You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tomcat.apache.org by sc...@apache.org on 2026/10/20 12:07:14 UTC
(tomcat) branch main updated: Add findsecbugs plugin to spotbugs
This is an automated email from the ASF dual-hosted git repository.
ChristopherSchultz pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/tomcat.git
The following commit(s) were added to refs/heads/main by this push:
new ef4df196ab Add findsecbugs plugin to spotbugs
ef4df196ab is described below
commit ef4df196aba8be70bd2e1b999ad49223599b0830
Author: Christopher Schultz <ch...@christopherschultz.net>
AuthorDate: Tue Oct 20 08:06:49 2026 -0400
Add findsecbugs plugin to spotbugs
---
build.properties.default | 8 ++++++++
build.xml | 9 +++++++++
2 files changed, 17 insertions(+)
diff --git a/build.properties.default b/build.properties.default
index 6284d027e0..633f31c6ce 100644
--- a/build.properties.default
+++ b/build.properties.default
@@ -293,6 +293,14 @@ spotbugs.home=${base.path}/spotbugs-${spotbugs.version}
spotbugs.jar=${spotbugs.home}/lib/spotbugs-ant.jar
spotbugs.loc=${base-maven.loc}/com/github/spotbugs/spotbugs/${spotbugs.version}/spotbugs-${spotbugs.version}.tgz
+findsecbugs.version=1.14.0
+findsecbugs.loc=${base-maven.loc}/com/h3xstream/findsecbugs/findsecbugs-plugin/${findsecbugs.version}/findsecbugs-plugin-${findsecbugs.version}.jar
+findsecbugs.jar=${findsecbugs.home}/findsecbugs-plugin-${findsecbugs.version}.jar
+findsecbugs.checksum.enabled=true
+findsecbugs.checksum.algorithm=SHA-512
+findsecbugs.checksum.value=9eb87ea65584d6ab9e79cfcc9a2ffe3519adab9356084c74aaead8b3c7ca1e025ae2c2ba1aa70fab701fcd2f960e044ab467da6199d3a7feb64da5db42bc7991
+findsecbugs.home=${base.path}/spotbugs-${spotbugs.version}/plugin
+
# ----- bnd, version 6.3.0 or later -----
# ----- provides OSGI metadata for JARs -----
bnd.version=7.4.0
diff --git a/build.xml b/build.xml
index fbf9148cf5..d82a68a001 100644
--- a/build.xml
+++ b/build.xml
@@ -2321,6 +2321,7 @@
<path id="spotbugs.classpath">
<fileset file="${spotbugs.jar}" />
+ <fileset file="${findsecbugs.jar}" />
</path>
<taskdef classpathref="spotbugs.classpath" name="spotbugs" classname="edu.umd.cs.findbugs.anttask.FindBugsTask"/>
@@ -3881,6 +3882,14 @@ Configured for ${release.asfusername} to release Tomcat ${version.major}.${versi
<param name="checksum.value" value="${spotbugs.checksum.value}"/>
</antcall>
+ <antcall target="downloadfile">
+ <param name="sourcefile" value="${findsecbugs.loc}"/>
+ <param name="destfile" value="${findsecbugs.jar}"/>
+ <param name="checksum.enabled" value="${findsecbugs.checksum.enabled}"/>
+ <param name="checksum.algorithm" value="${findsecbugs.checksum.algorithm}"/>
+ <param name="checksum.value" value="${findsecbugs.checksum.value}"/>
+ </antcall>
+
</target>
<target name="download-dist"
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
Re: (tomcat) branch main updated: Add findsecbugs plugin to spotbugs
Posted by Christopher Schultz <ch...@christopherschultz.net>.
Mark,
On 10/21/26 10:14 AM, Christopher Schultz wrote:
> Mark,
>
> On 10/21/26 8:54 AM, Mark Thomas wrote:
>> On 21/10/2026 13:30, Christopher Schultz wrote:
>>> Mark,
>>>
>>> On 10/21/26 5:01 AM, Mark Thomas wrote:
>>>> On 20/10/2026 23:38, Christopher Schultz wrote:
>>>>> All,
>>>>>
>>>>> I introduced this into main and did not yet back-port.
>>>>>
>>>>> I'd like to get some feedback on the way I've done this before I
>>>>> back- port all the way.
>>>>
>>>> I made a couple of minor tweaks.
>>>
>>> I think removing the findsecbugs JAR from the spotbugs classpath ends
>>> up skipping the findsecbugs tests entirely. I tried a few times to
>>> make it work and this seemed like the easiest way to trigger
>>> scanning. The other way was to explicitly add a pluginList=""
>>> attribute to the <spotbugs> call.
