4

I am currently trying to obfuscate my Eclipse RCP application with ProGuard. The problem is that it obfuscates the package names (the class My.Package.Class turns into something like a.b.c), but keeps the package names in the Export-Package section of MANIFEST.MF.

This leads to the fact that my application (which is a set of OSGi-bundles, actually) cannot be run, as the package names specified in Export-Package section of MANIFEST.MFs cannot be resolved.

Has anybody had any success with ProGuard obfuscating an OSGi-based RCP application? Basically, I see two choices: either completely turn off package names obfuscation, or obfucate MANIFEST.MF's Export-Package section, but I can't find the way to implement any of them. Proguard seems to obfuscate only Bundle-Activator class name in MANIFEST.MF, skipping all other sections. Thanks in advance!

Sergey Borodavkin
  • 285
  • 1
  • 3
  • 7

3 Answers3

7

Turn off package name obfuscation; I mean what important business values are you exposing by telling the world the package names?

If that really is an issue, move all code into a fully obfuscated library and use the library in a non-obfuscated plugin.

That said, consider not wasting your time with obfuscation at all. It will cost you time and money and it's questionable whether there is any benefit. At the time when your competitors have started to disassemble your valuable work, you will be writing the next version. So why bother?

Aaron Digulla
  • 321,842
  • 108
  • 597
  • 820
  • Aaron, thank you for your answer! As I said, turning off the package names obfuscation would work, but I don't know how to implement this (and if this can be achieved at all) with Proguard... To obfuscate or not to obfuscate - this is not the choice. Our customer wants this :) – Sergey Borodavkin Mar 20 '09 at 06:23
  • In that case, use my second suggestion. – Aaron Digulla Mar 20 '09 at 08:26
  • Thank you! I have followed your proposition and joined all modules into one megabundle, eliminating in such way all inter-module dependencies causing the troubles. It worked. – Sergey Borodavkin Mar 23 '09 at 12:46
  • There is definitely some benefit when the bundle will run on embedded platforms. And yes, OSGi is used in the embedded world. – dolmen Feb 27 '13 at 17:13
  • I'm shocked with such bad answer from more experienced user then I am. First of all - obfuscating is a important to to secure the code from competitors. The second point - osgi is a very importand architectural solution with a lot consequences and conditions. So it's clear that using obfuscating + osgi will require special ways, for example storing name keys in special files for every bundle. –  May 28 '15 at 12:53
  • @iJava Just saying that obfuscation is important doesn't make it so. Some proof, please. – Aaron Digulla May 28 '15 at 13:18
  • Ok. Program = design + programming. Good design is 90% of th success of the project. Good design depends on the quality how well all elements of architecture were defined and linked together. By other words names+functionality+relations. If you give not obfuscated code you give all the design of the project. That's all. –  May 28 '15 at 13:22
  • @iJava: Giving someone the source code for my product doesn't mean that they can steal business from me. They still have to understand the product, lure customers to their place, ... Obfuscation is overrated. If you think you need it, you have bigger problems (like quality) which you should solve first. If you already have happy customers, obfuscation won't make you sell more. – Aaron Digulla May 28 '15 at 13:28
  • @Aaron Digulla You are talking quite a different thing. I am talking about close source projects. The idea to obfucate code is not to hide bad code but to protect our intellectual property. And again this is not the question about licencing. Example - Russia Federation will export new tanks only to those customers which will buy from 100 tanks. Official explanation - we will not sell one tank in order it to be disassembled and studied. –  May 28 '15 at 13:33
0

OSGi bundle obfuscation is not supported built-in by ProGuard. Check the Proguard feature request #135 for more info.

dolmen
  • 8,126
  • 5
  • 40
  • 42
0

Use the following keep options for the OSGI declarative service

#Keep all annotations.
-keepattributes *Annotation*,Exceptions
#Keep all interfaces. This is required to run OSGi services.
-keep public interface *
#Keep all Component classes
-keep @org.osgi.service.component.annotations.Component class *
#Kepp all Component classes member functions with OSGi specific annotations
-keepclassmembers @org.osgi.service.component.annotations.Component class * {
   #Keep all methods with annotatios Reference.
   @org.osgi.service.component.annotations.Reference *;
   #Keep all methods with annotatios Activate.
   @org.osgi.service.component.annotations.Activate *;
}
jfk
  • 4,335
  • 34
  • 27