Lint Report: 8 errors and 7 warnings
Issue Types

Overview

Correctness
1warning InlinedApi: Using inlined constants on older versions
2warning InvalidPackage: Package not included in Android
8error NewApi: Calling new methods on older versions
1warning OldTargetApi: Target SDK attribute is not targeting latest version
1warning GradleDependency: Obsolete Gradle Dependency
1warning GradleDynamicVersion: Gradle Dynamic Version
Security
1warning TrulyRandom: Weak RNG
Disabled Checks (31)

Using inlined constants on older versions

../../src/main/java/com/RNRSA/RSA.java:67: Field requires API level 23 (current min is 16): android.security.keystore.KeyProperties#KEY_ALGORITHM_RSA
  64 public class RSA {
  65     public static Charset CharsetUTF_8;
  66 
  67     public static final String ALGORITHM = KeyProperties.KEY_ALGORITHM_RSA;                         
  68 
  69     private static final String PUBLIC_HEADER = "RSA PUBLIC KEY";
  70     private static final String PRIVATE_HEADER = "RSA PRIVATE KEY";
InlinedApi Correctness Warning Priority 6/10

Package not included in Android

../../../../../../../Users/amitay/.gradle/caches/modules-2/files-2.1/com.madgag.spongycastle/bcpkix-jdk15on/1.56.0.0/434734c3c66d400d5bd4383724ccb71ada61482c/bcpkix-jdk15on-1.56.0.0.jar: Invalid package reference in library; not included in Android: javax.naming.directory. Referenced from org.spongycastle.cert.dane.fetcher.JndiDANEFetcherFactory.
../../../../../../../Users/amitay/.gradle/caches/modules-2/files-2.1/com.madgag.spongycastle/bcpkix-jdk15on/1.56.0.0/434734c3c66d400d5bd4383724ccb71ada61482c/bcpkix-jdk15on-1.56.0.0.jar: Invalid package reference in library; not included in Android: javax.naming. Referenced from org.spongycastle.cert.dane.fetcher.JndiDANEFetcherFactory.1.
InvalidPackage Correctness Warning Priority 6/10

