Install Referrer Library v1.1 adds permissions

Updating the Install Referrer Library from v1.0 to v1.1 added the following permissions:

WRITE_EXTERNAL_STORAGE

READ_EXTERNAL_STORAGE

READ_PHONE_STATE

Those permissions are not present in the Install Referrer Library manifest.xml:

<?xml version="1.0" encoding="utf-8"?>
<manifest xmlns:android="http://schemas.android.com/apk/res/android"
    package="com.android.installreferrer" >

    <uses-permission android:name="com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE" />

    <application />

</manifest>

Source: https://mvnrepository.com/artifact/com.android.installreferrer/installreferrer/1.1

Why those permissions added to the merged manifest?

Version 1.1 and 1.1.1 are missing "minSdkVersion". This would automatically add those permissions. See similar issue here: Google Play Services 12.0.1.

Solution

Version 1.1.2 solves this issue.

Details

Manifest.xml for v1.0 (from https://mvnrepository.com/artifact/com.android.installreferrer/installreferrer/1.0)

<?xml version="1.0" encoding="utf-8"?>
<manifest xmlns:android="http://schemas.android.com/apk/res/android" package="com.android.installreferrer" >

    <uses-sdk
        android:minSdkVersion="8"
        android:targetSdkVersion="22" />

    <uses-permission android:name="com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE" />

    <application />

</manifest>

Manifest.xml for v1.1 (from https://mvnrepository.com/artifact/com.android.installreferrer/installreferrer/1.1)

<?xml version="1.0" encoding="utf-8"?>
<manifest xmlns:android="http://schemas.android.com/apk/res/android" package="com.android.installreferrer">

    <uses-permission android:name="com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE" />

    <application />

</manifest>