使用嵌入式 jar 混淆 jar

Question

我想用 Java 邮件的嵌入式 jar 混淆 jar：

<dependency>
    <groupId>com.sun.mail</groupId>
    <artifactId>javax.mail</artifactId>
    <version>1.5.4</version>
    <type>jar</type>
</dependency>
......
<plugin>
    <groupId>org.apache.felix</groupId>
    <artifactId>maven-bundle-plugin</artifactId>
    <version>3.0.0</version>
    <extensions>true</extensions>
    <configuration>
        <instructions>
            <!-- Embed dependency into the bundle-->
            <Embed-Dependency>javax.mail;inline=true</Embed-Dependency>
            <Bundle-Version>${project.version}</Bundle-Version>
            <Bundle-SymbolicName>${project.artifactId}</Bundle-SymbolicName>
        </instructions>
    </configuration>
</plugin>

Proguard 配置

<plugin>
    <groupId>com.github.wvengen</groupId>
    <artifactId>proguard-maven-plugin</artifactId>
    <version>2.0.11</version>
    <dependencies>
        <dependency>
            <groupId>net.sf.proguard</groupId>
            <artifactId>proguard-base</artifactId>
            <version>5.2.1</version>
        </dependency>
    </dependencies>
    <executions>
        <execution>
            <phase>package</phase>
            <goals>
                <goal>proguard</goal>
            </goals>
        </execution>
    </executions>
    <configuration>
        <proguardVersion>5.2.1</proguardVersion>
        <obfuscate>true</obfuscate>
        <injarNotExistsSkip>true</injarNotExistsSkip>
        <injar>${project.build.finalName}.jar</injar>
        <outjar>${project.build.finalName}.jar</outjar>
        <options>
            <option>-keep public class org.package.engine.osgi.impl</option>
            <option>-keep public interface org.package.engine.osgi</option>
        </options>
        <exclusions>
            <exclusion>
                <groupId>com.sun.mail</groupId>
                <artifactId>javax.mail</artifactId>
            </exclusion>
        </exclusions>
        <libs>
            <lib>${java.home}/lib/rt.jar</lib>
            <lib>${java.home}/lib/jce.jar</lib>
            <lib>${java.home}/lib/ext/jfxrt.jar</lib>
        </libs>
    </configuration>
</plugin>

我在编译期间收到此错误

proguard jar: C:\Users\user\.m2\repository\net\sf\proguard\proguard-base\5.2.1\proguard-base-5.2.1.jar
     [proguard] ProGuard, version 5.2.1     
     [proguard] Reading library jar [C:\Users\user\.m2\repository\org\osgi\org.osgi.core\6.0.0\org.osgi.core-6.0.0.jar]
     [proguard] Reading library jar [C:\Users\user\.m2\repository\org\apache\karaf\shell\org.apache.karaf.shell.core\4.0.1\org.apache.karaf.shell.core-4.0.1.jar]
     [proguard] Reading library jar [C:\Users\user\.m2\repository\jline\jline\2.12\jline-2.12.jar]               
     .............         
     [proguard]       Maybe this is library method 'java.util.Comparators$NullComparator { java.util.Comparator reversed(); }'
     [proguard] Warning: there were 1 instances of library classes depending on program classes.
     [proguard]          You must avoid such dependencies, since the program classes will
     [proguard]          be processed, while the library classes will remain unchanged.
     [proguard]          (http://proguard.sourceforge.net/manual/troubleshooting.html#dependency)
     [proguard] Error: Please correct the above warnings first.
     [proguard] Note: there were 5 accesses to class members by means of introspection.
     [proguard]       You should consider explicitly keeping the mentioned class members
     [proguard]       (using '-keep' or '-keepclassmembers').
     [proguard]       (http://proguard.sourceforge.net/manual/troubleshooting.html#dynamicalclassmember)

完整的错误堆栈http://pastebin.com/hmhv0Yvs

Answer 1

没有尝试运行您的 POM，但在我看来，它会将 javax.mail 工件提取到您的 JAR 中，然后混淆包括 javax.mail 在内的所有 JAR，您就会遇到上述问题。

与其提取依赖关系，不如将其复制到META-INF/lib？ AFAIR 删除 ;inline=true 应该这样做。

Answer 2

问题来自 proguard-maven-plugin 配置中的 -keep 选项配置错误。您应该添加* 通配符以表明您希望保留您提到的包中的所有类/接口（请参阅usage page）。

更正的配置是：

<options>
    <option>-keep public class org.package.engine.osgi.impl.*</option>
    <option>-keep public interface org.package.engine.osgi.*</option>
</options>