>>
>> My understanding was that findbugs picks up everything from the
>> plugins directory automatically.
>>
>> I guess what we need is a temporary change that triggers a report. Any
>> ideas?
>
> I can just run it (spotbugs) locally in "debug" mode. When run un debug
> mode, it tells you which scans are being done, including (or not) the
> findsecbugs ones.
>
> Okay, I just ran it in debug mode on main HEAD and everything seems
> fine. I have no idea why I wasn't able to get that to work previously.
>
> Oh, right. Because I was putting the JAR into a weird place. Your patch
> puts it into the right place, and the findsecbugs.jar property isn't
> used by anything at all. I'll remove the full path from it and just use
> the JAR file name.
Nope, it still needs it. No further changes necessary.
-chris
>>>>> On 10/20/26 8:07 AM, schultz@apache.org wrote:
>>>>>> This is an automated email from the ASF dual-hosted git repository.
>>>>>>
>>>>>> ChristopherSchultz pushed a commit to branch main
>>>>>> in repository https://gitbox.apache.org/repos/asf/tomcat.git
>>>>>>
>>>>>>
>>>>>> The following commit(s) were added to refs/heads/main by this push:
>>>>>> new ef4df196ab Add findsecbugs plugin to spotbugs
>>>>>> ef4df196ab is described below
>>>>>>
>>>>>> commit ef4df196aba8be70bd2e1b999ad49223599b0830
>>>>>> Author: Christopher Schultz <ch...@christopherschultz.net>
>>>>>> AuthorDate: Tue Oct 20 08:06:49 2026 -0400
>>>>>>
>>>>>> Add findsecbugs plugin to spotbugs
>>>>>> ---
>>>>>> build.properties.default | 8 ++++++++
>>>>>> build.xml | 9 +++++++++
>>>>>> 2 files changed, 17 insertions(+)
>>>>>>
>>>>>> diff --git a/build.properties.default b/build.properties.default
>>>>>> index 6284d027e0..633f31c6ce 100644
>>>>>> --- a/build.properties.default
>>>>>> +++ b/build.properties.default
>>>>>> @@ -293,6 +293,14 @@ spotbugs.home=${base.path}/spotbugs-
>>>>>> ${spotbugs.version}
>>>>>> spotbugs.jar=${spotbugs.home}/lib/spotbugs-ant.jar
>>>>>> spotbugs.loc=${base-maven.loc}/com/github/spotbugs/spotbugs/
>>>>>> ${spotbugs.version}/spotbugs-${spotbugs.version}.tgz
>>>>>> +findsecbugs.version=1.14.0
>>>>>> +findsecbugs.loc=${base-maven.loc}/com/h3xstream/findsecbugs/
>>>>>> findsecbugs-plugin/${findsecbugs.version}/findsecbugs-plugin-
>>>>>> ${findsecbugs.version}.jar
>>>>>> +findsecbugs.jar=${findsecbugs.home}/findsecbugs-plugin-
>>>>>> ${findsecbugs.version}.jar
>>>>>> +findsecbugs.checksum.enabled=true
>>>>>> +findsecbugs.checksum.algorithm=SHA-512
>>>>>> +findsecbugs.checksum.value=9eb87ea65584d6ab9e79cfcc9a2ffe3519adab9356084c74aaead8b3c7ca1e025ae2c2ba1aa70fab701fcd2f960e044ab467da6199d3a7feb64da5db42bc7991
>>>>>> +findsecbugs.home=${base.path}/spotbugs-${spotbugs.version}/plugin
>>>>>> +
>>>>>> # ----- bnd, version 6.3.0 or later -----
>>>>>> # ----- provides OSGI metadata for JARs -----
>>>>>> bnd.version=7.4.0
>>>>>> diff --git a/build.xml b/build.xml
>>>>>> index fbf9148cf5..d82a68a001 100644
>>>>>> --- a/build.xml
>>>>>> +++ b/build.xml
>>>>>> @@ -2321,6 +2321,7 @@
>>>>>> <path id="spotbugs.classpath">
>>>>>> <fileset file="${spotbugs.jar}" />
>>>>>> + <fileset file="${findsecbugs.jar}" />
>>>>>> </path>
>>>>>> <taskdef classpathref="spotbugs.classpath" name="spotbugs"
>>>>>> classname="edu.umd.cs.findbugs.anttask.FindBugsTask"/>
>>>>>> @@ -3881,6 +3882,14 @@ Configured for ${release.asfusername} to
>>>>>> release Tomcat ${version.major}.${versi
