Apache Storm JAR Access After Deployment

Question

I've developed a java application to run on Apache Storm. We will install applications into the customer computers and we want customer to not have access to the codes within the JAR reverse engineer. I worry about after a jar installed into Apache Storm are there any way to access jar ?

Answer 1

Yes. The deployed topology jars are accessible in a subdirectory of the storm/storm-local directory (or some other directory if you've set your own storm.local.dir setting in storm.yaml), which is where Storm puts deployed jars while the topology is running.

You could run a bytecode obfuscator on your topology jar before deploying it. Also if your users don't need access to the Storm install, you could probably do something with user permissions on their machine to keep them from poking around in there?

You might also want to read the security section of the Storm documentation http://storm.apache.org/releases/2.0.0-SNAPSHOT/SECURITY.html .