Install Referrer Library Permissions Snafu

Update 3/13/2020: Install Referrer 1.1.2 was released recently which fixes the problem below; go get it!

It's been a long time coming: the install_referrer broadcast intent is being shut down on March 1, 2020.

Its replacement is the Play Install Referrer library. It's easy to get setup but you might notice something odd when you add it to your app: the install referrer library starts adding unnecessary permissions to your app (like READ_PHONE_STATE).

The reason this is happening is because version 1.1 of the library stopped including <uses-sdk> in its manifest. When there is no target SDK set, the build tools assume the target SDK is 1. And because of that, the tools automatically request the READ_PHONE_STATE permission (since that used to be default pre-SDK 4).

This bug is an oops on Google's part and hopefully they fix the issue soon.

While waiting for a fix, there are a couple workarounds you can use:

1. You can use version 1.0 of the library, which included <uses-sdk> properly.

2. You can explicitly remove the READ_PHONE_STATE permission by adding this to your AndroidManifest.xml:

   <uses-permission android:name="android.permission.READ_PHONE_STATE" tools:node="remove" />
   

This snafu serves as a good lesson to never forget to include <uses-sdk> in your libraries.