>>>>>> <param name="checksum.value"
>>>>>> value="${spotbugs.checksum.value}"/>
>>>>>> </antcall>
>>>>>> + <antcall target="downloadfile">
>>>>>> + <param name="sourcefile" value="${findsecbugs.loc}"/>
>>>>>> + <param name="destfile" value="${findsecbugs.jar}"/>
>>>>>> + <param name="checksum.enabled"
>>>>>> value="${findsecbugs.checksum.enabled}"/>
>>>>>> + <param name="checksum.algorithm"
>>>>>> value="${findsecbugs.checksum.algorithm}"/>
>>>>>> + <param name="checksum.value"
>>>>>> value="${findsecbugs.checksum.value}"/>
>>>>>> + </antcall>
>>>>>> +
>>>>>> </target>
>>>>>> <target name="download-dist"
>>>>>>
>>>>>>
>>>>>> ---------------------------------------------------------------------
>>>>>> To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
>>>>>> For additional commands, e-mail: dev-help@tomcat.apache.org
>>>>>>
>>>>>
>>>>>
>>>>> ---------------------------------------------------------------------
>>>>> To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
>>>>> For additional commands, e-mail: dev-help@tomcat.apache.org
>>>>>
>>>>
>>>>
>>>> ---------------------------------------------------------------------
>>>> To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
>>>> For additional commands, e-mail: dev-help@tomcat.apache.org
>>>>
>>>
>>>
>>> ---------------------------------------------------------------------
>>> To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
>>> For additional commands, e-mail: dev-help@tomcat.apache.org
>>>
>>
>>
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
>> For additional commands, e-mail: dev-help@tomcat.apache.org
>>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
Re: (tomcat) branch main updated: Add findsecbugs plugin to spotbugs
Posted by Christopher Schultz <ch...@christopherschultz.net>.
Mark,
On 10/21/26 8:54 AM, Mark Thomas wrote:
> On 21/10/2026 13:30, Christopher Schultz wrote:
>> Mark,
>>
>> On 10/21/26 5:01 AM, Mark Thomas wrote:
>>> On 20/10/2026 23:38, Christopher Schultz wrote:
>>>> All,
>>>>
>>>> I introduced this into main and did not yet back-port.
>>>>
>>>> I'd like to get some feedback on the way I've done this before I
>>>> back- port all the way.
>>>
>>> I made a couple of minor tweaks.
>>
>> I think removing the findsecbugs JAR from the spotbugs classpath ends
>> up skipping the findsecbugs tests entirely. I tried a few times to
>> make it work and this seemed like the easiest way to trigger scanning.
>> The other way was to explicitly add a pluginList="" attribute to the
>> <spotbugs> call.
>
> My understanding was that findbugs picks up everything from the plugins
> directory automatically.
>
> I guess what we need is a temporary change that triggers a report. Any
> ideas?
I can just run it (spotbugs) locally in "debug" mode. When run un debug
mode, it tells you which scans are being done, including (or not) the
findsecbugs ones.
Okay, I just ran it in debug mode on main HEAD and everything seems
fine. I have no idea why I wasn't able to get that to work previously.
Oh, right. Because I was putting the JAR into a weird place. Your patch
puts it into the right place, and the findsecbugs.jar property isn't
used by anything at all. I'll remove the full path from it and just use
the JAR file name.
-chris
>>>> On 10/20/26 8:07 AM, schultz@apache.org wrote:
>>>>> This is an automated email from the ASF dual-hosted git repository.
