[r8-obfuscation] Keep runtime-owned JNI types - #12645
Conversation
314437c to
fb77ca1
Compare
fb77ca1 to
2f740b4
Compare
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
2f740b4 to
eb00af6
Compare
|
/review |
|
✅ Android PR Reviewer completed successfully! Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "azcliprod.blob.core.windows.net"See Network Configuration for more information.
|
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
The explicit runtime-owned keep rules and shared CoreCLR/NativeAOT JNI-name constants are coherent, and the generated-configuration tests cover both obfuscated and non-obfuscated paths. I left one inline testing suggestion to extend the native source audit to MonoVM so future runtime JNI additions cannot drift outside the explicit keep list.
CI is not green: Azure build 1580279 reports only MAUI Tests MAUI Integration failing, while the other dotnet/android lanes and CLA passed. Detailed Azure timeline logs were unavailable because the Azure CLI has no credentials in this runner, so I could not establish whether that lane is related to this change. The PR is also documented as depending on #12634.
Warning
Firewall blocked 1 domain
The following domain was blocked by the firewall during workflow execution:
azcliprod.blob.core.windows.net
To allow these domains, add them to the network.allowed list in your workflow frontmatter:
network:
allowed:
- defaults
- "azcliprod.blob.core.windows.net"See Network Configuration for more information.
Generated by Android PR Reviewer for #12645 · gpt56 · 384.8 AIC · ⌖ 8.92 AIC · ⊞ 25.7K
Comment /review to run again
| <Link>RuntimeJniAudit\Native\CoreCLR\%(RecursiveDir)%(Filename)%(Extension)</Link> | ||
| <CopyToOutputDirectory>PreserveNewest</CopyToOutputDirectory> | ||
| </Content> | ||
| <Content Include="$(XamarinAndroidSourcePath)src\native\nativeaot\**\*.cc"> |
There was a problem hiding this comment.
🤖 💡 Testing — Please include src/native/mono/monodroid/**/*.cc in this audit and scan it alongside CoreCLR and NativeAOT. MonoVM currently has the same SDK-owned runtime-field lookups (mono_android_IGCUserPeer, net_dot_jni_GCUserPeerable, and mono_android_GCUserPeer) in monodroid-glue.cc/osbridge.cc; because those sources are omitted here, a future Mono-only JNI name can bypass the explicit R8 keep-coverage test.
Rule: Missing regression coverage
1 participant
Related to #12535
Depends on #12634
This is layer 7 above the existing six-layer R8 JNI name-obfuscation stack. It centralizes the CoreCLR/NativeAOT-owned JNI names that native startup and pre-remapping runtime code consume, and replaces broad runtime namespace keeps with explicit audited coverage on the opt-in obfuscation path.
The rules protect runtime-owned bootstrap classes, interfaces, fields, constructors, and methods without pinning ordinary generated application peers, preserving the existing seed/final mapping and JNI rewriting flow.