Readme contains bad R8 advice

R8 and ProGuard rules are bundled into SSO. The bundled rules do not cover enabled obfuscation. Therefore it is recommended to add -dontobfuscate to your app-specific proguard rules.

Setting -dontobfuscate on a whole app is a bad idea, as it will unnecessarily increase the app size.

There are exactly two possibilities:

1. This library works in a consuming app that has R8 fullmode and obfuscation turned on. In this case, the text above is wrong and should be changed.

2. The library does not work in a consuming app that has R8 fullmode and obfuscation turned on. In this case, the R8 rules provided by the library should be improved until it does. Offloading this work to consuming developers is lazy and bad practice.

As fas as I can tell we are dealing with 1) here.

So I suggest altering the Readme to say the following:

The rules needed to make SSO work with R8 and ProGuard are bundled into the library.

With R8 full mode being enabled by default since AGP 8.0, you will probably need to handle following app-specific rules yourself (or disable full mode):
...

(Although I don't understand why you would want to repeat Gson/Retrofit rules, if devs have a problem with them they can go to the respective docs themselves)

Review the README guidance alongside lib/consumer-proguard-rules.pro and the linked R8 full-mode and AGP references. Determine whether the library works with R8 full mode and obfuscation enabled; done means the README accurately states the required app-specific rules, or the bundled rules are updated if needed.