java.util.zip.ZipException with spongycastle LICENSE.class

Question

I am trying to include two different 3rd party libs that both seem to include different versions of Spongy castle. Both are included via compile statements in my build.gradle and one is included as an AAR (@aar) while the other is included as normal.

When I try to compile the debug buildType with these 2 libs (sync doesnt show a problem). I see the following,

Error:Execution failed for task ':app:transformClassesWithJarMergingForDebug'.

com.android.build.api.transform.TransformException: java.util.zip.ZipException: duplicate entry: org/spongycastle/LICENSE.class

Been searching around for how to resolve this issue while keeping both the libraries (as both are needed) but have been unable to find a way to do that. Any help from an advanced Android dev or a gradle expert would be greatly appreciated.

Thanks!

[build.gradle]

apply plugin: 'com.android.application'

repositories {
    maven { url 'http://mobile-sdk.jumio.com' }
}

android {
    compileSdkVersion 23
    buildToolsVersion "23.0.2"

    packagingOptions {
        pickFirst 'org/spongycastle/x509/CertPathReviewerMessages.properties'
        pickFirst 'org/spongycastle/x509/CertPathReviewerMessages_de.properties'
    }

    defaultConfig {
        applicationId "com.example.me.license"
        minSdkVersion 16
        targetSdkVersion 23
        versionCode 1
        versionName "1.0"
    }
    buildTypes {
        release {
            minifyEnabled true
            proguardFiles getDefaultProguardFile('proguard-android.txt'), 'proguard-rules.pro'
        }
    }
}

dependencies {
    compile fileTree(dir: 'libs', include: ['*.jar'])
    testCompile 'junit:junit:4.12'
    compile 'com.android.support:appcompat-v7:23.3.0'

    compile "com.jumio.android:jumio-mobile-sdk:1.9.0@aar"
    compile 'com.worldpay:cse-android-sdk:1.0.2'
}

Answer 1

This is what happens if developers include their dependencies directly. The bad guy here is jumio-mobile-sdk. This package includes classes of com.madgag.spongycastle directly, instead of specifying them in a pom as it should be done.

Luckily for you, the other package is set up correctly, so you should be able to exclude spongycastle from it:

compile ('com.worldpay:cse-android-sdk:1.0.2'){
    exclude group: 'com.madgag.spongycastle'
}

---

Now imagine both packages would've included the classes directly. The would've been no other possibility then to manually edit the files. This is why I hate it if someone does what the guys of jumio are doing. If you have the contacts, tell them to prepare their package for dependency systems, so this problem won't arise again.