Is there a way to obfuscate the production app exported using `webBrowserDistribution`? I noticed t...

# compose-web

[Alex Styl]

Is there a way to obfuscate the production app exported using webBrowserDistribution?

I noticed that when I run it I can find the kotlin code on the Sources tab.

This is for a JS target (not wasm)

[Robert Jaros]

webBrowserDistribution doesn't seem to be any of the standard Kotlin plugin tasks

[Robert Jaros]

Do you mean jsBrowserDistribution?

[Alex Styl]

yes my bad. i have renamed the target. it is the same as jsBrowserDistribution

[Robert Jaros]

For me this task doesn't generate any source maps.

[Robert Jaros]

just a minified js bundle

[Alex Styl]

same here. but when i serve it from my server and visit the page, i can see the full kotlin code.

ex see https://composablehorizons.github.io/compose-menu/

[Robert Jaros]

You have an iframe there - are you sure you are not putting some kind of localhost dev server in this iframe?

[Alex Styl]

it is indeed an iframe which is pointing to the index.html file generated in the bundle

[Alex Styl]

code is https://github.com/composablehorizons/compose-menu/blob/main/docs/index.md?plain=1#L10

[Alex Styl]

it's the same result like running ./gradlew jsBrowserProductionRun and checking the sources tab

[Ismail]

Try jsBrowserProductionWebpack

[Ismail]

Actually that's not working either, I can still see the kotlin code

[Robert Jaros]

there is https://composablehorizons.github.io/compose-menu/preview/composeApp.js.map sources map file published

[Robert Jaros]

Where does it come from?

[Robert Jaros]

It shouldn't be generated with distribution task

[Alex Styl]

the demo is generated using this script. https://github.com/composablehorizons/compose-menu/blob/main/scripts/update_demo.sh

which is using jsBrowserDistribution

[Alex Styl]

i tried locally and removing the .map file removes the kt code from the sources tab. nice

[Alex Styl]

It shouldn't be generated with distribution task

@Robert Jaros are you sure about this? (as in is it documented somewhere?)

i guess it somewhat makes sense to have the mappings generated, if the code is minified/obfuscated.

[Alex Styl]

if it isnt meant to do this, which task is meant for production distribution?

[Robert Jaros]

I was kind of sure, because it doesn't generate source maps in my project. But I've built your code and it indeed does generate.

[Alex Styl]

the project is using compose 1.6.2 and tried also on 1.6.10 . which version are u on?

[Robert Jaros]

I'm on 1.6.10-rc3, but I don't think the compose version has anything to do with this

[Robert Jaros]

Ok, I've found the difference

[Robert Jaros]

I have custom webpack configuration in my project

[Robert Jaros]

in a webpack.config.d folder I have webpack.js file with:

if (config.devServer) {
  // other things
} else {
    config.devtool = undefined;
}

[Robert Jaros]

This devtool option disables source maps generation for production build

[Robert Jaros]

I'm using it for a long time in all my projects, so I've fogotten about this ;)

[Robert Jaros]

You can put webpack.config.d inside demo subproject

[Robert Jaros]

You can also use:

js(IR) {
    browser {
        webpackTask {
            sourceMaps = false
        }
    }
}

[Alex Styl]

nice. it worked!