I’m trying to obfuscate the jar for my application.
I’m using spring boot 3.2.5 and java 21.
Both jars are created, the initial and the obfuscated one, but the obfuscated one does not contain the classes from my app packages.
This is my proguard configuration:
# Obfuscation settings
-useuniqueclassmembernames
-classobfuscationdictionary obfuscation-dictionary.txt
-packageobfuscationdictionary obfuscation-dictionary.txt
# General options
-verbose
-dontoptimize
-dontshrink
-dontpreverify
-allowaccessmodification
-adaptclassstrings
-keepdirectories
-ignorewarnings
# Keep annotations
-keepattributes *Annotation*
-keepattributes Signature
-keepattributes Exceptions
# Keep main classes
-keep public class * extends org.springframework.boot.web.support.SpringBootServletInitializer
-keep public class com.my.package.Application {
public static void main(java.lang.String[]);
}
-keep,allowobfuscation class com.my.package.Application.** { *; }
-keep interface com.my.package.** { *; }
-keepclasseswithmembers public class * {
public static void main(java.lang.String[]);
}
# If you use Lombok, you might need this
-keep class lombok.** { *; }
-dontwarn lombok.**
-keepclassmembers class * {
@lombok.Setter *;
@lombok.Getter *;
@lombok.Cleanup *;
@lombok.ToString *;
@lombok.EqualsAndHashCode *;
@lombok.AllArgsConstructor *;
@lombok.NoArgsConstructor *;
@lombok.Builder *;
}
# Keep all classes in specific packages
-keep class my.package.** { *; }
-keep class org.springframework.boot.** { *; }
-keep class org.springframework.boot.loader.** { *; }
-dontwarn org.springframework.boot.loader.**
# Keep Spring Boot specific classes
-keep class org.springframework.boot.loader.jar.** { *; }
-keep class org.springframework.boot.loader.zip.** { *; }
-keep class java.util.jar.JarFile { *; }
# Keep ZIP related classes
-keep class java.util.zip.** { *; }
-dontwarn java.util.zip.**
# Keep all subclasses of InputStream
-keep class * extends java.io.InputStream { *; }
-keep class * extends java.util.zip.InflaterInputStream { *; }
# Keep specific classes and their inner classes
-keep class org.springframework.boot.loader.jar.NestedJarFile { *; }
-keep class org.springframework.boot.loader.jar.NestedJarFile$* { *; }
-keep class org.springframework.boot.loader.jar.ZipInflaterInputStream { *; }
-keep class org.springframework.boot.loader.zip.ZipContent$Entry { *; }
# Keep specific methods and fields
-keepclassmembers class * {
@org.springframework.beans.factory.annotation.Autowired *;
@org.springframework.beans.factory.annotation.Qualifier *;
@org.springframework.beans.factory.annotation.Value *;
@org.springframework.beans.factory.annotation.Required *;
@org.springframework.context.annotation.Bean *;
@org.springframework.context.annotation.Primary *;
@org.springframework.boot.context.properties.ConfigurationProperties *;
@org.springframework.boot.context.properties.EnableConfigurationProperties *;
@javax.inject.Inject *;
@javax.annotation.PostConstruct *;
@javax.annotation.PreDestroy *;
@org.springframework.security.access.prepost.PreAuthorize *;
}
# Keep enums
-keepclassmembers enum * {
*;
}
# Keep Serializable classes
-keepnames class * implements java.io.Serializable
-keepclassmembers class * implements java.io.Serializable {
static final long serialVersionUID;
private static final java.io.ObjectStreamField[] serialPersistentFields;
!static !transient <fields>;
!private <fields>;
!private <methods>;
private void writeObject(java.io.ObjectOutputStream);
private void readObject(java.io.ObjectInputStream);
java.lang.Object writeReplace();
java.lang.Object readResolve();
}
# Keep getters and setters
-keepclassmembers class * {
*** get*();
void set*(***);
}
# Keep specific annotations
-keep @org.springframework.cache.annotation.EnableCaching class *
-keep @org.springframework.context.annotation.Configuration class *
-keep @org.springframework.boot.context.properties.ConfigurationProperties class *
-keep @org.springframework.boot.autoconfigure.SpringBootApplication class *
# Keep specific directories
-keepdirectories org.springframework.boot.autoconfigure
This is my plugin configuration:
<plugin>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-maven-plugin</artifactId>
<version>3.2.5</version>
<executions>
<execution>
<id>repackage</id>
<phase>package</phase>
<goals>
<goal>repackage</goal>
</goals>
<configuration>
<mainClass>com.my.package.Application</mainClass>
</configuration>
</execution>
</executions>
</plugin>
<plugin>
<groupId>com.github.wvengen</groupId>
<artifactId>proguard-maven-plugin</artifactId>
<version>2.6.1</version>
<executions>
<execution>
<phase>package</phase>
<goals>
<goal>proguard</goal>
</goals>
</execution>
</executions>
<configuration>
<proguardVersion>7.3.2</proguardVersion>
<injar>${project.build.finalName}.jar</injar>
<outjar>${project.build.finalName}-obfuscated.jar</outjar>
<obfuscate>true</obfuscate>
<proguardInclude>${project.basedir}/proguard.cfg</proguardInclude>
<libs>
<lib>${java.home}/lib/jrt-fs.jar</lib>
</libs>
<options>
<option>-verbose</option>
</options>
</configuration>
<dependencies>
<dependency>
<groupId>com.guardsquare</groupId>
<artifactId>proguard-base</artifactId>
<version>7.3.2</version>
</dependency>
</dependencies>
</plugin>
A little help would be appreciated.
Thanks!
I tried debugging, I get this in the logs
[proguard] Number of obfuscated classes: 41
[proguard] Number of obfuscated fields: 196
[proguard] Number of obfuscated methods: 121
I see my classes being obfuscated in the proguard_map.txt file but they are not in the final obfuscated jar.
It might be something in the packaging or the ordering of the packaging, but I can’t figure it out.
You need to sign in to view this answers
Leave feedback about this