.lang.Thread.run(Thread.java:1563)

Environment

• freeRASP Version: 17.0.0-NO_DB
• Build Configuration: Release build with ProGuard/R8 minification enabled
• Dependency Declaration:

  implementation("com.aheaditec.talsec.security:TalsecSecurity-Community:17.0.0-NO_DB")

Attempted Workarounds

I've added the following ProGuard rules to prevent stripping of FingerprintJS and TrueTime classes:

# Talsec & FingerprintJS
-keep class com.aheaditec.talsec.security.** { *; }
-keep class com.fingerprintjs.android.fingerprint.** { *; }
-keep class com.instacart.truetime.** { *; }

# Keep all members to prevent stripping
-keepclassmembers class com.fingerprintjs.android.fingerprint.** { *; }
-keepclassmembers class com.instacart.truetime.** { *; }

-dontwarn com.fingerprintjs.android.fingerprint.**
-dontwarn com.instacart.truetime.**

Result: The crash persists even with these rules, suggesting the FingerprintJS library is completely missing from the classpath rather than being stripped by R8.

Additional Context

The crash occurs consistently in release builds but not in debug builds (where minification is disabled).

[SirionRazzer]

Hi @YMonnier ,
Thank you for bringing this to our attention; we’ll take a look. Could you please double-check and share any build techniques or settings (e.g., plugins) that might be interfering with the release build?
Kind Regards,
Tomas Soukal, Talsec Team

[YMonnier]

Hi @SirionRazzer ,

Thank you for your quick response. Here are the build configurations and settings for our release builds:

Build Configuration

Gradle Version: 9.2.1
Android Gradle Plugin: 8.10.0
Kotlin Version: 2.2.20

ProGuard/R8 Configuration

We have minification enabled for release builds:

buildTypes {
    release {
        minifyEnabled = true
        proguardFiles(
            getDefaultProguardFile("proguard-android-optimize.txt"),
            "proguard-rules.pro"
        )
    }
}

Current ProGuard Rules

Our proguard-rules.pro includes:

# Talsec & FingerprintJS
-keep class com.aheaditec.talsec.security.** { *; }
-keep class com.fingerprintjs.android.fingerprint.** { *; }
-keep class com.instacart.truetime.** { *; }

-keepclassmembers class com.fingerprintjs.android.fingerprint.** { *; }
-keepclassmembers class com.instacart.truetime.** { *; }

-dontwarn com.fingerprintjs.android.fingerprint.**
-dontwarn com.instacart.truetime.**

Observations

We did not introduce any other libraries between the integration of freeRASP 16.0.1-NO_DB and 17.0.0-NO_DB.

[Tomaandr]

Hello @YMonnier,

we tested version 17.0.0-NO_DB on a clean sample app in release mode (with minification and ProGuard/R8 enabled) and wasn’t able to reproduce the issue. When checking mapping.txt, I can see that FingerprinterFactory is not removed but correctly obfuscated:

com.fingerprintjs.android.fingerprint.FingerprinterFactory -> b4.g:
# {"id":"sourceFile","fileName":"FingerprinterFactory.kt"}
    int $r8$clinit -> a
      # {"id":"com.android.tools.r8.synthesized"}
    1:6:void <clinit>():38:38 -> <clinit>
com.fingerprintjs.android.fingerprint.FingerprinterFactory$createAndroidIdProvider$1 -> b4.e:
# {"id":"sourceFile","fileName":"FingerprinterFactory.kt"}
    int b4.FingerprinterFactory$createAndroidIdProvider$1.$r8$classId -> e
      # {"id":"com.android.tools.r8.synthesized"}
    android.content.Context $context -> f
      # {"id":"com.android.tools.r8.residualsignature","signature":"Lapp/talsec/raspnodb/MainActivity;"}
    1:9:void b4.FingerprinterFactory$createAndroidIdProvider$1.<init>(app.talsec.raspnodb.MainActivity,int):0:0 -> <init>
      # {"id":"com.android.tools.r8.synthesized"}
    15:22:android.content.ContentResolver com.fingerprintjs.android.fingerprint.FingerprinterFactory$createSettingsDataSource$1.invoke():229:229 -> a
    15:22:java.lang.Object com.fingerprintjs.android.fingerprint.FingerprinterFactory$createSettingsDataSource$1.invoke():229 -> a
    23:36:android.hardware.SensorManager com.fingerprintjs.android.fingerprint.FingerprinterFactory$createSensorDataSource$1.invoke():217:217 -> a
...

Could you please check the contents of your mapping.txt from the release build and confirm whether
com.fingerprintjs.android.fingerprint.FingerprinterFactory appears there (obfuscated or not)? You can also print all applied rules by adding:

-printconfiguration configuration.txt

to your proguard-rules.pro. If you’d like, you can send us your mapping.txt and configuration.txt and we can analyze them.

Kind Regards,
Talsec Team