{"action":"created","issue":{"url":"https://api.github.com/repos/paypal/PayPal-Android-SDK/issues/234","labels_url":"https://api.github.com/repos/paypal/PayPal-Android-SDK/issues/234/labels{/name}","comments_url":"https://api.github.com/repos/paypal/PayPal-Android-SDK/issues/234/comments","events_url":"https://api.github.com/repos/paypal/PayPal-Android-SDK/issues/234/events","html_url":"https://github.com/paypal/PayPal-Android-SDK/issues/234","id":125022815,"number":234,"title":"PayPal 2.12.4 aar adds unwanted permission and code","user":{"login":"cyrilmottier","id":92794,"avatar_url":"https://avatars.githubusercontent.com/u/92794?v=3","gravatar_id":"","url":"https://api.github.com/users/cyrilmottier","html_url":"https://github.com/cyrilmottier","followers_url":"https://api.github.com/users/cyrilmottier/followers","following_url":"https://api.github.com/users/cyrilmottier/following{/other_user}","gists_url":"https://api.github.com/users/cyrilmottier/gists{/gist_id}","starred_url":"https://api.github.com/users/cyrilmottier/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cyrilmottier/subscriptions","organizations_url":"https://api.github.com/users/cyrilmottier/orgs","repos_url":"https://api.github.com/users/cyrilmottier/repos","events_url":"https://api.github.com/users/cyrilmottier/events{/privacy}","received_events_url":"https://api.github.com/users/cyrilmottier/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2016-01-05T18:23:36Z","updated_at":"2016-01-11T17:54:02Z","closed_at":null,"body":"When looking at the dependencies of the library we get:\r\n\r\n```\r\n+--- com.paypal.sdk:paypal-android-sdk:2.12.4\r\n|    +--- com.squareup.okhttp:okhttp:2.5.0 -> 2.7.1\r\n|    |    \\--- com.squareup.okio:okio:1.6.0\r\n|    \\--- io.card:android-sdk:5.1.2\r\n```\r\n\r\nIn other words:\r\n  * OkHttp is not up-to-date (but that's not the issue)\r\n  * Card.IO is *always* imported which means bundling code that may not be used at all.\r\n\r\nThis is pretty annoying when we want to have the most light-weight APK possible.\r\n\r\nThings gets worse when looking at the AndroidManifest.xml. It includes the `CAMERA` permission which may not be useful at all if Card.IO `.so` are stripped. That's also the case for the `CardIOActivity` and the `<uses-feature />` tags.\r\n\r\nIt's obviously possible to add `tools:remove` to our `AndroidManifest.xml` but that's clearly a dirty hack. Hence, the current version of the library is not usable as it and can't be used in production code.\r\n\r\nA possible solution would be to have a dedicated Maven artefact like `com.paypal.sdk:paypal-android-sdk-no-card-io:2.12.4` that wouldn't include the Card.IO dependency."},"comment":{"url":"https://api.github.com/repos/paypal/PayPal-Android-SDK/issues/comments/170633598","html_url":"https://github.com/paypal/PayPal-Android-SDK/issues/234#issuecomment-170633598","issue_url":"https://api.github.com/repos/paypal/PayPal-Android-SDK/issues/234","id":170633598,"user":{"login":"jaypatel512","id":1309895,"avatar_url":"https://avatars.githubusercontent.com/u/1309895?v=3","gravatar_id":"","url":"https://api.github.com/users/jaypatel512","html_url":"https://github.com/jaypatel512","followers_url":"https://api.github.com/users/jaypatel512/followers","following_url":"https://api.github.com/users/jaypatel512/following{/other_user}","gists_url":"https://api.github.com/users/jaypatel512/gists{/gist_id}","starred_url":"https://api.github.com/users/jaypatel512/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jaypatel512/subscriptions","organizations_url":"https://api.github.com/users/jaypatel512/orgs","repos_url":"https://api.github.com/users/jaypatel512/repos","events_url":"https://api.github.com/users/jaypatel512/events{/privacy}","received_events_url":"https://api.github.com/users/jaypatel512/received_events","type":"User","site_admin":false},"created_at":"2016-01-11T17:54:02Z","updated_at":"2016-01-11T17:54:02Z","body":"Hey @cyrilmottier !\r\n\r\nYou are correct. I will go ahead and update the okhttp first. And about the card-io, currently, the only way to exclude card-io is to exclude libraries as shown here: https://github.com/paypal/PayPal-Android-SDK/issues/226 !\r\n\r\nHowever, we are working on getting the dependency from card-io completely, to remove that completely, but this may take some time though. I will keep you update on this."}}