App was rejected on Huawei AppGallery. Huawei detected that our App obtained ANDROID_ID during initialization

[Jeijie]

When our application was audited in Huawei's application market, it was detected that the Android ID was obtained during application initialization and was rejected. The following is the log information provided：

尊敬的开发者，您好！您的应用在用户同意隐私政策前申请获取用户的ANDROID ID个人信息，具体请参考如下调用栈定位，感谢您的支持！
"stackTrace":["com.microsoft.codepush.react.CodePushNativeModule.(CodePushNativeModule.java:58)","com.microsoft.codepush.react.CodePush.createNativeModules(CodePush.java:377)","com.facebook.react.ReactPackageHelper.getNativeModuleIterator(ReactPackageHelper.java:42)","com.facebook.react.NativeModuleRegistryBuilder.processPackage(NativeModuleRegistryBuilder.java:41)","com.facebook.react.ReactInstanceManager.processPackage(ReactInstanceManager.java:1212)","com.facebook.react.ReactInstanceManager.processPackages(ReactInstanceManager.java:1182)","com.facebook.react.ReactInstanceManager.createReactContext(ReactInstanceManager.java:1120)","com.facebook.react.ReactInstanceManager.access$900(ReactInstanceManager.java:123)","com.facebook.react.ReactInstanceManager$5.run(ReactInstanceManager.java:943)","java.lang.Thread.run(Thread.java:933)"]

Actual Behavior

Environment

"react-native-code-push": "^5.6.0"
React Native Environment Info:
System:
OS: macOS 11.2.3
CPU: (8) x64 Intel(R) Core(TM) i5-8279U CPU @ 2.40GHz
Memory: 188.14 MB / 8.00 GB
Shell: 5.8 - /bin/zsh
Binaries:
Node: 12.6.0 - ~/.nvm/versions/node/v12.6.0/bin/node
Yarn: 1.22.19 - ~/.nvm/versions/node/v12.6.0/bin/yarn
npm: 6.9.0 - ~/.nvm/versions/node/v12.6.0/bin/npm
Watchman: 4.9.0 - /usr/local/bin/watchman
SDKs:
iOS SDK:
Platforms: iOS 14.5, DriverKit 20.4, macOS 11.3, tvOS 14.5, watchOS 7.4
Android SDK:
API Levels: 22, 23, 25, 26, 27, 28, 29, 30
Build Tools: 23.0.1, 23.0.3, 26.0.3, 27.0.3, 28.0.1, 28.0.3, 29.0.2, 29.0.3, 30.0.2
System Images: android-23 | Android TV ARM EABI v7a, android-23 | Android TV Intel x86 Atom, android-23 | Android Wear ARM EABI v7a, android-23 | Android Wear Intel x86 Atom, android-26 | Intel x86 Atom_64
IDEs:
Android Studio: 3.6 AI-192.7142.36.36.6392135
Xcode: 12.5/12E262 - /usr/bin/xcodebuild
npmPackages:
react: 16.8.3 => 16.8.3
react-native: 0.59.5 => 0.59.5

[evan0204]

原因是 因为CodePush是APP集成后，初始化APP时候会初始化CodePush，但是CodePush中有个ANDROID_ID的获取，用于区分热更新的设备ID唯一编码，目前各Android平台已经把获取Android_ID作为隐私权的一部分，所以导致的这个问题。

解决办法(目前还未做测试，但2，3是肯定可行的)：
1、在隐私同意前做一个初始化判断，是否初始化CodePush组件(自定义热更新View组件，CodePush引入只在此组件用)。
示例：

2、如果还是不行(从源码上看是APP初始化就进行了CodePush的初始化)就需要分割下Android下初始化CodePush的步骤，手动添加个Init方法手动调用，不能放在SDK下进行默认初始化了
3、还有一种简单方式就是把获取ANDROID_ID的步骤放在真正调用的地方进行使用也可以，就是需要花点时间找下调用点
4、通过对源代码的多次复查，发现其实获取的ANDROID_ID存储的变量为：clientUniqueId，只是单纯做了存储，未做使用，所以，可以直接删除也没有任何问题

[Jeijie]

@evan0204 谢谢，第4点可以

[jerryisbusy]

Same problem.
Can anybody gives some help?

