Proguard rules for milo dependencies

[peterfranciscook]

I wanted to see if any milo users have a set of proguard rules for transitive dependencies that they'd like to share. I found 1 discussion mentioning proguard (#1037) but I didn't see any specific rules mentioned.

These artifacts: [org.eclipse.milo:sdk-client:0.6.16", org.eclipse.milo:stack-core:0.6.16",]

have these these transitive dependencies

[INFO] +- org.eclipse.milo:sdk-client:jar:0.6.16:compile
[INFO] |  +- org.eclipse.milo:stack-client:jar:0.6.16:compile
[INFO] |  |  +- com.digitalpetri.netty:netty-channel-fsm:jar:0.9:compile
[INFO] |  |  |  \- com.digitalpetri.fsm:strict-machine:jar:0.7:compile
[INFO] |  |  \- io.netty:netty-codec-http:jar:4.1.119.Final:compile
[INFO] |  \- org.eclipse.milo:sdk-core:jar:0.6.16:compile
[INFO] +- org.eclipse.milo:stack-core:jar:0.6.16:compile
[INFO] |  +- org.bouncycastle:bcprov-jdk18on:jar:1.78.1:compile
[INFO] |  +- org.bouncycastle:bcpkix-jdk18on:jar:1.78.1:compile
[INFO] |  |  \- org.bouncycastle:bcutil-jdk18on:jar:1.78.1:compile
[INFO] |  +- org.slf4j:slf4j-api:jar:1.7.36:compile
[INFO] |  \- org.glassfish.jaxb:jaxb-runtime:jar:2.3.6:compile
[INFO] |     +- jakarta.xml.bind:jakarta.xml.bind-api:jar:2.3.3:compile
[INFO] |     +- org.glassfish.jaxb:txw2:jar:2.3.6:compile
[INFO] |     +- com.sun.istack:istack-commons-runtime:jar:3.0.12:compile
[INFO] |     \- com.sun.activation:jakarta.activation:jar:1.2.2:runtime

I've found that just letting proguard go to town on an uber jar with milo bundled will output a jar file that does not run.

Note - my proguard file is pretty conservative - I don't have it allowing optimizations or obfuscation. In my experience, small incremental rule changes with proguard for an uber jar is the only way to avoid headaches.

These are the rules I've found useful so far that I think are related to milo specifically.

# don't strip anything from milo itself at this point
-keep class org.eclipse.milo.** { *; }

# possibly not related to milo
-keep class sun.misc.Unsafe { *; }

# so far I haven't had breakage from proguard stripping netty classes that aren't referenced
# milo does a pretty good job of avoiding reflection
-dontwarn io.netty.**

# not clear if this is actually a transitive dependency of the xml libraries milo uses
-dontwarn com.sun.xml.**

# kind of unsure about this one ... i think bazel winds up shading the logger i use ("org.tinylog:slf4j-tinylog:2.7.0") 
# in where milo uses slf4j so there's no breakage
-dontwarn org.slf4j.**

Any other proguard users in the milo community have rules they'd like to share?

[kevinherron]

There's a mailing list (milo-dev@eclipse.org) you can try asking as well. Not sure it will be any better... mailing lists seem to be out of fashion for anybody without grey in their beard.