Obfuscate jar with embedded jar

Question

I want to obfuscate jar with embedded jar for Java mail:

<dependency>
    <groupId>com.sun.mail</groupId>
    <artifactId>javax.mail</artifactId>
    <version>1.5.4</version>
    <type>jar</type>
</dependency>
......
<plugin>
    <groupId>org.apache.felix</groupId>
    <artifactId>maven-bundle-plugin</artifactId>
    <version>3.0.0</version>
    <extensions>true</extensions>
    <configuration>
        <instructions>
            <!-- Embed dependency into the bundle-->
            <Embed-Dependency>javax.mail;inline=true</Embed-Dependency>
            <Bundle-Version>${project.version}</Bundle-Version>
            <Bundle-SymbolicName>${project.artifactId}</Bundle-SymbolicName>
        </instructions>
    </configuration>
</plugin>

Proguard configuration

<plugin>
    <groupId>com.github.wvengen</groupId>
    <artifactId>proguard-maven-plugin</artifactId>
    <version>2.0.11</version>
    <dependencies>
        <dependency>
            <groupId>net.sf.proguard</groupId>
            <artifactId>proguard-base</artifactId>
            <version>5.2.1</version>
        </dependency>
    </dependencies>
    <executions>
        <execution>
            <phase>package</phase>
            <goals>
                <goal>proguard</goal>
            </goals>
        </execution>
    </executions>
    <configuration>
        <proguardVersion>5.2.1</proguardVersion>
        <obfuscate>true</obfuscate>
        <injarNotExistsSkip>true</injarNotExistsSkip>
        <injar>${project.build.finalName}.jar</injar>
        <outjar>${project.build.finalName}.jar</outjar>
        <options>
            <option>-keep public class org.package.engine.osgi.impl</option>
            <option>-keep public interface org.package.engine.osgi</option>
        </options>
        <exclusions>
            <exclusion>
                <groupId>com.sun.mail</groupId>
                <artifactId>javax.mail</artifactId>
            </exclusion>
        </exclusions>
        <libs>
            <lib>${java.home}/lib/rt.jar</lib>
            <lib>${java.home}/lib/jce.jar</lib>
            <lib>${java.home}/lib/ext/jfxrt.jar</lib>
        </libs>
    </configuration>
</plugin>

I get this error during compilation time

proguard jar: C:\Users\user\.m2\repository\net\sf\proguard\proguard-base\5.2.1\proguard-base-5.2.1.jar
     [proguard] ProGuard, version 5.2.1     
     [proguard] Reading library jar [C:\Users\user\.m2\repository\org\osgi\org.osgi.core\6.0.0\org.osgi.core-6.0.0.jar]
     [proguard] Reading library jar [C:\Users\user\.m2\repository\org\apache\karaf\shell\org.apache.karaf.shell.core\4.0.1\org.apache.karaf.shell.core-4.0.1.jar]
     [proguard] Reading library jar [C:\Users\user\.m2\repository\jline\jline\2.12\jline-2.12.jar]               
     .............         
     [proguard]       Maybe this is library method 'java.util.Comparators$NullComparator { java.util.Comparator reversed(); }'
     [proguard] Warning: there were 1 instances of library classes depending on program classes.
     [proguard]          You must avoid such dependencies, since the program classes will
     [proguard]          be processed, while the library classes will remain unchanged.
     [proguard]          (http://proguard.sourceforge.net/manual/troubleshooting.html#dependency)
     [proguard] Error: Please correct the above warnings first.
     [proguard] Note: there were 5 accesses to class members by means of introspection.
     [proguard]       You should consider explicitly keeping the mentioned class members
     [proguard]       (using '-keep' or '-keepclassmembers').
     [proguard]       (http://proguard.sourceforge.net/manual/troubleshooting.html#dynamicalclassmember)

Full error stack http://pastebin.com/hmhv0Yvs

Answer 1

Didn't try to run your POM, but as I see it, it extracts javax.mail artifact to your JAR, and then obfuscates all that JAR including javax.mail and you get the problems above.

Instead of extracting the dependency, why not copy it to META-INF/lib? AFAIR removing ;inline=true should do that.

Answer 2

The problem comes from a misconfiguration of your -keep options in the proguard-maven-plugin configuration. You should add the * wildcard to indicate that you want to keep all the classes / interfaces in the package you mentioned (refer to the usage page).

Corrected configuration would be:

<options>
    <option>-keep public class org.package.engine.osgi.impl.*</option>
    <option>-keep public interface org.package.engine.osgi.*</option>
</options>