[huangnan78100]

作者什么时候能够发布新版本解决这个问题？

[GZLGIT]

@evan0204 @Jeijie 谢谢第四点可以。想问下有最新的进展吗？

[Jeijie]

@GZLGIT 注释掉CodePushNativeModule.java文件获取ANDROID_ID的两行代码,就可以通过审核通过了

[GZLGIT]

@Jeijie 非常感谢

[zhuminjunivan]

目前的做法都是本地改一下 但是还是需要官方支持的。
react-native-device-info也有这个问题,但是他们发布版本改过了
react-native-device-info/react-native-device-info#1427

[hengkx]

same issue

[huangnan78100]

目前的做法都是本地改一下 但是还是需要官方支持的。 react-native-device-info也有这个问题,但是他们发布版本改过了 react-native-device-info/react-native-device-info#1427

官方怎么还没有解决这个问题啊

[huangnan78100]

官方还没有解决，只能fork一下项目了，一直本地改也不行啊

[hengkx]

patch-package

[bruce3x]

可以给 app/build.gradle 中加个 gradle task，来确保编译前移除了 code push 源码中的 android id 调用

def fixLine(File file, String keyword, String newLine) {
    if (!file.exists()) {
        throw IllegalStateException("$file is not found!")
    }

    List<String> lines = file.readLines()
    StringBuilder sb = new StringBuilder()
    lines.eachWithIndex { String line, int index ->
        if (!line.contains(keyword)) {
            sb.append(line)
        } else {
            logger.lifecycle("Found '$keyword' in line ${index + 1}, fix it!")
            sb.append(newLine)
        }
        sb.append("\n")
    }
    file.write(sb.toString())
    logger.lifecycle("Fixed $file !")
}

/**
 * 移除 `react-native-code-push` 和 `react-native-device-info` 两个 react-native 库中获取 AndroidID 的代码
 */
task removeAndroidIdUsage {
    doLast {
        File codePush = rootProject.file(
            "../node_modules/react-native-code-push/android/app/src/main/java/com/microsoft/codepush/react/CodePushNativeModule.java")
        File deviceInfo = rootProject.file(
            "../node_modules/react-native-device-info/android/src/main/java/com/learnium/RNDeviceInfo/RNDeviceModule.java"
        )

        fixLine(codePush, "Settings.Secure.ANDROID_ID", "")
        fixLine(deviceInfo, "Settings.Secure.ANDROID_ID", "  public String getUniqueIdSync() { return \"\"; }")
    }
}

project.afterEvaluate {
    android.applicationVariants.all { def variant ->
        def targetName = variant.name.capitalize()
        def compileJavaTask = tasks.findByName("compile${targetName}JavaWithJavac")
        compileJavaTask.dependsOn(removeAndroidIdUsage)
        logger.warn("Making task ${compileJavaTask} depend on ${removeAndroidIdUsage}")
    }
}

[shenjo]

我暂时比较简单粗暴，在项目根目录加了个patches/index.js的脚本，将两处id的引用替换掉

const fs = require('fs');
const path = require('path');

const node_module = path.resolve(__dirname, '../node_modules');

// code-push 去掉androidId的引用

const tobeChangedCodePushSourceCodeAddr = path.resolve(node_module, './react-native-code-push/android/app/src/main/java/com/microsoft/codepush/react/CodePushNativeModule.java');

const content = fs.readFileSync(tobeChangedCodePushSourceCodeAddr, { encoding: 'utf8' });

fs.writeFile(tobeChangedCodePushSourceCodeAddr, content.replace('mClientUniqueId = Settings.Secure.getString(reactContext.getContentResolver(), Settings.Secure.ANDROID_ID);', '')
		.replace('configMap.putString("clientUniqueId", mClientUniqueId);', ''), { encoding: 'utf-8' }, (err) => {
		if (err) {
			console.log(err);
		}
	}
);

然后在 package.json 里添加install 钩子

"postinstall": "node ./patches/index.js"