From c69f17f0d007a19a7e78b9f5959bb27bbe774605 Mon Sep 17 00:00:00 2001 From: Brandon DeRosier Date: Fri, 27 Feb 2026 02:25:53 -0800 Subject: [PATCH 1/2] Update obfuscation docs for Shorebird 1.6.84 Shorebird now supports obfuscation on all platforms including iOS when using Flutter 3.41.2+. Document the --obfuscate flag on shorebird release and automatic obfuscation detection for patches. --- .../docs/code-push/guides/security-tools.mdx | 46 +++++++++++++------ 1 file changed, 33 insertions(+), 13 deletions(-) diff --git a/src/content/docs/code-push/guides/security-tools.mdx b/src/content/docs/code-push/guides/security-tools.mdx index d145e55a..9e8c2d0b 100644 --- a/src/content/docs/code-push/guides/security-tools.mdx +++ b/src/content/docs/code-push/guides/security-tools.mdx @@ -53,11 +53,32 @@ All you have to do is pass `--obfuscate` to your `flutter build` (or This obfuscation isn't particularly fancy, but it will rename all library, method and field names in your program to unique identifiers during compilation. -Shorebird also supports this same obfuscation, on all platforms other than iOS. -Currently obfuscation support in Dart's compiler is incompatible with -Shorebird's other modifications on iOS. We have a plan to fix such, it just -hasn't reached the top of our list yet: -https://github.com/shorebirdtech/shorebird/issues/1619 +### Using obfuscation with Shorebird + +As of Shorebird 1.6.84 with Flutter 3.41.2 and later, Shorebird supports +obfuscation on all platforms, including iOS. + +To use obfuscation, pass `--obfuscate` to your `shorebird release` command: + +```sh +shorebird release android --obfuscate +shorebird release ios --obfuscate +``` + +When you create a patch, Shorebird will automatically detect that the release +was built with obfuscation and apply the same obfuscation to the patch. No +extra flags are needed: + +```sh +shorebird patch android +shorebird patch ios +``` + +:::note +Obfuscation support requires Flutter 3.41.2 or later. If you are using an +older version of Flutter, `shorebird release --obfuscate` will display an +error asking you to upgrade. +::: ## Third Party Security Programs @@ -85,13 +106,12 @@ with third party security tools and Shorebird. ### GuardSquare on iOS -We have seen one issue with GuardSquare on iOS with Shorebird. Similar to the -lack of `--obfuscate` support for Shorebird with Dart, GuardSquare (at least in -some configurations) will make an attempt to "obfuscate" iOS binaries further -replacing the implementations of some functions with code which is used to -provide obscured access to constants/strings/numbers stored within the binary. -This is currently incompatible with our Dart modifications for iOS. If this is -an issue for your product, we'd be happy to discuss with your GuardSquare -support team if there are workarounds we could build together. +We have seen one issue with GuardSquare on iOS with Shorebird. GuardSquare (at +least in some configurations) will make an attempt to "obfuscate" iOS binaries +further, replacing the implementations of some functions with code which is used +to provide obscured access to constants/strings/numbers stored within the +binary. This may be incompatible with Shorebird's Dart modifications for iOS. +If this is an issue for your product, we'd be happy to discuss with your +GuardSquare support team if there are workarounds we could build together. Reach out to us at contact@shorebird.dev. From f5f43e7e70cecd48546e846e494a530ea0a808d8 Mon Sep 17 00:00:00 2001 From: Brandon DeRosier Date: Fri, 27 Feb 2026 02:28:16 -0800 Subject: [PATCH 2/2] Format with prettier --- .../docs/code-push/guides/security-tools.mdx | 16 +++++++--------- 1 file changed, 7 insertions(+), 9 deletions(-) diff --git a/src/content/docs/code-push/guides/security-tools.mdx b/src/content/docs/code-push/guides/security-tools.mdx index 9e8c2d0b..2e533a54 100644 --- a/src/content/docs/code-push/guides/security-tools.mdx +++ b/src/content/docs/code-push/guides/security-tools.mdx @@ -66,19 +66,17 @@ shorebird release ios --obfuscate ``` When you create a patch, Shorebird will automatically detect that the release -was built with obfuscation and apply the same obfuscation to the patch. No -extra flags are needed: +was built with obfuscation and apply the same obfuscation to the patch. No extra +flags are needed: ```sh shorebird patch android shorebird patch ios ``` -:::note -Obfuscation support requires Flutter 3.41.2 or later. If you are using an -older version of Flutter, `shorebird release --obfuscate` will display an -error asking you to upgrade. -::: +:::note Obfuscation support requires Flutter 3.41.2 or later. If you are using +an older version of Flutter, `shorebird release --obfuscate` will display an +error asking you to upgrade. ::: ## Third Party Security Programs @@ -110,8 +108,8 @@ We have seen one issue with GuardSquare on iOS with Shorebird. GuardSquare (at least in some configurations) will make an attempt to "obfuscate" iOS binaries further, replacing the implementations of some functions with code which is used to provide obscured access to constants/strings/numbers stored within the -binary. This may be incompatible with Shorebird's Dart modifications for iOS. -If this is an issue for your product, we'd be happy to discuss with your +binary. This may be incompatible with Shorebird's Dart modifications for iOS. If +this is an issue for your product, we'd be happy to discuss with your GuardSquare support team if there are workarounds we could build together. Reach out to us at contact@shorebird.dev.