无法让 Proguard 混淆和 Spring Boot 一起工作

Question

总结

我一直试图让Proguard 与Spring-boot 一起为obfuscation 工作，但在使用maven 构建后无法让Spring-boot 运行。我已经搜索并发现有人在谈论相同的问题，但我没有看到它已解决。

我有 2 个应用程序。

• A2 需要 A1
• A1

我只需要将obfuscation 构建到 A2 中，但理想情况下我想将它构建到两者中。

我正在创建一个 executable Spring-boot jar 来运行 A1 和 A3。

我可以让maven 打包并创建executable jar，但是当我运行它时，我得到下面的堆栈跟踪说compressed and nested jar files must be stored without compression。

问题

如何在不压缩嵌套 jar 的情况下让 proguard 构建我的应用程序？

谢谢

堆栈跟踪

   Exception in thread "main" java.lang.IllegalStateException: Unable to open    nested entry 'BOOT-INF/lib/commons-lang3-3.4.jar'. It has been compressed and nested jar files must be stored without compression. Please check the mechanism  used to create your executable jar file
        at org.springframework.boot.loader.c.k.e(JarFile.java:285)
        at org.springframework.boot.loader.c.k.c(JarFile.java:260)
        at org.springframework.boot.loader.c.k.a(JarFile.java:248)
        at org.springframework.boot.loader.c.k.a(JarFile.java:237)
        at org.springframework.boot.loader.a.c.a(JarFileArchive.java:103)
        at org.springframework.boot.loader.a.c.a(JarFileArchive.java:87)
        at org.springframework.boot.loader.a.c(ExecutableArchiveLauncher.java:72)
        at org.springframework.boot.loader.c.a(Launcher.java:49)
        at org.springframework.boot.loader.JarLauncher.main(JarLauncher.java:58)

POM 插件详情

<plugin>
   <groupId>com.github.wvengen</groupId>
   <artifactId>proguard-maven-plugin</artifactId>
   <version>2.0.13</version>
   <executions>
      <execution>
         <id>proguard</id>
         <phase>package</phase>
         <goals>
            <goal>proguard</goal>
         </goals>
      </execution>
   </executions>
   <configuration>
      <!-- File with proguard configuration -->
      <proguardInclude>${basedir}/proguard.conf</proguardInclude>
      <obfuscate>true</obfuscate>
      <libs>
         <lib>${java.home}/lib/rt.jar</lib>
         <lib>${java.home}/lib/jce.jar</lib>
      </libs>
      <options>
         <option>-optimizations !class/marking/final</option>
         <option>-adaptresourcefilecontents **.properties,META-INF/MANIFEST.MF,META-INF/spring.*</option>
         <option>-keepattributes Exceptions,InnerClasses,Signature,Deprecated,SourceFile,LineNumberTable,*Annotation*,EnclosingMethod</option>
         <option>-keepclasseswithmembers public class * { public static void main(java.lang.String[]);}</option>
      </options>
   </configuration>
   <dependencies>
      <dependency>
         <groupId>net.sf.proguard</groupId>
         <artifactId>proguard-base</artifactId>
         <version>5.2.1</version>
         <scope>runtime</scope>
      </dependency>
   </dependencies>
</plugin>

Proguard.conf

# Don't obfuscate or remove your entry point
-keep public class com.something.InitialRunner{public static void main(java.lang.String[]);}

-ignorewarnings
-dontoptimize
-dontshrink


# Uncomment if you want to have more meaningful backtraces
# Useful for obfuscation debugging
# You absolutely must keep this commented out for production
#-keepattributes SourceFile,LineNumberTable

Answer 1

正如我们在上面的 cmets 中所讨论的，这就是我的处理方式。

第一步：使用 maven-dependency-plugin 将您的依赖项复制到外部文件夹，如下所示：

 <build>
   <plugins>
     <plugin>
       <groupId>org.apache.maven.plugins</groupId>
       <artifactId>maven-dependency-plugin</artifactId>
         <executions>
           <execution>
             <id>copy-dependencies</id>
             <phase>package</phase>
             <goals>
               <goal>copy-dependencies</goal>
             </goals>
             <configuration>
               <outputDirectory> 
                 ${project.build.directory}/libs
               </outputDirectory>
               <overWriteReleases>false</overWriteReleases>
               <overWriteSnapshots>true</overWriteSnapshots>
               <overWriteIfNewer>true</overWriteIfNewer>
               <includeScope>runtime</includeScope>
              </configuration>
            </execution>
          </executions>
        </plugin>
    </plugins>
  </build>  

第二步：使用 Maven 来执行你的 proguard。现在我不确定你用的是哪个 proguard 插件，我用的是 wvengen 的那个。

    <plugin>
       <groupId>com.github.wvengen</groupId>
       <artifactId>proguard-maven-plugin</artifactId>
       <version>2.0.12</version>
       <executions>
         <execution>
           <phase>package</phase>
           <goals>
             <goal>proguard</goal>
           </goals>
           <configuration>
             <obfuscate>true</obfuscate>
             <outputDirectory>target</outputDirectory>
             <proguardInclude>proguard.conf</proguardInclude>
             <libs>
               <lib>C:\Program Files\Java\jre1.8.0_65/lib/rt.jar</lib>
               <lib>C:\Program Files\Java\jre1.8.0_65/lib/jsse.jar</lib>
             </libs>
           </configuration>
         </execution>
       </executions>
    </plugin>

第三步：检查你的依赖项是否列在 proguard.conf 文件中

# Use -libraryjars to list every jar found in the target/libs folder.

# Don't obfuscate or remove your entry point
-keep public class com.something.InitialRunner{public static void main(java.lang.String[]);}

-ignorewarnings
-dontoptimize
-dontshrink


# Uncomment if you want to have more meaningful backtraces
# Useful for obfuscation debugging
# You absolutely must keep this commented out for production
#-keepattributes SourceFile,LineNumberTable

鉴于可能有一种方法可以使用 Maven 自动执行此操作，这样您就不必手动添加它们，但这就是我处理它的方式。一旦我在混淆之前阻止 Spring 被包装在主 jar 中，那么应用程序就可以正常运行了。