Obfuscate the Plugin Jar

Hi,

I have a SonarQube Plugin which works on SonarQube version 8.4.2.36762 and higher. As we want to launch this plugin commercially, we would like to know what does SonarQube suggest in order to obfuscate the contents of the Jar to prevent it from decompilation use java decompilers.

We are trying to obfuscate the jar but that ends up breaking the SonarQube from startup. Can you please help guide on this.

I am getting this Error 2022.04.19 20:51:57 ERROR web[o.s.s.p.PlatformImpl] Web server startup failed: File is not a plugin. Please delete it and restart:

Regards,
Anudit

Hi,

Asking what is the best obfuscation tool for your needs is more a question for StackOverflow :slight_smile:

Likely the plugin manifest (META-INF/MANIFEST.MF) has been modified by your obfuscator. You have to be sure the attributes added by the Sonar Maven Packaging plugin have not been removed.
FYI the error is coming from here.

1 Like

Thank you for your response. I am using Proguard to obfuscate my jar. After tweaking around it a bit, I am now encountering the below error. Can you please let me know what is the issue now in the obfuscated jar as the original jar without obfuscation works perfectly fine.

java.lang.IllegalStateException: Unable to load component class package.a.a
	at org.sonar.core.platform.ComponentContainer$ExtendedDefaultPicoContainer.getComponent(ComponentContainer.java:66)
	at org.picocontainer.DefaultPicoContainer.getComponent(DefaultPicoContainer.java:621)
	at org.picocontainer.parameters.CollectionComponentParameter.getArrayInstance(CollectionComponentParameter.java:334)
	at org.picocontainer.parameters.CollectionComponentParameter.access$100(CollectionComponentParameter.java:49)
	at org.picocontainer.parameters.CollectionComponentParameter$1.resolveInstance(CollectionComponentParameter.java:139)
	at org.picocontainer.parameters.ComponentParameter$1.resolveInstance(ComponentParameter.java:141)
	at org.picocontainer.injectors.SingleMemberInjector.getParameter(SingleMemberInjector.java:78)
	at org.picocontainer.injectors.ConstructorInjector$CtorAndAdapters.getParameterArguments(ConstructorInjector.java:309)
	at org.picocontainer.injectors.ConstructorInjector$1.run(ConstructorInjector.java:335)
	at org.picocontainer.injectors.AbstractInjector$ThreadLocalCyclicDependencyGuard.observe(AbstractInjector.java:270)
	at org.picocontainer.injectors.ConstructorInjector.getComponentInstance(ConstructorInjector.java:364)
	at org.picocontainer.injectors.AbstractInjectionFactory$LifecycleAdapter.getComponentInstance(AbstractInjectionFactory.java:56)
	at org.picocontainer.behaviors.AbstractBehavior.getComponentInstance(AbstractBehavior.java:64)
	at org.picocontainer.behaviors.Stored.getComponentInstance(Stored.java:91)
	at org.picocontainer.DefaultPicoContainer.instantiateComponentAsIsStartable(DefaultPicoContainer.java:1034)
	at org.picocontainer.DefaultPicoContainer.addAdapterIfStartable(DefaultPicoContainer.java:1026)
	at org.picocontainer.DefaultPicoContainer.startAdapters(DefaultPicoContainer.java:1003)
	at org.picocontainer.DefaultPicoContainer.start(DefaultPicoContainer.java:767)
	at org.sonar.core.platform.ComponentContainer.startComponents(ComponentContainer.java:136)
	at org.sonar.server.platform.platformlevel.PlatformLevel.start(PlatformLevel.java:90)
	at org.sonar.server.platform.platformlevel.PlatformLevel4.start(PlatformLevel4.java:555)
	at org.sonar.server.platform.PlatformImpl.start(PlatformImpl.java:213)
	at org.sonar.server.platform.PlatformImpl.startLevel34Containers(PlatformImpl.java:187)
	at org.sonar.server.platform.PlatformImpl.access$500(PlatformImpl.java:46)
	at org.sonar.server.platform.PlatformImpl$1.lambda$doRun$0(PlatformImpl.java:120)
	at org.sonar.server.platform.PlatformImpl$AutoStarterRunnable.runIfNotAborted(PlatformImpl.java:370)
	at org.sonar.server.platform.PlatformImpl$1.doRun(PlatformImpl.java:120)
	at org.sonar.server.platform.PlatformImpl$AutoStarterRunnable.run(PlatformImpl.java:354)
	at java.base/java.lang.Thread.run(Thread.java:834)
Caused by: org.picocontainer.PicoCompositionException: Either the specified parameters do not match any of the following constructors: []; OR the constructors were not accessible for 'package.a.a'
	at org.picocontainer.injectors.ConstructorInjector.getGreediestSatisfiableConstructor(ConstructorInjector.java:200)
	at org.picocontainer.injectors.ConstructorInjector.getGreediestSatisfiableConstructor(ConstructorInjector.java:110)
	at org.picocontainer.injectors.ConstructorInjector.access$100(ConstructorInjector.java:51)
	at org.picocontainer.injectors.ConstructorInjector$1.run(ConstructorInjector.java:331)
	at org.picocontainer.injectors.AbstractInjector$ThreadLocalCyclicDependencyGuard.observe(AbstractInjector.java:270)
	at org.picocontainer.injectors.ConstructorInjector.getComponentInstance(ConstructorInjector.java:364)
	at org.picocontainer.injectors.AbstractInjectionFactory$LifecycleAdapter.getComponentInstance(AbstractInjectionFactory.java:56)
	at org.picocontainer.behaviors.AbstractBehavior.getComponentInstance(AbstractBehavior.java:64)
	at org.picocontainer.behaviors.Stored.getComponentInstance(Stored.java:91)
	at org.picocontainer.DefaultPicoContainer.getInstance(DefaultPicoContainer.java:699)
	at org.picocontainer.DefaultPicoContainer.getComponent(DefaultPicoContainer.java:647)
	at org.sonar.core.platform.ComponentContainer$ExtendedDefaultPicoContainer.getComponent(ComponentContainer.java:64)
	... 28 common frames omitted

I don’t know proguard, but a quick search seems to indicate you have to tell the tool to preserve empty constructors:

SonarQube IoC container requires components to have an accessible constructor.

Thanks Henry. I managed to solve it.

This topic was automatically closed 7 days after the last reply. New replies are no longer allowed.