如何用proguard混淆Spring Boot App

Question

我试着通过proguard maven来混淆我的spring boot应用。Proguard已成功混淆jar文件。但是当我运行模糊jar文件时，我得到了这个错误；

java.lang.IllegalStateException: Unable to open nested entry 'lib/spring-boot-starter-data-jpa-1.2.4.RELEASE.jar'. It has been compressed and nested jar files must be stored without compression. Please check the mechanism used to create your executable jar file
    at org.springframework.boot.loader.jar.JarFile.createJarFileFromFileEntry(JarFile.java:378)
    at org.springframework.boot.loader.jar.JarFile.createJarFileFromEntry(JarFile.java:355)
    at org.springframework.boot.loader.jar.JarFile.getNestedJarFile(JarFile.java:341)
    at org.springframework.boot.loader.archive.JarFileArchive.getNestedArchive(JarFileArchive.java:108)
    at org.springframework.boot.loader.archive.JarFileArchive.getNestedArchives(JarFileArchive.java:92)
    at org.springframework.boot.loader.ExecutableArchiveLauncher.getClassPathArchives(ExecutableArchiveLauncher.java:74)
    at org.springframework.boot.loader.Launcher.launch(Launcher.java:60)
    at org.springframework.boot.loader.JarLauncher.main(JarLauncher.java:45)

这是我的pom.xml；

<plugin>
            <groupId>com.github.wvengen</groupId>
            <artifactId>proguard-maven-plugin</artifactId>
            <version>2.0.10</version>
            <executions>
                <execution>
                    <id>proguard</id>
                    <phase>package</phase>
                    <goals>
                        <goal>proguard</goal>
                    </goals>
                </execution>
            </executions>
            <configuration>
                <obfuscate>true</obfuscate>
                <injar>${project.build.finalName}.jar</injar>
                <outjar>${project.build.finalName}-pro.jar</outjar>
                <libs>
                    <lib>${java.home}/lib/rt.jar</lib>
                    <lib>${java.home}/lib/jce.jar</lib>
                </libs>
                <injarNotExistsSkip>true</injarNotExistsSkip>
                <options>
                    <option>-adaptresourcefilecontents **.properties,META-INF/MANIFEST.MF,META-INF/spring.*</option>
                    <option>-keepattributes
                        Exceptions,InnerClasses,Signature,Deprecated,SourceFile,LineNumberTable,*Annotation*,EnclosingMethod
                    </option>
                    <option>-keepclasseswithmembers public class * { public static void main(java.lang.String[]);}
                    </option>
                    <option>-keepclassmembers class * {
                        @org.springframework.beans.factory.annotation.Autowired *;
                        @org.springframework.beans.factory.annotation.Value *;
                        }
                    </option>
                    <option>-keep class javax.** { *; }</option>
                    <option>-keep class org.** { *; }</option>
                    <option>-keep class com.** { *; }</option>
                    <option>-keep class commons-io.** { *; }</option>
                    <option>-keep class commons-codec.** { *; }</option>
                    <option>-keep class ommons-collections.** { *; }</option>
                    <option>-keep class commons-dbcp.** { *; }</option>
                    <option>-keep class cglib.** { *; }</option>
                    <option>-keep class postgresql.** { *; }</option>
                    <option>-keep class commons-validator.** { *; }</option>
                    <option>-keep class org.springframework.**</option>
                </options>
            </configuration>
            <dependencies>
                <dependency>
                    <groupId>net.sf.proguard</groupId>
                    <artifactId>proguard-base</artifactId>
                    <version>5.2.1</version>
                    <scope>runtime</scope>
                </dependency>
            </dependencies>
        </plugin>

我忽略了所有的第三方依赖；

               <option>-keep class javax.** { *; }</option>
                <option>-keep class org.** { *; }</option>
                <option>-keep class com.** { *; }</option>
                <option>-keep class commons-io.** { *; }</option>
                <option>-keep class commons-codec.** { *; }</option>
                <option>-keep class ommons-collections.** { *; }</option>
                <option>-keep class commons-dbcp.** { *; }</option>
                <option>-keep class cglib.** { *; }</option>
                <option>-keep class postgresql.** { *; }</option>
                <option>-keep class commons-validator.** { *; }</option>
                <option>-keep class org.springframework.**</option>

但这并不管用。我也尝试了proguard.conf，但我得到了同样的结果。谢谢你的帮助。

Answer 1

您不需要为您正在使用的所有库jars添加-keep选项。只需保留spring boot应用程序的main方法，并保留属性和目录结构即可。下面的conf应该可以工作：

# Keeps the directory structure intact.
# Spring's @ComponentScan needs the specified directory structure at runtime as well.
-keepdirectories

-keep public class * { public static void main(java.lang.String[]);}

-keepattributes Exceptions,InnerClasses,Signature,Deprecated,SourceFile,LineNumberTable,*Annotation*,EnclosingMethod