Google Play Integrity API调试正常生产环境调用失败的排查与解决

问题背景 #

通过Android Studio WiFi配对真机运行应用时一切正常，但生产环境中API调用持续失败，错误信息如下：
Integrity API error (-12): Unknown internal Google server error.
Retry with an exponential backoff. Consider filing a bug if fails consistently.
(对应错误码：GOOGLE_SERVER_UNAVAILABLE)

初步怀疑问题和代码混淆（obfuscation）、Google应用签名或控制台中未明确记录的生产部署凭据有关。

问题定位 #

已确认问题根源在于ProGuard混淆：

• DEBUG模式下Gradle设置minifyEnabled=true可复现该异常
• 生产环境关闭混淆后问题直接消失

底层抛出的异常详情：

Error getting access token for service account: 400 Bad Request
POST https://oauth2.googleapis.com/token
{"error":"invalid_grant","error_description":"Invalid grant: account not found"}, iss: account-email-from-json-file-iam.gserviceaccount.com
class: com.google.auth.oauth2.OAuth2Credentials$1.call  [OAuth2Credentials.java  line: 257]
class: com.google.auth.oauth2.OAuth2Credentials$1.call  [OAuth2Credentials.java  line: 254]
class: java.util.concurrent.FutureTask.run  [FutureTask.java  line: 264]
class: com.google.common.util.concurrent.DirectExecutor.execute  [DirectExecutor.java  line: 31]
class: com.google.auth.oauth2.OAuth2Credentials$AsyncRefreshResult.executeIfNew  [OAuth2Credentials.java  line: 580]
class: com.google.auth.oauth2.OAuth2Credentials.asyncFetch  [OAuth2Credentials.java  line: 220]
class: com.google.auth.oauth2.OAuth2Credentials.getRequestMetadata  [OAuth2Credentials.java  line: 170]
class: com.google.auth.oauth2.ServiceAccountCredentials.getRequestMetadata  [ServiceAccountCredentials.java  line: 967]
class: com.google.auth.http.HttpCredentialsAdapter.initialize  [HttpCredentialsAdapter.java  line: 96]
class: com.google.api.client.http.HttpRequestFactory.buildRequest  [HttpRequestFactory.java  line: 91]
class: com.google.api.client.googleapis.services.AbstractGoogleClientRequest.buildHttpRequest  [AbstractGoogleClientRequest.java  line: 404]
class: com.google.api.client.googleapis.services.AbstractGoogleClientRequest.executeUnparsed  [AbstractGoogleClientRequest.java  line: 514]
class: com.google.api.client.googleapis.services.AbstractGoogleClientRequest.executeUnparsed  [AbstractGoogleClientRequest.java  line: 455]
class: com.google.api.client.googleapis.services.AbstractGoogleClientRequest.execute  [AbstractGoogleClientRequest.java  line: 565]

解决方案 #

在ProGuard规则中添加以下配置后，测试设备上的问题已解决（目前仍存在Google审核设备上失败的情况，但至少能推进后续开发）：

# 修复PlayIntegrity API混淆后崩溃问题
-keep class com.google.api.services.playintegrity.** { *; } # 必填
-keep class com.google.api.client.** { *; } # 必填

碎碎念 #

谷歌的文档简直是笑话，弃用SafetyNet这类服务后，替代方案的文档严重不足。作为独立开发者，我们要花数百小时无报酬调试，他们却坐享收入分成。如果没有社区分享，谷歌的很多服务根本没法用。

PlayIntegrity API之所以必要，是因为Java/Google应用逆向工程太容易。谷歌作为合作伙伴，应该更用心帮助开发者保护知识产权，而不是只想着抽成。

感谢@pvalle提供的原始思路。

内容的提问来源于stack exchange，提问作者danny