All,
I introduced this into main and did not yet back-port.
I'd like to get some feedback on the way I've done this before I
back-port all the way.
NOTE: findsecbugs does not currently find any additional items on top of
what spotbugs is finding (which is currently also nothing).
-chris
On 10/20/26 8:07 AM, [email protected] wrote:
This is an automated email from the ASF dual-hosted git repository.
ChristopherSchultz pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/tomcat.git
The following commit(s) were added to refs/heads/main by this push:
new ef4df196ab Add findsecbugs plugin to spotbugs
ef4df196ab is described below
commit ef4df196aba8be70bd2e1b999ad49223599b0830
Author: Christopher Schultz <[email protected]>
AuthorDate: Tue Oct 20 08:06:49 2026 -0400
Add findsecbugs plugin to spotbugs
---
build.properties.default | 8 ++++++++
build.xml | 9 +++++++++
2 files changed, 17 insertions(+)
diff --git a/build.properties.default b/build.properties.default
index 6284d027e0..633f31c6ce 100644
--- a/build.properties.default
+++ b/build.properties.default
@@ -293,6 +293,14 @@ spotbugs.home=${base.path}/spotbugs-${spotbugs.version}
spotbugs.jar=${spotbugs.home}/lib/spotbugs-ant.jar
spotbugs.loc=${base-maven.loc}/com/github/spotbugs/spotbugs/${spotbugs.version}/spotbugs-${spotbugs.version}.tgz
+findsecbugs.version=1.14.0
+findsecbugs.loc=${base-maven.loc}/com/h3xstream/findsecbugs/findsecbugs-plugin/${findsecbugs.version}/findsecbugs-plugin-${findsecbugs.version}.jar
+findsecbugs.jar=${findsecbugs.home}/findsecbugs-plugin-${findsecbugs.version}.jar
+findsecbugs.checksum.enabled=true
+findsecbugs.checksum.algorithm=SHA-512
+findsecbugs.checksum.value=9eb87ea65584d6ab9e79cfcc9a2ffe3519adab9356084c74aaead8b3c7ca1e025ae2c2ba1aa70fab701fcd2f960e044ab467da6199d3a7feb64da5db42bc7991
+findsecbugs.home=${base.path}/spotbugs-${spotbugs.version}/plugin
+
# ----- bnd, version 6.3.0 or later -----
# ----- provides OSGI metadata for JARs -----
bnd.version=7.4.0
diff --git a/build.xml b/build.xml
index fbf9148cf5..d82a68a001 100644
--- a/build.xml
+++ b/build.xml
@@ -2321,6 +2321,7 @@
<path id="spotbugs.classpath">
<fileset file="${spotbugs.jar}" />
+ <fileset file="${findsecbugs.jar}" />
</path>
<taskdef classpathref="spotbugs.classpath" name="spotbugs" classname="edu.umd.cs.findbugs.anttask.FindBugsTask"/>
@@ -3881,6 +3882,14 @@ Configured for ${release.asfusername} to release Tomcat
${version.major}.${versi
<param name="checksum.value" value="${spotbugs.checksum.value}"/>
</antcall>
+ <antcall target="downloadfile">
+ <param name="sourcefile" value="${findsecbugs.loc}"/>
+ <param name="destfile" value="${findsecbugs.jar}"/>
+ <param name="checksum.enabled" value="${findsecbugs.checksum.enabled}"/>
+ <param name="checksum.algorithm"
value="${findsecbugs.checksum.algorithm}"/>
+ <param name="checksum.value" value="${findsecbugs.checksum.value}"/>
+ </antcall>
+
</target>
<target name="download-dist"
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