Calling new methods on older versions

../../src/main/java/com/RNRSA/RSA.java:314: Call requires API level 18 (current min is 16): new android.security.KeyPairGeneratorSpec.Builder
 311   } else {
 312       Calendar endDate = Calendar.getInstance();
 313       endDate.add(Calendar.YEAR, 1);
 314       KeyPairGeneratorSpec.Builder keyPairGeneratorSpec = new KeyPairGeneratorSpec.Builder(context)
 315           .setAlias(keyTag)
 316           .setSubject(new X500Principal(
 317               String.format("CN=%s, OU=%s", keyTag, context.getPackageName())
../../src/main/java/com/RNRSA/RSA.java:315: Call requires API level 18 (current min is 16): android.security.KeyPairGeneratorSpec.Builder#setAlias
 312   Calendar endDate = Calendar.getInstance();
 313   endDate.add(Calendar.YEAR, 1);
 314   KeyPairGeneratorSpec.Builder keyPairGeneratorSpec = new KeyPairGeneratorSpec.Builder(context)
 315       .setAlias(keyTag)                                                                   
 316       .setSubject(new X500Principal(
 317           String.format("CN=%s, OU=%s", keyTag, context.getPackageName())
 318       ))
../../src/main/java/com/RNRSA/RSA.java:316: Call requires API level 18 (current min is 16): android.security.KeyPairGeneratorSpec.Builder#setSubject
 313   endDate.add(Calendar.YEAR, 1);
 314   KeyPairGeneratorSpec.Builder keyPairGeneratorSpec = new KeyPairGeneratorSpec.Builder(context)
 315       .setAlias(keyTag)
 316       .setSubject(new X500Principal(                                                      
 317           String.format("CN=%s, OU=%s", keyTag, context.getPackageName())
 318       ))
 319       .setSerialNumber(BigInteger.ONE)
../../src/main/java/com/RNRSA/RSA.java:319: Call requires API level 18 (current min is 16): android.security.KeyPairGeneratorSpec.Builder#setSerialNumber
 316                 .setSubject(new X500Principal(
 317                     String.format("CN=%s, OU=%s", keyTag, context.getPackageName())
 318                 ))
 319                 .setSerialNumber(BigInteger.ONE)                                                    
 320                 .setStartDate(Calendar.getInstance().getTime())
 321                 .setEndDate(endDate.getTime());
 322             if (android.os.Build.VERSION.SDK_INT >= 19) {
../../src/main/java/com/RNRSA/RSA.java:320: Call requires API level 18 (current min is 16): android.security.KeyPairGeneratorSpec.Builder#setStartDate
 317                     String.format("CN=%s, OU=%s", keyTag, context.getPackageName())
 318                 ))
 319                 .setSerialNumber(BigInteger.ONE)
 320                 .setStartDate(Calendar.getInstance().getTime())                                     
 321                 .setEndDate(endDate.getTime());
 322             if (android.os.Build.VERSION.SDK_INT >= 19) {
 323                 keyPairGeneratorSpec.setKeySize(keySize).setKeyType(ALGORITHM);
../../src/main/java/com/RNRSA/RSA.java:321: Call requires API level 18 (current min is 16): android.security.KeyPairGeneratorSpec.Builder#setEndDate
 318                 ))
 319                 .setSerialNumber(BigInteger.ONE)
 320                 .setStartDate(Calendar.getInstance().getTime())
 321                 .setEndDate(endDate.getTime());                                                     
 322             if (android.os.Build.VERSION.SDK_INT >= 19) {
 323                 keyPairGeneratorSpec.setKeySize(keySize).setKeyType(ALGORITHM);
 324             }
../../src/main/java/com/RNRSA/RSA.java:325: Call requires API level 18 (current min is 16): android.security.KeyPairGeneratorSpec.Builder#build
 322             if (android.os.Build.VERSION.SDK_INT >= 19) {
 323                 keyPairGeneratorSpec.setKeySize(keySize).setKeyType(ALGORITHM);
 324             }
 325             kpg.initialize(keyPairGeneratorSpec.build());                                           
 326         }
 327 
 328         KeyPair keyPair = kpg.genKeyPair();
../../src/main/java/com/RNRSA/RSA.java:325: Cast from KeyPairGeneratorSpec to AlgorithmParameterSpec requires API level 18 (current min is 16)
 322             if (android.os.Build.VERSION.SDK_INT >= 19) {
 323                 keyPairGeneratorSpec.setKeySize(keySize).setKeyType(ALGORITHM);
 324             }
 325             kpg.initialize(keyPairGeneratorSpec.build());                                           
 326         }
 327 
 328         KeyPair keyPair = kpg.genKeyPair();
NewApi Correctness Error Priority 6/10

Target SDK attribute is not targeting latest version

../../build.gradle:28: Not targeting the latest versions of Android; compatibility modes apply. Consider testing and updating this version. Consult the android.os.Build.VERSION_CODES javadoc for details.
 25 
 26     defaultConfig {
 27         minSdkVersion 16
 28         targetSdkVersion 26
                                                                        
 29         versionCode 1
 30         versionName "1.0"
 31         ndk {
OldTargetApi Correctness Warning Priority 6/10

Obsolete Gradle Dependency

../../build.gradle:17: A newer version of com.android.tools.build:gradle than 3.3.2 is available: 3.4.2
 14     }
 15 
 16     dependencies {
 17         classpath 'com.android.tools.build:gradle:3.3.2'
                                           
 18     }
 19 }
 20 apply plugin: 'com.android.library'
GradleDependency Correctness Warning Priority 4/10

Gradle Dynamic Version

../../build.gradle:58: Avoid using + in version numbers; can lead to unpredictable and unrepeatable builds (com.facebook.react:react-native:+)
 55 }
 56 
 57 dependencies {
 58     implementation 'com.facebook.react:react-native:+'
                                             
