Multi Module Maven Project with Obfuscation

Warning! 

This article is not up-to-date anymore and might be inaccurate. Please refer to following post.

http://huseyinabanozeng.blogspot.com/2018/07/obfuscating-spring-boot-projects-using.html

This article is an extension to article named Multi Module Maven Project Using Assembly Plugin. Assembly module is added with obfuscation configuration.

Obfuscation is a technique to make byte code harder to reverse engineer to protect source code. In Java word there are not many freeware obfuscation tools. One of the well known obfuscation tools is named proguard. It has a nice maven plugin. But I could not make proguard-base 4.10 work. It gave ClassNotFoundErrors due to worngly obfuscated class names.

Another option is yguard from yworks. Yguard has an ant task and works with maven ant-run plugin as well. My experience with yguard is pretty well, it works just fine.

Below is the pom file for assembly module with obfuscation configuration.

<?xml version="1.0" encoding="UTF-8" standalone="no"?>

<project xmlns="http://maven.apache.org/POM/4.0.0"

xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"

         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">

    <parent>

        <artifactId>myproject</artifactId>

        <groupId>com.mygroup</groupId>

        <version>1.0</version>

    </parent>

    <modelVersion>4.0.0</modelVersion>

    <artifactId>myproject-assembly</artifactId>

    <packaging>pom</packaging>

    <dependencies>

        <dependency>

            <artifactId>myproject-module2</artifactId>

            <groupId>com.mygroup</groupId><!-- Before first build 'LATEST' may cause errors, replace it with a valid version number and build.

            After  a successful build, LATEST is good to go again. -->

            <version>LATEST</version>

            <scope>compile</scope>

        </dependency>

    </dependencies>

    <build>

        <plugins>

            <plugin>

                <artifactId>maven-assembly-plugin</artifactId>

                <executions>

                    <execution>

                        <id>make-bundles</id>

                        <goals>

                            <goal>single</goal>

                        </goals>

                        <phase>package</phase>

                        <configuration>

                            <finalName>${project.build.finalName}</finalName>

                            <appendAssemblyId>false</appendAssemblyId>

                            <descriptors>

                                <descriptor>src/assembly/bin.xml</descriptor>

                            </descriptors>

                        </configuration>

                    </execution>

                </executions>

            </plugin>

            <plugin>

                <artifactId>maven-dependency-plugin</artifactId>

                <executions>

                    <execution>

                        <phase>install</phase>

                        <goals>

                            <goal>copy-dependencies</goal>

                        </goals>

                        <configuration>

                            <outputDirectory>${project.build.directory}/lib</outputDirectory>

                        </configuration>

                    </execution>

                </executions>

            </plugin>

            <plugin>

                <artifactId>maven-antrun-plugin</artifactId>

                <version>1.7</version>

                <executions>

                    <execution>

                        <phase>install</phase>

                        <configuration>

                            <target>

                              <!-- make a fileset of the libraries, these are not obfuscated -->

                                <path id="external.lib.path">

                               <fileset dir="${project.build.directory}\lib" includes="*.jar"/>

                                </path>

 <taskdef name="yguard" classname="com.yworks.yguard.YGuardTask" classpath="yguard/yguard.jar"/>

                                <yguard>

                                    <externalclasses refid="external.lib.path"/><inoutpair in="target/${project.build.finalName}.jar" out="target/${project.build.finalName}_obfuscated.jar"/>

                                    <shrink logfile="${project.build.directory}\yguard.log.xml">

                                        <property name="error-checking" value="pedantic"/>

                                    </shrink>

                                    <!-- keep name of main class and main method --><rename mainclass="com.mygroup.myproject.module2.Main" logfile="${project.build.directory}\yguard.log.xml" replaceClassNameStrings="true">

                                        <property name="error-checking" value="pedantic"/>

                                        <!-- plain-text class names in the config files will -->

                                        <!-- be replaced with the obfuscated name versions -->

                                        <!--adjust replaceContent="true">

                                            <include name="**/*.xml"/>

                                            <include name="**/*.properties"/>

                                        </adjust-->

                            <!-- keep the complete path to the resources, (gifs...) even if

                                  package com.mycompany.myapp gets obfuscated by name -->

                                        <!--adjust replacePath="false">

                                            <include name="com/pkg/persistence/*"/>

                                        </adjust-->

                              <!-- Replace the .properties files' names with the obfuscated -->

                              <!-- versions if the corresponding .class files get obfuscated -->

                                        <!--adjust replaceName="true">

                                            <include name="**/*.properties"/>

                                        </adjust-->

                                        <keep>

                                            <class classes="public" methods="public">

                                                <patternset>

<!—include name="com.mygroup.myproject.module1.**.*"/-->

<!-- spring configuration files refers classes in following packages --><include name="com.mygroup.myproject.module1.model.*"/><include name="com.mygroup.myproject.module1.dao.*"/><include name="com.mygroup.myproject.module2.service.**.*"/>

                                                </patternset>

                                            </class>

                                        </keep>

                                    </rename>

                                </yguard>

                            </target>

                        </configuration>

                        <goals>

                            <goal>run</goal>

                        </goals>

                    </execution>

                </executions>

            </plugin>

        </plugins>

    </build>

</project>

All project files can be downloaded from here.