{
  "id": 9039959,
  "title": "Quarkus + GraalVM Advanced Obfuscation",
  "url": "https://urgent.news/2026/09/22/quarkus-graalvm-advanced-obfuscation",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-22T00:00:56.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/aeells/quarkus-graalvm-advanced-obfuscation-5hd4"
  },
  "original_language": "en",
  "account": "In the last 18 months, author has built Backbone, a production platform bootstrap for SaaS startup engineering teams. Community edition of Backbone was recently open-sourced for local development, allowing users to run platform services, scaffold product domain services, and build against a real runtime. However, the entire codebase was not open-sourced due to distribution challenges.\n\nJava bytecode has weak boundaries, leaving a lot of useful structure even without source code. GraalVM Native Image helps by shipping machine code instead of class files and applying closed-world analysis to strip unreachable code. GraalVM 25 introduces Advanced Obfuscation (AO), which replaces meaningful names with opaque symbols across application code and third-party dependencies.\n\nThe main question was whether AO would work in a real Quarkus service. After finding no public write-up, the author tried it and found a reproduction on GitHub. Backbone Community needs runnable platform services, and users should be able to start them locally without inheriting a crippled source-only stub. When ready to ship, a commercial license unlocks full source code access and additional features.\n\nThe distribution model involves private service source remaining closed, with the open surface including the local toolchain, domain-service scaffolding, SDK APIs, and runnable platform images. AO is only the binary distribution boundary, turning native compilation into a practical distribution boundary rather than a security boundary or DRM.\n\nThe author points out that AO is experimental and Oracle-GraalVM-only. When using AO with Quarkus, the native build succeeded, but startup failed inside SmallRye Fault Tolerance with an NPE. The stack trace was partially obfuscated, making debugging more challenging. The JSON map produced by -H:AdvancedObfuscation=export-mapping showed that AO isn't just cosmetic for attackers with time and tools.",
  "summary": "How to open-source your runtime without open-sourcing your IP I've spent the last 18 months building Backbone , a production platform bootstrap for SaaS startup engineering teams. I recently open-sourced the Community edition. Community is meant to be genuinely usable for local development: run the platform services, scaffold product domain services, build against a real runtime. What I didn't…",
  "key_points": [
    "Backbone platform bootstrap open-sourced for local development",
    "GraalVM 25 introduces Advanced Obfuscation (AO) for Quarkus",
    "AO turns native compilation into practical distribution boundary"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}