13 Star 63 Fork 34

杨昌沛 / xjar-maven-plugin

加入 Gitee
与超过 1200万 开发者一起发现、参与优秀开源项目,私有仓库也完全免费 :)
免费加入
克隆/下载
贡献代码
同步代码
取消
提示: 由于 Git 不支持空文件夾,创建文件夹后会生成空的 .keep 文件
Loading...
README
Apache-2.0

XJar-Maven-Plugin

XJar-Maven-Plugin 是对 XJar 的一个Maven Plugin封装,实现可通过Maven命令或绑定在Maven构建的生命周期之中执行,用以更加便捷的方式集成 XJar

GitHub: https://github.com/core-lib/xjar-maven-plugin

什么是XJar

XJar 是基于对JAR包内资源的加密以及拓展ClassLoader来构建的一套程序加密启动,动态解密运行的方案,避免源码泄露或反编译,支持Spring Boot JAR 安全加密运行,同时支持的原生JAR。 更多文档请点击:XJar

环境依赖

JDK 1.7 +

集成步骤

<project>
    <!-- 设置 jitpack.io 插件仓库 -->
    <pluginRepositories>
        <pluginRepository>
            <id>jitpack.io</id>
            <url>https://jitpack.io</url>
        </pluginRepository>
    </pluginRepositories>
    <!-- 添加 XJar Maven 插件 -->
    <build>
        <plugins>
            <plugin>
                <groupId>com.github.core-lib</groupId>
                <artifactId>xjar-maven-plugin</artifactId>
                <version>4.0.1</version>
                <executions>
                    <execution>
                        <goals>
                            <goal>build</goal>
                        </goals>
                        <phase>package</phase>
                        <configuration>
                            <password>io.xjar</password>
                            <!-- optional
                            <algorithm/>
                            <keySize/>
                            <ivSize/>
                            <includes>
                                <include/>
                            </includes>
                            <excludes>
                                <exclude/>
                            </excludes>
                            <sourceDir/>
                            <sourceJar/>
                            <targetDir/>
                            <targetJar/>
                            -->
                        </configuration>
                    </execution>
                </executions>
            </plugin>
        </plugins>
    </build>
</project>

也可以通过Maven命令单独执行 XJar 插件

mvn xjar:build -Dxjar.password=io.xjar
mvn xjar:build -Dxjar.password=io.xjar -Dxjar.targetDir=/directory/to/save/target.xjar

但通常情况下是让XJar插件绑定到指定的phase中自动执行,这样就能在项目构建的时候自动构建出加密的包。

mvn clean package -Dxjar.password=io.xjar
mvn clean install -Dxjar.password=io.xjar -Dxjar.targetDir=/directory/to/save/target.xjar

强烈建议

强烈建议不要在 pom.xml 的 xjar-maven-plugin 配置中写上密码,这样会导致打包出来的 xjar 包中的 pom.xml 文件保留着密码,极其容易暴露密码!强烈推荐通过 mvn 命令来指定加密密钥!

注意事项

不兼容 spring-boot-maven-plugin 的 executable = true 以及 embeddedLaunchScript

<plugin>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-maven-plugin</artifactId>
    <!-- 需要将executable和embeddedLaunchScript参数删除,目前还不能支持对该模式Jar的加密!后面可能会支持该方式的打包。 
    <configuration>
        <executable>true</executable>
        <embeddedLaunchScript>...</embeddedLaunchScript>
    </configuration>
    -->
</plugin>

参数说明

参数名称 命令参数名称 参数说明 参数类型 缺省值 示例值
password -Dxjar.password 密码字符串 String 必须 任意字符串,io.xjar
algorithm -Dxjar.algorithm 加密算法名称 String AES/CBC/PKCS5Padding JDK内置加密算法,如:AES/CBC/PKCS5Padding 和 DES/CBC/PKCS5Padding
keySize -Dxjar.keySize 密钥长度 int 128 根据加密算法而定,56,128,256
ivSize -Dxjar.ivSize 密钥向量长度 int 128 根据加密算法而定,128
sourceDir -Dxjar.sourceDir 源jar所在目录 File ${project.build.directory} 文件目录
sourceJar -Dxjar.sourceJar 源jar名称 String ${project.build.finalName}.jar 文件名称
targetDir -Dxjar.targetDir 目标jar存放目录 File ${project.build.directory} 文件目录
targetJar -Dxjar.targetJar 目标jar名称 String ${project.build.finalName}.xjar 文件名称
includes -Dxjar.includes 需要加密的资源路径表达式 String[] com/company/project/** , mapper/*Mapper.xml , 支持Ant表达式
excludes -Dxjar.excludes 无需加密的资源路径表达式 String[] static/** , META-INF/resources/** , 支持Ant表达式
deletes -Dxjar.deletes 加密后删除指定资源路径表达式 String[] target/*.jar, ../module/target/*.jar, 支持Ant表达式
  • 指定加密算法的时候密钥长度以及向量长度必须在算法可支持范围内, 具体加密算法的密钥及向量长度请自行百度或谷歌.
  • 当 includes 和 excludes 同时使用时即加密在includes的范围内且排除了excludes的资源。

