Proguard in a Maven + Spring 3 big Web Application

Question

I have been trying all day to obfuscate the web application we are developing (we are going to allow big clients to host it on their servers) and after surfing, searching and trying a lot I am unable to reduce the number of errors I receive: "there were 7283 unresolved references to classes or interfaces"

I started from 20K so I managed to get some improvements...

This is the pom config I am using:

<plugin>
                <groupId>com.github.wvengen</groupId>
                <artifactId>proguard-maven-plugin</artifactId>
                <executions>
                    <execution>
                        <phase>package</phase>
                        <goals>
                            <goal>proguard</goal>
                        </goals>
                    </execution>
                </executions>
                <dependencies>
                    <dependency>
                        <groupId>net.sf.proguard</groupId>
                        <artifactId>proguard-base</artifactId>
                        <version>4.8</version>
                        <scope>runtime</scope>
                    </dependency>
                </dependencies>             
                <configuration>
                    <obfuscate>true</obfuscate>
                    <includeDependency>true</includeDependency>
                    <options>
                        <option>-target 1.6</option>                    
                        <option>-allowaccessmodification</option>
                        <option><![CDATA[
                            -keep public class * {
                                public <init>(...);  
                                public void set*(...); 
                                public void init*(...); 
                                public void close*(...); 
                                public ** get*(...); 
                                public boolean is*(...); 
                                public boolean can*(...); 
                            } 
                            ]]></option>
                        <option><![CDATA[
                            -keepclassmembers class * { 
                                @javax.inject.Inject *; 
                                @javax.inject.Named *; 
                                @org.springframework.beans.factory.annotation.Autowired *; 
                                @org.springframework.beans.factory.annotation.Qualifier *; 
                                @org.springframework.beans.factory.annotation.Value *; 
                                @org.springframework.beans.factory.annotation.Required *;
                            }
                            ]]></option>                            
                        <option>-keep @org.springframework.stereotype.Service class *</option>
                        <option>-keep @org.springframework.stereotype.Controller class * </option>
                        <option>-keep @org.springframework.stereotype.Component class * </option>
                        <option>-keep @org.springframework.stereotype.Repository class *</option>
                    </options>
                    <inFilter>com/proton/**,!com/proton/protocol/**</inFilter>
                    <injar>${build.warname}.${project.packaging}</injar>
                    <outjar>${build.warname}-proguarded.${project.packaging}</outjar>
                    <outputDirectory>${project.build.directory}</outputDirectory>
                    <addMavenDescriptor>false</addMavenDescriptor>
                    <libs>
                        <lib>${java.home}/lib/rt.jar</lib>
                        <lib>${java.home}/lib/jce.jar</lib>                      
                        <lib>${java.home}/lib/jsse.jar</lib>
                    </libs>
                    <proguardVersion>4.8</proguardVersion>
                </configuration>
            </plugin>

And a big part of the result log: https://raw.github.com/gist/3708235/37b4cada40fa4742fd1e3ef0f24efd69fa232b28/Proguard

It seems that at least a big chunk of the errors are from spring libraries, I am sure I must work a lot with keep rules to fix some dynamic calls but I will be great if someone could help with all this errors.

Answer 1

I forgot I had this question open, this is the setup we are using right now:

<plugin>
            <groupId>com.github.wvengen</groupId>
            <artifactId>proguard-maven-plugin</artifactId>
            <executions>
                <execution>
                    <phase>package</phase>
                    <goals>
                        <goal>proguard</goal>
                    </goals>
                </execution>
            </executions>
            <dependencies>
                <dependency>
                    <groupId>net.sf.proguard</groupId>
                    <artifactId>proguard-base</artifactId>
                    <version>4.8</version>
                    <scope>runtime</scope>
                </dependency>
            </dependencies>             
            <configuration>
                <obfuscate>true</obfuscate>
                <includeDependency>true</includeDependency>
                <options>
                    <option>-target 1.6</option>                    
                    <option>-dontoptimize</option>
                    <option>-keepdirectories</option>
                    <option>-renamesourcefileattribute SourceFile</option>
                    <option>-keepparameternames</option>
                    <option>-keepattributes Exceptions,InnerClasses,Signature,Deprecated,SourceFile,LineNumberTable,*Annotation*,EnclosingMethod</option>
                    <option><![CDATA[
                        -keep public class com.proton.commons.** { public protected *; }
                        ]]></option>    
                            <!-- Here comes a lot of interface packages, public classes, etc as the last one -->    
                    <option><![CDATA[
                        -keepclassmembers enum * {
                            public static **[] values();
                            public static ** valueOf(java.lang.String);
                        }                       
                        ]]></option>        
                    <option><![CDATA[
                        -keepclassmembers class * { 
                            @org.springframework.beans.factory.annotation.Autowired *; 
                            @org.springframework.beans.factory.annotation.Qualifier *; 
                            @org.springframework.beans.factory.annotation.Value *; 
                            @org.springframework.beans.factory.annotation.Required *;
                            @org.springframework.context.annotation.Bean *;
                            @javax.annotation.PostConstruct *;
                            @javax.annotation.PreDestroy *;
                            @org.aspectj.lang.annotation.AfterReturning *;
                            @org.aspectj.lang.annotation.Pointcut *;
                            @org.aspectj.lang.annotation.AfterThrowing *;
                            @org.aspectj.lang.annotation.Around *;
                        }
                        ]]></option>                            
                    <option>-keep @org.springframework.stereotype.Service class *</option>
                    <option>-keep @org.springframework.stereotype.Controller class * </option>
                    <option>-keep @org.springframework.stereotype.Component class * </option>
                    <option>-keep @org.springframework.stereotype.Repository class *</option>
                    <option>-keep @org.springframework.cache.annotation.EnableCaching class *</option>
                    <option>-keep @org.springframework.context.annotation.Configuration class *</option>
                 <!-- Custom annotation -->
                    <option>-keep @com.proton.ks.aop.ProtonLogging class *</option>
                    <option>-keep @org.aspectj.lang.annotation.Aspect class *</option>
                    <option>-keep @java.lang.annotation.Retention class *</option>
                    <option>-keep @java.lang.annotation.Target class *</option>
                    <option>-dontwarn javax.**</option>
                    <option>-dontnote com.proton.ks.preferences.PreferenceFactory</option>
                </options>
                <addMavenDescriptor>false</addMavenDescriptor>
                <libs>
                    <lib>${java.home}/lib/rt.jar</lib>
                    <lib>${java.home}/lib/jce.jar</lib>                      
                    <lib>${java.home}/lib/jsse.jar</lib>
                    <lib>${java.home}/lib/ext/sunjce_provider.jar</lib>
                </libs>
                <proguardVersion>4.8</proguardVersion>
            </configuration>
        </plugin>

Answer 2

I have solved a lot of my problems using -dontskipnonpubliclibraryclasses.