>>>>>
>>>>> ChristopherSchultz pushed a commit to branch main
>>>>> in repository https://gitbox.apache.org/repos/asf/tomcat.git
>>>>>
>>>>>
>>>>> The following commit(s) were added to refs/heads/main by this push:
>>>>> new ef4df196ab Add findsecbugs plugin to spotbugs
>>>>> ef4df196ab is described below
>>>>>
>>>>> commit ef4df196aba8be70bd2e1b999ad49223599b0830
>>>>> Author: Christopher Schultz <ch...@christopherschultz.net>
>>>>> AuthorDate: Tue Oct 20 08:06:49 2026 -0400
>>>>>
>>>>> Add findsecbugs plugin to spotbugs
>>>>> ---
>>>>> build.properties.default | 8 ++++++++
>>>>> build.xml | 9 +++++++++
>>>>> 2 files changed, 17 insertions(+)
>>>>>
>>>>> diff --git a/build.properties.default b/build.properties.default
>>>>> index 6284d027e0..633f31c6ce 100644
>>>>> --- a/build.properties.default
>>>>> +++ b/build.properties.default
>>>>> @@ -293,6 +293,14 @@ spotbugs.home=${base.path}/spotbugs-
>>>>> ${spotbugs.version}
>>>>> spotbugs.jar=${spotbugs.home}/lib/spotbugs-ant.jar
>>>>> spotbugs.loc=${base-maven.loc}/com/github/spotbugs/spotbugs/
>>>>> ${spotbugs.version}/spotbugs-${spotbugs.version}.tgz
>>>>> +findsecbugs.version=1.14.0
>>>>> +findsecbugs.loc=${base-maven.loc}/com/h3xstream/findsecbugs/
>>>>> findsecbugs-plugin/${findsecbugs.version}/findsecbugs-plugin-
>>>>> ${findsecbugs.version}.jar
>>>>> +findsecbugs.jar=${findsecbugs.home}/findsecbugs-plugin-
>>>>> ${findsecbugs.version}.jar
>>>>> +findsecbugs.checksum.enabled=true
>>>>> +findsecbugs.checksum.algorithm=SHA-512
>>>>> +findsecbugs.checksum.value=9eb87ea65584d6ab9e79cfcc9a2ffe3519adab9356084c74aaead8b3c7ca1e025ae2c2ba1aa70fab701fcd2f960e044ab467da6199d3a7feb64da5db42bc7991
>>>>> +findsecbugs.home=${base.path}/spotbugs-${spotbugs.version}/plugin
>>>>> +
>>>>> # ----- bnd, version 6.3.0 or later -----
>>>>> # ----- provides OSGI metadata for JARs -----
>>>>> bnd.version=7.4.0
>>>>> diff --git a/build.xml b/build.xml
>>>>> index fbf9148cf5..d82a68a001 100644
>>>>> --- a/build.xml
>>>>> +++ b/build.xml
>>>>> @@ -2321,6 +2321,7 @@
>>>>> <path id="spotbugs.classpath">
>>>>> <fileset file="${spotbugs.jar}" />
>>>>> + <fileset file="${findsecbugs.jar}" />
>>>>> </path>
>>>>> <taskdef classpathref="spotbugs.classpath" name="spotbugs"
>>>>> classname="edu.umd.cs.findbugs.anttask.FindBugsTask"/>
>>>>> @@ -3881,6 +3882,14 @@ Configured for ${release.asfusername} to
>>>>> release Tomcat ${version.major}.${versi
>>>>> <param name="checksum.value"
>>>>> value="${spotbugs.checksum.value}"/>
>>>>> </antcall>
>>>>> + <antcall target="downloadfile">
>>>>> + <param name="sourcefile" value="${findsecbugs.loc}"/>
>>>>> + <param name="destfile" value="${findsecbugs.jar}"/>
>>>>> + <param name="checksum.enabled"
>>>>> value="${findsecbugs.checksum.enabled}"/>
>>>>> + <param name="checksum.algorithm"
>>>>> value="${findsecbugs.checksum.algorithm}"/>
>>>>> + <param name="checksum.value"
>>>>> value="${findsecbugs.checksum.value}"/>
>>>>> + </antcall>
>>>>> +
>>>>> </target>
>>>>> <target name="download-dist"
>>>>>
>>>>>
>>>>> ---------------------------------------------------------------------
>>>>> To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
>>>>> For additional commands, e-mail: dev-help@tomcat.apache.org
>>>>>
>>>>
>>>>
>>>> ---------------------------------------------------------------------
>>>> To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
>>>> For additional commands, e-mail: dev-help@tomcat.apache.org
>>>>
>>>
>>>
>>> ---------------------------------------------------------------------
>>> To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
>>> For additional commands, e-mail: dev-help@tomcat.apache.org
>>>
>>
>>
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
>> For additional commands, e-mail: dev-help@tomcat.apache.org
>>
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: dev-help@tomcat.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
Re: (tomcat) branch main updated: Add findsecbugs plugin to spotbugs
Posted by Mark Thomas <ma...@apache.org>.
On 21/10/2026 13:30, Christopher Schultz wrote:
> Mark,
>
> On 10/21/26 5:01 AM, Mark Thomas wrote:
>> On 20/10/2026 23:38, Christopher Schultz wrote:
>>> All,
>>>
>>> I introduced this into main and did not yet back-port.
>>>
>>> I'd like to get some feedback on the way I've done this before I
>>> back- port all the way.
>>
>> I made a couple of minor tweaks.
>
> I think removing the findsecbugs JAR from the spotbugs classpath ends up
> skipping the findsecbugs tests entirely. I tried a few times to make it
> work and this seemed like the easiest way to trigger scanning. The other
> way was to explicitly add a pluginList="" attribute to the <spotbugs> call.
My understanding was that findbugs picks up everything from the plugins
directory automatically.