版本记录

  • 4.0.1
    1. 兼容JDK-9及以上版本
  • 4.0.0
    1. 加解密支持填充模式
    2. 加解密支持IV-Parameter
    3. 升级启动器
    4. 移除危险模式
    5. 拼写错误修正
    6. 提供智能加密/解密器 避免使用失误
    7. 删除多余的加密/解密方法
    8. 修复有安全校验的nested-lib在不加密其内部资源情况下启动时也无法通过校验的问题
    9. 去除命令启动和手输密码启动的方式只保留Go启动器的模式
    10. 增加可读性更强的Fluent风格的加密/解密API
  • 2.0.9
    • 修复XJar类加载器加载的类没有 ProtectionDomain 以及 CodeSource 的问题
    • 修复不同字符集机器间加密与运行的问题
  • 2.0.8
    • 版本号去除"v"前缀
  • v2.0.7
    • 支持加密后删除指定资源
  • v2.0.6
    • 解决多jar包启动时无法找到准确的MANIFEST.MF导致无法正常启动的问题
  • v2.0.5
    • 升级LoadKit依赖版本
    • 修复ANT表达式无法正确匹配**/*通配符的问题
  • v2.0.4
    • 解决危险模式不支持ubuntu系统的问题
  • v2.0.3
    • 过滤器泛型协变支持
    • 支持 includes 与 excludes 同时起效,当同时设置时即加密在includes范围内但又不在excludes范围内的资源
  • v2.0.2
    • 原生jar增加密钥文件的启动方式,解决类似 nohup 和 javaw 的后台启动方式无法通过控制台输入密码的问题
  • v2.0.1
    • 增加密钥文件的启动方式,解决类似 nohup 和 javaw 的后台启动方式无法通过控制台输入密码的问题
    • 修复解密后没有删除危险模式中在MANIFEST.MF中保留的密钥信息
  • v2.0.0
    • 升级为v2.0.0 与 xjar版本保持一致
  • v1.1.0
    • 支持 Spring-Boot 以ZIP方式打包,即依赖外部化方式启动。
    • 修复无加密资源时无法启动问题
  • v1.0.9
    • 支持危险模式加密,实现免密码启动,但是请谨慎使用!
  • v1.0.8
    • 避免过滤器使用不当造成无法启动
  • v1.0.7
    • bug修复
  • v1.0.6
    • 将对普通jar项目或模块和spring boot项目或模块的插件方式加密整合成一个智能分析goal,配置时无需关心当前项目或模块是哪一种。
    • 对于无法加密的Jar进行友好提示
    • 升级 XJar 版本为 v1.1.0
  • v1.0.5
    • 引用新版本的XJar(v1.0.9),修复不同版本的Spring-Boot加密无法运行问题
  • v1.0.4
    • 第一个正式版发布

