Duplicate classes errors after adding a dependency on `tink-android`

[oakkitten]

Using 2.2.21 from Jitpack, I'm running into build issues with my Android app after adding a dependency of androidx.security:security-crypto, which itself depends on com.google.crypto.tink:tink-android, with errors such as:

org.gradle.api.tasks.TaskExecutionException: Execution failed for task ':app:checkDebugDuplicateClasses'.
    ...
Caused by: org.gradle.workers.internal.DefaultWorkerExecutor$WorkExecutionException: A failure occurred while executing com.android.build.gradle.internal.tasks.CheckDuplicatesRunnable
    ...
Caused by: java.lang.RuntimeException: 
    Duplicate class com.google.crypto.tink.PublicKeySign found in modules jetified-sshlib-2.2.21 (com.github.connectbot:sshlib:2.2.21) and jetified-tink-android-1.7.0 (com.google.crypto.tink:tink-android:1.7.0)
    Duplicate class com.google.crypto.tink.PublicKeyVerify found in modules jetified-sshlib-2.2.21 (com.github.connectbot:sshlib:2.2.21) and jetified-tink-android-1.7.0 (com.google.crypto.tink:tink-android:1.7.0)
    Duplicate class com.google.crypto.tink.annotations.Alpha found in modules jetified-sshlib-2.2.21 (com.github.connectbot:sshlib:2.2.21) and jetified-tink-android-1.7.0 (com.google.crypto.tink:tink-android:1.7.0)
    ...

I tried excluding the tink dependcies of sshlib, which didn't work, and after running ./gradlew project:dependencies I see that sshlib does not have any dependencies. I looked through the build file and I see that sshlib uses Gradle Shadow, might that be the issue?

I'm quite unfamiliar with Shadow and Gradle generally causes me a lot of misery. Any ideas how I should proceed? And sorry if this is something stupid.

[oakkitten]

This seems to be solvable after reverting 1257f137. After reverting, I was able to do

// project relay uses sshlib
implementation(project(":relay")) {
    exclude("com.google.crypto.tink", "tink")
}

implementation("com.google.crypto.tink:tink-android:1.8.0")

Also, removing Shadow leads to APK size decreasing by 767 bytes (AGP 8.2.2, R8 in full mode)! Yay...

An alternative approach could be package relocation maybe. But so far everything seems to work