I guess what we need is a temporary change that triggers a report. Any
ideas?
Mark
>
> -chris
>
>>> On 10/20/26 8:07 AM, schultz@apache.org wrote:
>>>> This is an automated email from the ASF dual-hosted git repository.
>>>>
>>>> ChristopherSchultz pushed a commit to branch main
>>>> in repository https://gitbox.apache.org/repos/asf/tomcat.git
>>>>
>>>>
>>>> The following commit(s) were added to refs/heads/main by this push:
>>>> new ef4df196ab Add findsecbugs plugin to spotbugs
>>>> ef4df196ab is described below
>>>>
>>>> commit ef4df196aba8be70bd2e1b999ad49223599b0830
>>>> Author: Christopher Schultz <ch...@christopherschultz.net>
>>>> AuthorDate: Tue Oct 20 08:06:49 2026 -0400
>>>>
>>>> Add findsecbugs plugin to spotbugs
>>>> ---
>>>> build.properties.default | 8 ++++++++
>>>> build.xml | 9 +++++++++
>>>> 2 files changed, 17 insertions(+)
>>>>
>>>> diff --git a/build.properties.default b/build.properties.default
>>>> index 6284d027e0..633f31c6ce 100644
>>>> --- a/build.properties.default
>>>> +++ b/build.properties.default
>>>> @@ -293,6 +293,14 @@ spotbugs.home=${base.path}/spotbugs-
>>>> ${spotbugs.version}
>>>> spotbugs.jar=${spotbugs.home}/lib/spotbugs-ant.jar
>>>> spotbugs.loc=${base-maven.loc}/com/github/spotbugs/spotbugs/
>>>> ${spotbugs.version}/spotbugs-${spotbugs.version}.tgz
>>>> +findsecbugs.version=1.14.0
>>>> +findsecbugs.loc=${base-maven.loc}/com/h3xstream/findsecbugs/
>>>> findsecbugs-plugin/${findsecbugs.version}/findsecbugs-plugin-
>>>> ${findsecbugs.version}.jar
>>>> +findsecbugs.jar=${findsecbugs.home}/findsecbugs-plugin-
>>>> ${findsecbugs.version}.jar
>>>> +findsecbugs.checksum.enabled=true
>>>> +findsecbugs.checksum.algorithm=SHA-512
>>>> +findsecbugs.checksum.value=9eb87ea65584d6ab9e79cfcc9a2ffe3519adab9356084c74aaead8b3c7ca1e025ae2c2ba1aa70fab701fcd2f960e044ab467da6199d3a7feb64da5db42bc7991
>>>> +findsecbugs.home=${base.path}/spotbugs-${spotbugs.version}/plugin
>>>> +
>>>> # ----- bnd, version 6.3.0 or later -----
>>>> # ----- provides OSGI metadata for JARs -----
>>>> bnd.version=7.4.0
>>>> diff --git a/build.xml b/build.xml
>>>> index fbf9148cf5..d82a68a001 100644
>>>> --- a/build.xml
>>>> +++ b/build.xml
>>>> @@ -2321,6 +2321,7 @@
>>>> <path id="spotbugs.classpath">
>>>> <fileset file="${spotbugs.jar}" />
>>>> + <fileset file="${findsecbugs.jar}" />
>>>> </path>
>>>> <taskdef classpathref="spotbugs.classpath" name="spotbugs"
>>>> classname="edu.umd.cs.findbugs.anttask.FindBugsTask"/>
>>>> @@ -3881,6 +3882,14 @@ Configured for ${release.asfusername} to
>>>> release Tomcat ${version.major}.${versi
>>>> <param name="checksum.value"
>>>> value="${spotbugs.checksum.value}"/>
>>>> </antcall>
>>>> + <antcall target="downloadfile">
>>>> + <param name="sourcefile" value="${findsecbugs.loc}"/>
>>>> + <param name="destfile" value="${findsecbugs.jar}"/>
>>>> + <param name="checksum.enabled"
>>>> value="${findsecbugs.checksum.enabled}"/>
>>>> + <param name="checksum.algorithm"
>>>> value="${findsecbugs.checksum.algorithm}"/>
>>>> + <param name="checksum.value"
>>>> value="${findsecbugs.checksum.value}"/>
>>>> + </antcall>
>>>> +
>>>> </target>
>>>> <target name="download-dist"
>>>>
>>>>
>>>> ---------------------------------------------------------------------
>>>> To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
>>>> For additional commands, e-mail: dev-help@tomcat.apache.org
>>>>
>>>
>>>
>>> ---------------------------------------------------------------------
>>> To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
>>> For additional commands, e-mail: dev-help@tomcat.apache.org
>>>
>>
>>
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
>> For additional commands, e-mail: dev-help@tomcat.apache.org
>>
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: dev-help@tomcat.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
Re: (tomcat) branch main updated: Add findsecbugs plugin to spotbugs
Posted by Christopher Schultz <ch...@christopherschultz.net>.