协议声明

Apache-2.0

加入群聊

QQ 950956093

Apache License Version 2.0, January 2004 http://www.apache.org/licenses/ TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION 1. Definitions. "License" shall mean the terms and conditions for use, reproduction, and distribution as defined by Sections 1 through 9 of this document. "Licensor" shall mean the copyright owner or entity authorized by the copyright owner that is granting the License. "Legal Entity" shall mean the union of the acting entity and all other entities that control, are controlled by, or are under common control with that entity. For the purposes of this definition, "control" means (i) the power, direct or indirect, to cause the direction or management of such entity, whether by contract or otherwise, or (ii) ownership of fifty percent (50%) or more of the outstanding shares, or (iii) beneficial ownership of such entity. "You" (or "Your") shall mean an individual or Legal Entity exercising permissions granted by this License. "Source" form shall mean the preferred form for making modifications, including but not limited to software source code, documentation source, and configuration files. "Object" form shall mean any form resulting from mechanical transformation or translation of a Source form, including but not limited to compiled object code, generated documentation, and conversions to other media types. "Work" shall mean the work of authorship, whether in Source or Object form, made available under the License, as indicated by a copyright notice that is included in or attached to the work (an example is provided in the Appendix below). "Derivative Works" shall mean any work, whether in Source or Object form, that is based on (or derived from) the Work and for which the editorial revisions, annotations, elaborations, or other modifications represent, as a whole, an original work of authorship. For the purposes of this License, Derivative Works shall not include works that remain separable from, or merely link (or bind by name) to the interfaces of, the Work and Derivative Works thereof. "Contribution" shall mean any work of authorship, including the original version of the Work and any modifications or additions to that Work or Derivative Works thereof, that is intentionally submitted to Licensor for inclusion in the Work by the copyright owner or by an individual or Legal Entity authorized to submit on behalf of the copyright owner. For the purposes of this definition, "submitted" means any form of electronic, verbal, or written communication sent to the Licensor or its representatives, including but not limited to communication on electronic mailing lists, source code control systems, and issue tracking systems that are managed by, or on behalf of, the Licensor for the purpose of discussing and improving the Work, but excluding communication that is conspicuously marked or otherwise designated in writing by the copyright owner as "Not a Contribution." "Contributor" shall mean Licensor and any individual or Legal Entity on behalf of whom a Contribution has been received by Licensor and subsequently incorporated within the Work. 2. Grant of Copyright License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare Derivative Works of, publicly display, publicly perform, sublicense, and distribute the Work and such Derivative Works in Source or Object form. 3. Grant of Patent License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable (except as stated in this section) patent license to make, have made, use, offer to sell, sell, import, and otherwise transfer the Work, where such license applies only to those patent claims licensable by such Contributor that are necessarily infringed by their Contribution(s) alone or by combination of their Contribution(s) with the Work to which such Contribution(s) was submitted. If You institute patent litigation against any entity (including a cross-claim or counterclaim in a lawsuit) alleging that the Work or a Contribution incorporated within the Work constitutes direct or contributory patent infringement, then any patent licenses granted to You under this License for that Work shall terminate as of the date such litigation is filed. 4. Redistribution. You may reproduce and distribute copies of the Work or Derivative Works thereof in any medium, with or without modifications, and in Source or Object form, provided that You meet the following conditions: (a) You must give any other recipients of the Work or Derivative Works a copy of this License; and (b) You must cause any modified files to carry prominent notices stating that You changed the files; and (c) You must retain, in the Source form of any Derivative Works that You distribute, all copyright, patent, trademark, and attribution notices from the Source form of the Work, excluding those notices that do not pertain to any part of the Derivative Works; and (d) If the Work includes a "NOTICE" text file as part of its distribution, then any Derivative Works that You distribute must include a readable copy of the attribution notices contained within such NOTICE file, excluding those notices that do not pertain to any part of the Derivative Works, in at least one of the following places: within a NOTICE text file distributed as part of the Derivative Works; within the Source form or documentation, if provided along with the Derivative Works; or, within a display generated by the Derivative Works, if and wherever such third-party notices normally appear. The contents of the NOTICE file are for informational purposes only and do not modify the License. You may add Your own attribution notices within Derivative Works that You distribute, alongside or as an addendum to the NOTICE text from the Work, provided that such additional attribution notices cannot be construed as modifying the License. You may add Your own copyright statement to Your modifications and may provide additional or different license terms and conditions for use, reproduction, or distribution of Your modifications, or for any such Derivative Works as a whole, provided Your use, reproduction, and distribution of the Work otherwise complies with the conditions stated in this License. 5. Submission of Contributions. Unless You explicitly state otherwise, any Contribution intentionally submitted for inclusion in the Work by You to the Licensor shall be under the terms and conditions of this License, without any additional terms or conditions. Notwithstanding the above, nothing herein shall supersede or modify the terms of any separate license agreement you may have executed with Licensor regarding such Contributions. 6. Trademarks. This License does not grant permission to use the trade names, trademarks, service marks, or product names of the Licensor, except as required for reasonable and customary use in describing the origin of the Work and reproducing the content of the NOTICE file. 7. Disclaimer of Warranty. Unless required by applicable law or agreed to in writing, Licensor provides the Work (and each Contributor provides its Contributions) on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. You are solely responsible for determining the appropriateness of using or redistributing the Work and assume any risks associated with Your exercise of permissions under this License. 8. Limitation of Liability. In no event and under no legal theory, whether in tort (including negligence), contract, or otherwise, unless required by applicable law (such as deliberate and grossly negligent acts) or agreed to in writing, shall any Contributor be liable to You for damages, including any direct, indirect, special, incidental, or consequential damages of any character arising as a result of this License or out of the use or inability to use the Work (including but not limited to damages for loss of goodwill, work stoppage, computer failure or malfunction, or any and all other commercial damages or losses), even if such Contributor has been advised of the possibility of such damages. 9. Accepting Warranty or Additional Liability. While redistributing the Work or Derivative Works thereof, You may choose to offer, and charge a fee for, acceptance of support, warranty, indemnity, or other liability obligations and/or rights consistent with this License. However, in accepting such obligations, You may act only on Your own behalf and on Your sole responsibility, not on behalf of any other Contributor, and only if You agree to indemnify, defend, and hold each Contributor harmless for any liability incurred by, or claims asserted against, such Contributor by reason of your accepting any such warranty or additional liability. END OF TERMS AND CONDITIONS APPENDIX: How to apply the Apache License to your work. To apply the Apache License to your work, attach the following boilerplate notice, with the fields enclosed by brackets "[]" replaced with your own identifying information. (Don't include the brackets!) The text should be enclosed in the appropriate comment syntax for the file format. We also recommend that a file or class name and description of purpose be included on the same "printed page" as the copyright notice for easier identification within third-party archives. Copyright [yyyy] [name of copyright owner] Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

简介

XJar-Maven-Plugin 是对 XJar 的一个Maven Plugin封装,实现可通过Maven命令或绑定在Maven构建的生命周期之中执行,用以更加便捷的方式集成 XJar 。 展开 收起
Java
Apache-2.0
取消

发行版

暂无发行版

贡献者

全部

近期动态

加载更多
不能加载更多了
Java
1
https://gitee.com/core-lib/xjar-maven-plugin.git
git@gitee.com:core-lib/xjar-maven-plugin.git
core-lib
xjar-maven-plugin
xjar-maven-plugin
master

搜索帮助