How do I obfuscate a WAR project which contains multiple other JARs using maven?

Question

I'm trying to find a way to obfuscate a WAR packaged project that is built with maven using Proguard (open to other tools).

I have /WEB-INF/lib/ directory that contains all the jars that the application depends on and the webapp under /WEB-INF/classes/

I tried passing the WAR file directly to proguard but was told it won't work, that I need to work with jars (I was getting 50k warnings).

I passed the webapp jar to proguard and it works, however, I need all the related dependencies to be obfuscated as well and here I don't know how to keep going.

Shall I copy all dependencies into a folder along with the webapp jar, obfuscate them and then insert them into the war? Somehow I feel maven is not the right tool for this kind of job. Basically I need a step in between jar and war packaging that produces an obfuscated output of all the jars.

Asking to whoever had the curse task of doing something similar.

Answer 1

you will need to use a third party tool like Proguard

• first you will need to add proguard to your pom.xml

   

     <build>
        <plugins>
            <plugin>
                <groupId>com.github.wvengen</groupId>
                <artifactId>proguard-maven-plugin</artifactId>
                <version>2.0.14</version>
                <executions>
                    <execution>
                        <phase>package</phase>
                        <goals>
                            <goal>proguard</goal>
                        </goals>
                    </execution>
                </executions>
                <configuration>
                    <!-- Proguard configuration options go here -->
                </configuration>
            </plugin>
        </plugins>
    </build>

• create configuration file for proguard in the root of your project proguard.conf

      -dontshrink
  -dontoptimize
  -keep class your.package.name.** { *; }
  

• Configure Maven to use proguard

      <configuration>
      <proguardInclude>${basedir}/proguard.conf</proguardInclude>
  </configuration>
  

• build and run