java - 无法让 Proguard 混淆和 Spring Boot 一起工作

Question

摘要

我一直在尝试让 Proguard 与 Spring-boot 一起使用以进行混淆，但在使用 maven 构建后无法让 Spring-boot 运行。我搜索过，发现有人在谈论同样的问题，但我还没有看到它得到解决。

我有 2 个应用程序。

• A2 需要 A1
• A1

我只需要将混淆构建到A2中，但理想情况下我想将它构建到两者中。

我正在创建一个可执行文件 Spring-boot jar来运行A1和A3。

我可以让maven打包并创建可执行文件jar，但是当我运行它时，我得到下面的堆栈跟踪，说明压缩和嵌套的jar文件必须在不压缩的情况下存储。

问题

如何在不压缩嵌套 jar 的情况下让 proguard 构建我的应用程序？

谢谢

堆栈跟踪

   Exception in thread "main" java.lang.IllegalStateException: Unable to open    nested entry 'BOOT-INF/lib/commons-lang3-3.4.jar'. It has been compressed and nested jar files must be stored without compression. Please check the mechanism  used to create your executable jar file
        at org.springframework.boot.loader.c.k.e(JarFile.java:285)
        at org.springframework.boot.loader.c.k.c(JarFile.java:260)
        at org.springframework.boot.loader.c.k.a(JarFile.java:248)
        at org.springframework.boot.loader.c.k.a(JarFile.java:237)
        at org.springframework.boot.loader.a.c.a(JarFileArchive.java:103)
        at org.springframework.boot.loader.a.c.a(JarFileArchive.java:87)
        at org.springframework.boot.loader.a.c(ExecutableArchiveLauncher.java:72)
        at org.springframework.boot.loader.c.a(Launcher.java:49)
        at org.springframework.boot.loader.JarLauncher.main(JarLauncher.java:58)

POM 插件详细信息

<plugin>
   <groupId>com.github.wvengen</groupId>
   <artifactId>proguard-maven-plugin</artifactId>
   <version>2.0.13</version>
   <executions>
      <execution>
         <id>proguard</id>
         <phase>package</phase>
         <goals>
            <goal>proguard</goal>
         </goals>
      </execution>
   </executions>
   <configuration>
      <!-- File with proguard configuration -->
      <proguardInclude>${basedir}/proguard.conf</proguardInclude>
      <obfuscate>true</obfuscate>
      <libs>
         <lib>${java.home}/lib/rt.jar</lib>
         <lib>${java.home}/lib/jce.jar</lib>
      </libs>
      <options>
         <option>-optimizations !class/marking/final</option>
         <option>-adaptresourcefilecontents **.properties,META-INF/MANIFEST.MF,META-INF/spring.*</option>
         <option>-keepattributes Exceptions,InnerClasses,Signature,Deprecated,SourceFile,LineNumberTable,*Annotation*,EnclosingMethod</option>
         <option>-keepclasseswithmembers public class * { public static void main(java.lang.String[]);}</option>
      </options>
   </configuration>
   <dependencies>
      <dependency>
         <groupId>net.sf.proguard</groupId>
         <artifactId>proguard-base</artifactId>
         <version>5.2.1</version>
         <scope>runtime</scope>
      </dependency>
   </dependencies>
</plugin>

Proguard.conf

# Don't obfuscate or remove your entry point
-keep public class com.something.InitialRunner{public static void main(java.lang.String[]);}

-ignorewarnings
-dontoptimize
-dontshrink


# Uncomment if you want to have more meaningful backtraces
# Useful for obfuscation debugging
# You absolutely must keep this commented out for production
#-keepattributes SourceFile,LineNumberTable

Answer 1

正如我们在上面的评论中讨论的那样，我是这样处理这个问题的。

第一步:使用 maven-dependency-plugin 将依赖项复制到外部文件夹，如下所示:

 <build>
   <plugins>
     <plugin>
       <groupId>org.apache.maven.plugins</groupId>
       <artifactId>maven-dependency-plugin</artifactId>
         <executions>
           <execution>
             <id>copy-dependencies</id>
             <phase>package</phase>
             <goals>
               <goal>copy-dependencies</goal>
             </goals>
             <configuration>
               <outputDirectory> 
                 ${project.build.directory}/libs
               </outputDirectory>
               <overWriteReleases>false</overWriteReleases>
               <overWriteSnapshots>true</overWriteSnapshots>
               <overWriteIfNewer>true</overWriteIfNewer>
               <includeScope>runtime</includeScope>
              </configuration>
            </execution>
          </executions>
        </plugin>
    </plugins>
  </build>  

第二步:使用 Maven 执行您的 proguard。现在我不确定你使用的是哪个 proguard 插件，我使用 wvengen 的插件。

    <plugin>
       <groupId>com.github.wvengen</groupId>
       <artifactId>proguard-maven-plugin</artifactId>
       <version>2.0.12</version>
       <executions>
         <execution>
           <phase>package</phase>
           <goals>
             <goal>proguard</goal>
           </goals>
           <configuration>
             <obfuscate>true</obfuscate>
             <outputDirectory>target</outputDirectory>
             <proguardInclude>proguard.conf</proguardInclude>
             <libs>
               <lib>C:\Program Files\Java\jre1.8.0_65/lib/rt.jar</lib>
               <lib>C:\Program Files\Java\jre1.8.0_65/lib/jsse.jar</lib>
             </libs>
           </configuration>
         </execution>
       </executions>
    </plugin>

第三步:检查 proguard.conf 文件中是否列出了您的依赖项

# Use -libraryjars to list every jar found in the target/libs folder.

# Don't obfuscate or remove your entry point
-keep public class com.something.InitialRunner{public static void main(java.lang.String[]);}

-ignorewarnings
-dontoptimize
-dontshrink


# Uncomment if you want to have more meaningful backtraces
# Useful for obfuscation debugging
# You absolutely must keep this commented out for production
#-keepattributes SourceFile,LineNumberTable

考虑到可能有一种方法可以使用 Maven 自动执行此操作，这样您就不必手动添加它们，但这就是我处理它的方式。一旦我在混淆之前阻止 Spring 被包装在主 jar 中，那么应用程序就可以正常运行。