使用嵌入式jar包对jar进行混淆

Question

我想为Java邮件中的嵌入式jar混淆jar:

<dependency>
    <groupId>com.sun.mail</groupId>
    <artifactId>javax.mail</artifactId>
    <version>1.5.4</version>
    <type>jar</type>
</dependency>
......
<plugin>
    <groupId>org.apache.felix</groupId>
    <artifactId>maven-bundle-plugin</artifactId>
    <version>3.0.0</version>
    <extensions>true</extensions>
    <configuration>
        <instructions>
            <!-- Embed dependency into the bundle-->
            <Embed-Dependency>javax.mail;inline=true</Embed-Dependency>
            <Bundle-Version>${project.version}</Bundle-Version>
            <Bundle-SymbolicName>${project.artifactId}</Bundle-SymbolicName>
        </instructions>
    </configuration>
</plugin>

Proguard配置

<plugin>
    <groupId>com.github.wvengen</groupId>
    <artifactId>proguard-maven-plugin</artifactId>
    <version>2.0.11</version>
    <dependencies>
        <dependency>
            <groupId>net.sf.proguard</groupId>
            <artifactId>proguard-base</artifactId>
            <version>5.2.1</version>
        </dependency>
    </dependencies>
    <executions>
        <execution>
            <phase>package</phase>
            <goals>
                <goal>proguard</goal>
            </goals>
        </execution>
    </executions>
    <configuration>
        <proguardVersion>5.2.1</proguardVersion>
        <obfuscate>true</obfuscate>
        <injarNotExistsSkip>true</injarNotExistsSkip>
        <injar>${project.build.finalName}.jar</injar>
        <outjar>${project.build.finalName}.jar</outjar>
        <options>
            <option>-keep public class org.package.engine.osgi.impl</option>
            <option>-keep public interface org.package.engine.osgi</option>
        </options>
        <exclusions>
            <exclusion>
                <groupId>com.sun.mail</groupId>
                <artifactId>javax.mail</artifactId>
            </exclusion>
        </exclusions>
        <libs>
            <lib>${java.home}/lib/rt.jar</lib>
            <lib>${java.home}/lib/jce.jar</lib>
            <lib>${java.home}/lib/ext/jfxrt.jar</lib>
        </libs>
    </configuration>
</plugin>

编译时我遇到了这个错误

proguard jar: C:\Users\user\.m2\repository\net\sf\proguard\proguard-base\5.2.1\proguard-base-5.2.1.jar
     [proguard] ProGuard, version 5.2.1     
     [proguard] Reading library jar [C:\Users\user\.m2\repository\org\osgi\org.osgi.core\6.0.0\org.osgi.core-6.0.0.jar]
     [proguard] Reading library jar [C:\Users\user\.m2\repository\org\apache\karaf\shell\org.apache.karaf.shell.core\4.0.1\org.apache.karaf.shell.core-4.0.1.jar]
     [proguard] Reading library jar [C:\Users\user\.m2\repository\jline\jline\2.12\jline-2.12.jar]               
     .............         
     [proguard]       Maybe this is library method 'java.util.Comparators$NullComparator { java.util.Comparator reversed(); }'
     [proguard] Warning: there were 1 instances of library classes depending on program classes.
     [proguard]          You must avoid such dependencies, since the program classes will
     [proguard]          be processed, while the library classes will remain unchanged.
     [proguard]          (http://proguard.sourceforge.net/manual/troubleshooting.html#dependency)
     [proguard] Error: Please correct the above warnings first.
     [proguard] Note: there were 5 accesses to class members by means of introspection.
     [proguard]       You should consider explicitly keeping the mentioned class members
     [proguard]       (using '-keep' or '-keepclassmembers').
     [proguard]       (http://proguard.sourceforge.net/manual/troubleshooting.html#dynamicalclassmember)

完整的错误堆栈 http://pastebin.com/hmhv0Yvs

- Peter Penzov

Answer 1

我没有尝试运行您的POM，但是就我所看到的，它会提取javax.mail工件到您的JAR中，然后混淆包括javax.mail在内的整个JAR，这样会导致以上问题。

与其提取依赖项，为什么不将其复制到META-INF/lib中呢？据我所知，删除;inline=true即可实现此操作。

- iirekm

---

META-INF/lib 的位置在哪里？ - Peter Penzov

Answer 2

问题出在proguard-maven-plugin配置中-keep选项的错误设置。您应该添加*通配符，以表明您希望保留所提到的包中的所有类/接口（请参考使用页面）。

更正后的配置应为：

<options>
    <option>-keep public class org.package.engine.osgi.impl.*</option>
    <option>-keep public interface org.package.engine.osgi.*</option>
</options>

- Tunaki

---

@PeterPenzov 嗯，我尝试了一下，在一个简单的程序上运行良好。你能回到一个非常简单的情况下吗（删除/备份所有类）？ - Tunaki