Mark,
On 10/21/26 5:01 AM, Mark Thomas wrote:
> On 20/10/2026 23:38, Christopher Schultz wrote:
>> All,
>>
>> I introduced this into main and did not yet back-port.
>>
>> I'd like to get some feedback on the way I've done this before I back-
>> port all the way.
>
> I made a couple of minor tweaks.
I think removing the findsecbugs JAR from the spotbugs classpath ends up
skipping the findsecbugs tests entirely. I tried a few times to make it
work and this seemed like the easiest way to trigger scanning. The other
way was to explicitly add a pluginList="" attribute to the <spotbugs> call.
-chris
>> On 10/20/26 8:07 AM, schultz@apache.org wrote:
>>> This is an automated email from the ASF dual-hosted git repository.
>>>
>>> ChristopherSchultz pushed a commit to branch main
>>> in repository https://gitbox.apache.org/repos/asf/tomcat.git
>>>
>>>
>>> The following commit(s) were added to refs/heads/main by this push:
>>> new ef4df196ab Add findsecbugs plugin to spotbugs
>>> ef4df196ab is described below
>>>
>>> commit ef4df196aba8be70bd2e1b999ad49223599b0830
>>> Author: Christopher Schultz <ch...@christopherschultz.net>
>>> AuthorDate: Tue Oct 20 08:06:49 2026 -0400
>>>
>>> Add findsecbugs plugin to spotbugs
>>> ---
>>> build.properties.default | 8 ++++++++
>>> build.xml | 9 +++++++++
>>> 2 files changed, 17 insertions(+)
>>>
>>> diff --git a/build.properties.default b/build.properties.default
>>> index 6284d027e0..633f31c6ce 100644
>>> --- a/build.properties.default
>>> +++ b/build.properties.default
>>> @@ -293,6 +293,14 @@ spotbugs.home=${base.path}/spotbugs-
>>> ${spotbugs.version}
>>> spotbugs.jar=${spotbugs.home}/lib/spotbugs-ant.jar
>>> spotbugs.loc=${base-maven.loc}/com/github/spotbugs/spotbugs/
>>> ${spotbugs.version}/spotbugs-${spotbugs.version}.tgz
>>> +findsecbugs.version=1.14.0
>>> +findsecbugs.loc=${base-maven.loc}/com/h3xstream/findsecbugs/
>>> findsecbugs-plugin/${findsecbugs.version}/findsecbugs-plugin-
>>> ${findsecbugs.version}.jar
>>> +findsecbugs.jar=${findsecbugs.home}/findsecbugs-plugin-
>>> ${findsecbugs.version}.jar
>>> +findsecbugs.checksum.enabled=true
>>> +findsecbugs.checksum.algorithm=SHA-512
>>> +findsecbugs.checksum.value=9eb87ea65584d6ab9e79cfcc9a2ffe3519adab9356084c74aaead8b3c7ca1e025ae2c2ba1aa70fab701fcd2f960e044ab467da6199d3a7feb64da5db42bc7991
>>> +findsecbugs.home=${base.path}/spotbugs-${spotbugs.version}/plugin
>>> +
>>> # ----- bnd, version 6.3.0 or later -----
>>> # ----- provides OSGI metadata for JARs -----
>>> bnd.version=7.4.0
>>> diff --git a/build.xml b/build.xml
>>> index fbf9148cf5..d82a68a001 100644
>>> --- a/build.xml
>>> +++ b/build.xml
>>> @@ -2321,6 +2321,7 @@
>>> <path id="spotbugs.classpath">
>>> <fileset file="${spotbugs.jar}" />
>>> + <fileset file="${findsecbugs.jar}" />
>>> </path>
>>> <taskdef classpathref="spotbugs.classpath" name="spotbugs"
>>> classname="edu.umd.cs.findbugs.anttask.FindBugsTask"/>
>>> @@ -3881,6 +3882,14 @@ Configured for ${release.asfusername} to
>>> release Tomcat ${version.major}.${versi
>>> <param name="checksum.value"
>>> value="${spotbugs.checksum.value}"/>
>>> </antcall>
>>> + <antcall target="downloadfile">
>>> + <param name="sourcefile" value="${findsecbugs.loc}"/>
>>> + <param name="destfile" value="${findsecbugs.jar}"/>
>>> + <param name="checksum.enabled"
>>> value="${findsecbugs.checksum.enabled}"/>
>>> + <param name="checksum.algorithm"
>>> value="${findsecbugs.checksum.algorithm}"/>
>>> + <param name="checksum.value"
>>> value="${findsecbugs.checksum.value}"/>
>>> + </antcall>
>>> +
>>> </target>
>>> <target name="download-dist"
>>>
>>>
>>> ---------------------------------------------------------------------
>>> To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
>>> For additional commands, e-mail: dev-help@tomcat.apache.org
>>>
>>
>>
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
>> For additional commands, e-mail: dev-help@tomcat.apache.org
>>
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: dev-help@tomcat.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
Re: (tomcat) branch main updated: Add findsecbugs plugin to spotbugs
Posted by Mark Thomas <ma...@apache.org>.