 59     implementation 'com.madgag.spongycastle:core:1.56.0.0'
 60     implementation 'com.madgag.spongycastle:prov:1.56.0.0'
 61     implementation 'com.madgag.spongycastle:bcpkix-jdk15on:1.56.0.0'
GradleDynamicVersion Correctness Warning Priority 4/10

Weak RNG

../../src/main/java/com/RNRSA/RSA.java:284: Potentially insecure random numbers on Android 4.3 and older. Read https://android-developers.blogspot.com/2013/08/some-securerandom-thoughts.html for more info.
 281   }
 282 
 283   public void generate(int keySize) throws IOException, NoSuchAlgorithmException, InvalidAlgorithmParameterException {
 284       KeyPairGenerator kpg = KeyPairGenerator.getInstance(ALGORITHM);                             
 285       kpg.initialize(keySize);
 286 
 287       KeyPair keyPair = kpg.genKeyPair();
TrulyRandom Security Warning Priority 9/10

Disabled Checks

One or more issues were not run by lint, either because the check is not enabled by default, or because it was disabled with a command line flag or via one or more lint.xml configuration files in the project directories.

Suppressing Warnings and Errors

Lint errors can be suppressed in a variety of ways:

1. With a @SuppressLint annotation in the Java code
2. With a tools:ignore attribute in the XML file
3. With a //noinspection comment in the source code
4. With ignore flags specified in the build.gradle file, as explained below
5. With a lint.xml configuration file in the project
6. With a lint.xml configuration file passed to lint via the --config flag
7. With the --ignore flag passed to lint.

To suppress a lint warning with an annotation, add a @SuppressLint("id") annotation on the class, method or variable declaration closest to the warning instance you want to disable. The id can be one or more issue id's, such as "UnusedResources" or {"UnusedResources","UnusedIds"}, or it can be "all" to suppress all lint warnings in the given scope.

To suppress a lint warning with a comment, add a //noinspection id comment on the line before the statement with the error.

To suppress a lint warning in an XML file, add a tools:ignore="id" attribute on the element containing the error, or one of its surrounding elements. You also need to define the namespace for the tools prefix on the root element in your document, next to the xmlns:android declaration:
xmlns:tools="http://schemas.android.com/tools"

To suppress a lint warning in a build.gradle file, add a section like this:

android {
    lintOptions {
        disable 'TypographyFractions','TypographyQuotes'
    }
}

Here we specify a comma separated list of issue id's after the disable command. You can also use warning or error instead of disable to change the severity of issues.

To suppress lint warnings with a configuration XML file, create a file named lint.xml and place it at the root directory of the module in which it applies.

The format of the lint.xml file is something like the following:

<?xml version="1.0" encoding="UTF-8"?>
<lint>
    <!-- Ignore everything in the test source set -->
    <issue id="all">
        <ignore path="*/test/*" />
    </issue>

    <!-- Disable this given check in this project -->
    <issue id="IconMissingDensityFolder" severity="ignore" />

    <!-- Ignore the ObsoleteLayoutParam issue in the given files -->
    <issue id="ObsoleteLayoutParam">
        <ignore path="res/layout/activation.xml" />
        <ignore path="res/layout-xlarge/activation.xml" />
        <ignore regexp="(foo|bar).java" />
    </issue>

    <!-- Ignore the UselessLeaf issue in the given file -->
    <issue id="UselessLeaf">
        <ignore path="res/layout/main.xml" />
    </issue>

    <!-- Change the severity of hardcoded strings to "error" -->
    <issue id="HardcodedText" severity="error" />
</lint>

To suppress lint checks from the command line, pass the --ignore flag with a comma separated list of ids to be suppressed, such as:
$ lint --ignore UnusedResources,UselessLeaf /my/project/path

For more information, see http://g.co/androidstudio/suppressing-lint-warnings