fvarrui / JavaPackager

:package: Gradle/Maven plugin to package Java applications as native Windows, MacOS, or Linux executables and create installers for them.
GNU General Public License v3.0
1.07k stars 133 forks source link

javapackager packaging and security #416

Closed 7ye closed 1 month ago

7ye commented 5 months ago

I have a security-related question. After packaging a Java application into an .exe using javapackager, the executable can be opened with compression tools, revealing all the source code and Maven metadata. This allows others to easily copy the code, open it in an IDE like IntelliJ IDEA, and compile it into their own program. How can I address this issue?

fvarrui commented 4 months ago

Hi @7ye!

I have a security-related question. After packaging a Java application into an .exe using javapackager, the executable can be opened with compression tools, revealing all the source code and Maven metadata. This allows others to easily copy the code, open it in an IDE like IntelliJ IDEA, and compile it into their own program. How can I address this issue?

Yes, that's how it works ... and to be accurate, it's not source code, but bytecode (easily decompilable 😞 ).

AFAIK, only thing you can do is to obfuscate your code before packaging. You can build your own JAR, obfuscate it and then pass your obfuscated JAR to JavaPackager using its runnableJar property. The only thing this does is make it difficult for vultures or those curious about the code.

I hope it helps!