On 20/10/2026 23:38, Christopher Schultz wrote:
> All,
>
> I introduced this into main and did not yet back-port.
>
> I'd like to get some feedback on the way I've done this before I back-
> port all the way.
I made a couple of minor tweaks.
Mark
>
> NOTE: findsecbugs does not currently find any additional items on top of
> what spotbugs is finding (which is currently also nothing).
>
> -chris
>
> On 10/20/26 8:07 AM, schultz@apache.org wrote:
>> This is an automated email from the ASF dual-hosted git repository.
>>
>> ChristopherSchultz pushed a commit to branch main
>> in repository https://gitbox.apache.org/repos/asf/tomcat.git
>>
>>
>> The following commit(s) were added to refs/heads/main by this push:
>> new ef4df196ab Add findsecbugs plugin to spotbugs
>> ef4df196ab is described below
>>
>> commit ef4df196aba8be70bd2e1b999ad49223599b0830
>> Author: Christopher Schultz <ch...@christopherschultz.net>
>> AuthorDate: Tue Oct 20 08:06:49 2026 -0400
>>
>> Add findsecbugs plugin to spotbugs
>> ---
>> build.properties.default | 8 ++++++++
>> build.xml | 9 +++++++++
>> 2 files changed, 17 insertions(+)
>>
>> diff --git a/build.properties.default b/build.properties.default
>> index 6284d027e0..633f31c6ce 100644
>> --- a/build.properties.default
>> +++ b/build.properties.default
>> @@ -293,6 +293,14 @@ spotbugs.home=${base.path}/spotbugs-
>> ${spotbugs.version}
>> spotbugs.jar=${spotbugs.home}/lib/spotbugs-ant.jar
>> spotbugs.loc=${base-maven.loc}/com/github/spotbugs/spotbugs/
>> ${spotbugs.version}/spotbugs-${spotbugs.version}.tgz
>> +findsecbugs.version=1.14.0
>> +findsecbugs.loc=${base-maven.loc}/com/h3xstream/findsecbugs/
>> findsecbugs-plugin/${findsecbugs.version}/findsecbugs-plugin-
>> ${findsecbugs.version}.jar
>> +findsecbugs.jar=${findsecbugs.home}/findsecbugs-plugin-
>> ${findsecbugs.version}.jar
>> +findsecbugs.checksum.enabled=true
>> +findsecbugs.checksum.algorithm=SHA-512
>> +findsecbugs.checksum.value=9eb87ea65584d6ab9e79cfcc9a2ffe3519adab9356084c74aaead8b3c7ca1e025ae2c2ba1aa70fab701fcd2f960e044ab467da6199d3a7feb64da5db42bc7991
>> +findsecbugs.home=${base.path}/spotbugs-${spotbugs.version}/plugin
>> +
>> # ----- bnd, version 6.3.0 or later -----
>> # ----- provides OSGI metadata for JARs -----
>> bnd.version=7.4.0
>> diff --git a/build.xml b/build.xml
>> index fbf9148cf5..d82a68a001 100644
>> --- a/build.xml
>> +++ b/build.xml
>> @@ -2321,6 +2321,7 @@
>> <path id="spotbugs.classpath">
>> <fileset file="${spotbugs.jar}" />
>> + <fileset file="${findsecbugs.jar}" />
>> </path>
>> <taskdef classpathref="spotbugs.classpath" name="spotbugs"
>> classname="edu.umd.cs.findbugs.anttask.FindBugsTask"/>
>> @@ -3881,6 +3882,14 @@ Configured for ${release.asfusername} to
>> release Tomcat ${version.major}.${versi
>> <param name="checksum.value" value="${spotbugs.checksum.value}"/>
>> </antcall>
>> + <antcall target="downloadfile">
>> + <param name="sourcefile" value="${findsecbugs.loc}"/>
>> + <param name="destfile" value="${findsecbugs.jar}"/>
>> + <param name="checksum.enabled"
>> value="${findsecbugs.checksum.enabled}"/>
>> + <param name="checksum.algorithm"
>> value="${findsecbugs.checksum.algorithm}"/>
>> + <param name="checksum.value"
>> value="${findsecbugs.checksum.value}"/>
>> + </antcall>
>> +
>> </target>
>> <target name="download-dist"
>>
>>
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
>> For additional commands, e-mail: dev-help@tomcat.apache.org
>>
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: dev-help@tomcat.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
Re: (tomcat) branch main updated: Add findsecbugs plugin to spotbugs
Posted by Christopher Schultz <ch...@christopherschultz.net>.
