ProGuard Consumer Rules

How ProGuard consumer rules shape code shrinking

ProGuard consumer rules matter because they let a library publish the parts of its API surface that must survive optimisation. That is especially important for public entry points, callback interfaces, reflection targets, and serialised model types, where aggressive shrinking can break runtime behaviour even when the code still compiles.

Why they exist in library distribution

Consumer rules are a downstream contract, not just a build-time convenience. A library can ship rules that tell app builds which symbols must remain stable so the library keeps working after minification, class merging, or dead-code elimination. That makes them part of the library’s compatibility story, especially when the implementation relies on names or members that ordinary static analysis cannot see as necessary.

This is why consumer rules are common in SDKs, Android libraries, and frameworks that depend on reflection, annotations, generated code, or deserialisation. They help preserve the intended public behaviour of the library while still allowing the consuming application to optimise everything else.

What consumer rules protect from breakage

The main failure mode is accidental removal or renaming of something that is not obviously used by direct code references. Reflection-heavy code can fail when class names change, serializers can stop finding fields or constructors, and callback-based integrations can fail when interfaces or methods are stripped. The build may succeed, but the runtime contract is silently damaged.

Consumer rules do not make code inherently safer, they make optimisation more compatible with dynamic usage patterns. In practice, they are a way to describe hidden dependencies that the compiler and shrinker cannot infer reliably on their own.

How to read them in a build pipeline

Consumer rules should be treated as part of the library’s published interface, alongside its API documentation and versioning promises. Consumers inherit them automatically, so a library team needs to keep them accurate, minimal, and aligned with actual runtime requirements. Overly broad rules reduce shrinking effectiveness, while under-specified rules create hard-to-diagnose breakage.

For teams reviewing a dependency, the practical question is whether the rules are narrow enough to preserve only the necessary surface. The safest posture is to review the library’s published guidance, inspect the rules that ship with the artifact, and test the application under the same optimisation settings used in production.

Risk and Threat Considerations

Consumer rules can create security and reliability risk when they preserve more surface than intended or when they fail to protect behaviour that depends on hidden entry points. Broad keep rules can leave extra classes, methods, or metadata available after shrinking, while missing keep rules can break security-sensitive flows that rely on reflection, configuration binding, or serialised state.

Failure mechanism: The optimiser either removes something the runtime still needs, or retains more than necessary because the rule is too permissive. Both outcomes can create operational instability, and in some cases they can weaken the intended reduction of exposed code paths.

Impact: Broken deserialisation, failed callbacks, missing permissions checks, or unexpectedly exposed implementation details can surface after deployment, often only under specific runtime conditions or on a new version of the app.

Practitioner Guidance

What to watch for: Treat consumer rules as a compatibility artefact that must be tested, not assumed correct because the build passes. Pay special attention to reflection, generated code, serializers, and any library that exposes annotations or callback-based extensibility.

Governance implication: Library owners should keep consumer rules as precise as possible and review them whenever the public API changes. A good rule set preserves runtime contracts without becoming a blanket exemption from optimisation.

Practitioner takeaway: If a library depends on names or members that static analysis cannot prove are used, its consumer rules are part of its security and reliability boundary, not just build metadata.

Related resources from NHI Mgmt Group

• How should regulators phase in crypto rules without creating gaps between financial integrity, consumer protection, and market integrity?
• Why do Malaysian crypto firms face higher operational risk when licensing, consumer protection, and AML rules are still evolving?
• What happens when API gateway configurations rely on consumer-level rules instead of shared group policies?
• What happens when regulators give crypto firms clearer rules while still keeping strong consumer-protection guardrails?