Resource exclusion pattern `org/` silently strips resources from all `org.*` library packages

[yutongwong]

Resource exclusion pattern org/ silently strips resources from all org.* library packages

Severity: High
File: app/build.gradle.kts:413

The packaging resources exclusion block contains:

resources {
    excludes += "META-INF/"
    excludes += "kotlin/"
    excludes += "org/"
    excludes += ".properties"
}

The "org/" pattern is a prefix match against the resource path inside any dependency JAR/AAR. Any library that ships resources under org/ (e.g. org/apache/, org/xmlpull/, org/bouncycastle/ resource files, org/intellij/lang/annotations/) will have those resources silently stripped from the APK.

Why it matters

This is an overly broad exclusion that can cause runtime ClassNotFoundException, FileNotFoundException, or missing-resource crashes in any library whose resources live under org/. If the intent is to exclude only a specific package (e.g. BouncyCastle's pre-computed tables already handled at line 418), the pattern should be narrowed to the specific path like org/bouncycastle/ rather than the entire org/ tree. The same concern applies to the .properties substring match on line 414, which will exclude any file ending in .properties from any dependency — not just META-INF.

[wangzhishou]

Confirmed, and the giveaway is line 420:

excludes += "org/"                      // 415 — strips the entire org.* tree
...
excludes += "org/bouncycastle/pqc/**"   // 420 — already a no-op

So the BouncyCastle PQC exclusion that someone wrote on purpose is currently dead code, because org/ above it already removed the whole tree. That tells me the intent was always a narrow exclusion, and org/ is broader than whoever added it realised. Same story for .properties on line 416 — a bare substring match rather than META-INF/*.properties, so it catches any dependency resource that happens to end in .properties.

Agreed on the fix, which is what you proposed:

• drop org/, keep the explicit org/bouncycastle/pqc/**
• narrow or delete .properties (the META-INF/ line above already covers the case it was probably added for)

The reason I am not editing it blind: org/ has been in the tree since the upstream fork, so removing it pulls resources back into the APK that have not shipped in a long time. Most likely fine, but it wants a real build plus a smoke test on the modules that actually use org.* — not a drive-by one-liner.

Labelled bug, queued for the next release cycle.