All,
I introduced this into main and did not yet back-port.
I'd like to get some feedback on the way I've done this before I
back-port all the way.
NOTE: findsecbugs does not currently find any additional items on top of
what spotbugs is finding (which is currently also nothing).
-chris
On 10/20/26 8:07 AM, schultz@apache.org wrote:
> This is an automated email from the ASF dual-hosted git repository.
>
> ChristopherSchultz pushed a commit to branch main
> in repository https://gitbox.apache.org/repos/asf/tomcat.git
>
>
> The following commit(s) were added to refs/heads/main by this push:
> new ef4df196ab Add findsecbugs plugin to spotbugs
> ef4df196ab is described below
>
> commit ef4df196aba8be70bd2e1b999ad49223599b0830
> Author: Christopher Schultz <ch...@christopherschultz.net>
> AuthorDate: Tue Oct 20 08:06:49 2026 -0400
>
> Add findsecbugs plugin to spotbugs
> ---
> build.properties.default | 8 ++++++++
> build.xml | 9 +++++++++
> 2 files changed, 17 insertions(+)
>
> diff --git a/build.properties.default b/build.properties.default
> index 6284d027e0..633f31c6ce 100644
> --- a/build.properties.default
> +++ b/build.properties.default
> @@ -293,6 +293,14 @@ spotbugs.home=${base.path}/spotbugs-${spotbugs.version}
> spotbugs.jar=${spotbugs.home}/lib/spotbugs-ant.jar
> spotbugs.loc=${base-maven.loc}/com/github/spotbugs/spotbugs/${spotbugs.version}/spotbugs-${spotbugs.version}.tgz
>
> +findsecbugs.version=1.14.0
> +findsecbugs.loc=${base-maven.loc}/com/h3xstream/findsecbugs/findsecbugs-plugin/${findsecbugs.version}/findsecbugs-plugin-${findsecbugs.version}.jar
> +findsecbugs.jar=${findsecbugs.home}/findsecbugs-plugin-${findsecbugs.version}.jar
> +findsecbugs.checksum.enabled=true
> +findsecbugs.checksum.algorithm=SHA-512
> +findsecbugs.checksum.value=9eb87ea65584d6ab9e79cfcc9a2ffe3519adab9356084c74aaead8b3c7ca1e025ae2c2ba1aa70fab701fcd2f960e044ab467da6199d3a7feb64da5db42bc7991
> +findsecbugs.home=${base.path}/spotbugs-${spotbugs.version}/plugin
> +
> # ----- bnd, version 6.3.0 or later -----
> # ----- provides OSGI metadata for JARs -----
> bnd.version=7.4.0
> diff --git a/build.xml b/build.xml
> index fbf9148cf5..d82a68a001 100644
> --- a/build.xml
> +++ b/build.xml
> @@ -2321,6 +2321,7 @@
>
> <path id="spotbugs.classpath">
> <fileset file="${spotbugs.jar}" />
> + <fileset file="${findsecbugs.jar}" />
> </path>
>
> <taskdef classpathref="spotbugs.classpath" name="spotbugs" classname="edu.umd.cs.findbugs.anttask.FindBugsTask"/>
> @@ -3881,6 +3882,14 @@ Configured for ${release.asfusername} to release Tomcat ${version.major}.${versi
> <param name="checksum.value" value="${spotbugs.checksum.value}"/>
> </antcall>
>
> + <antcall target="downloadfile">
> + <param name="sourcefile" value="${findsecbugs.loc}"/>
> + <param name="destfile" value="${findsecbugs.jar}"/>
> + <param name="checksum.enabled" value="${findsecbugs.checksum.enabled}"/>
> + <param name="checksum.algorithm" value="${findsecbugs.checksum.algorithm}"/>
> + <param name="checksum.value" value="${findsecbugs.checksum.value}"/>
> + </antcall>
> +
> </target>
>
> <target name="download-dist"
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: dev-help@tomcat.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org