How to obfuscate webapp using Maven and ProGuard

Question

I am using Maven and the maven-war plugin to create my WAR. All JSPs are precompiled using the jspc-maven-plugin, and all classes are placed in the JAR (WEB-INF / lib). So far, everything is working fine. Now I am trying to configure proguard-maven-plugin to confuse my code.

At first I tried to obfuscate all classes during the compilation phase, but then I had problems with JSP precompilation. I found some examples where the phase of the package is defined. But in this case, I do not know how to access my JAR file, which is alrady, packaged in a WAR. Finally, I tried just setting my WAR as <injar> mywebapp.war </injar>. But that doesn't work either. What am I missing?

<plugin> <groupId>com.pyx4me</groupId> <artifactId>proguard-maven-plugin</artifactId> <version>2.0.4</version> <executions> <execution> <phase>package</phase> <goals> <goal>proguard</goal> </goals> </execution> </executions> <configuration> <obfuscate>true</obfuscate> <includeDependency>false</includeDependency> <injar>${project.artifactId}-v${project.version}.war</injar> <outjar>${project.artifactId}-v${project.version}-obf.war</outjar> <outputDirectory>${project.build.directory}</outputDirectory> <maxMemory>256m</maxMemory> <libs> <!-- Java Runtime --> <lib>${java.home}/../Classes/classes.jar</lib> <lib>${java.home}/../Classes/jce.jar</lib> </libs> <options> <option>-allowaccessmodification</option> <option>-dontskipnonpubliclibraryclasses</option> <option>-dontskipnonpubliclibraryclassmembers</option> </options> </configuration> </plugin> 

Do you have any hints, examples for this?

Thank you so much! David

Answer 1

Take a look at the Maven lifecycles that are available. In particular, the default life cycle. The problem you may encounter is that Maven may guarantee some plugins, such as bank and military plugins, but other plugins, such as your proguard plugin, may not work.

I think that if you change the execution phase from package to prepare-package , this should confuse the JSP files before they are packed into a JAR file and then into a WAR file. And this phase should not interfere with the compilation of any classes that you may have.