It definitely depends on the language. The author mentions spring security so I'm assuming he's using java, where it's a massive PITA to manually hunt down and attach the sources to the 50 jars you have in lib/. Maven probably has something that will automatically do this but if your legacy project is just using ant then you're pretty much stuck.