On 21/10/2026 13:30, Christopher Schultz wrote:
Mark,
On 10/21/26 5:01 AM, Mark Thomas wrote:
On 20/10/2026 23:38, Christopher Schultz wrote:
All,
I introduced this into main and did not yet back-port.
I'd like to get some feedback on the way I've done this before I
back- port all the way.
I made a couple of minor tweaks.
I think removing the findsecbugs JAR from the spotbugs classpath ends up
skipping the findsecbugs tests entirely. I tried a few times to make it
work and this seemed like the easiest way to trigger scanning. The other
way was to explicitly add a pluginList="" attribute to the <spotbugs> call.
My understanding was that findbugs picks up everything from the plugins
directory automatically.
I guess what we need is a temporary change that triggers a report. Any
ideas?
Mark
-chris
On 10/20/26 8:07 AM, [email protected] wrote:
This is an automated email from the ASF dual-hosted git repository.
ChristopherSchultz pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/tomcat.git
The following commit(s) were added to refs/heads/main by this push:
new ef4df196ab Add findsecbugs plugin to spotbugs
ef4df196ab is described below
commit ef4df196aba8be70bd2e1b999ad49223599b0830
Author: Christopher Schultz <[email protected]>
AuthorDate: Tue Oct 20 08:06:49 2026 -0400
Add findsecbugs plugin to spotbugs
---
build.properties.default | 8 ++++++++
build.xml | 9 +++++++++
2 files changed, 17 insertions(+)
diff --git a/build.properties.default b/build.properties.default
index 6284d027e0..633f31c6ce 100644
--- a/build.properties.default
+++ b/build.properties.default
@@ -293,6 +293,14 @@ spotbugs.home=${base.path}/spotbugs-
${spotbugs.version}
spotbugs.jar=${spotbugs.home}/lib/spotbugs-ant.jar
spotbugs.loc=${base-maven.loc}/com/github/spotbugs/spotbugs/
${spotbugs.version}/spotbugs-${spotbugs.version}.tgz
+findsecbugs.version=1.14.0
+findsecbugs.loc=${base-maven.loc}/com/h3xstream/findsecbugs/
findsecbugs-plugin/${findsecbugs.version}/findsecbugs-plugin-
${findsecbugs.version}.jar
+findsecbugs.jar=${findsecbugs.home}/findsecbugs-plugin-
${findsecbugs.version}.jar
+findsecbugs.checksum.enabled=true
+findsecbugs.checksum.algorithm=SHA-512
+findsecbugs.checksum.value=9eb87ea65584d6ab9e79cfcc9a2ffe3519adab9356084c74aaead8b3c7ca1e025ae2c2ba1aa70fab701fcd2f960e044ab467da6199d3a7feb64da5db42bc7991
+findsecbugs.home=${base.path}/spotbugs-${spotbugs.version}/plugin
+
# ----- bnd, version 6.3.0 or later -----
# ----- provides OSGI metadata for JARs -----
bnd.version=7.4.0
diff --git a/build.xml b/build.xml
index fbf9148cf5..d82a68a001 100644
--- a/build.xml
+++ b/build.xml
@@ -2321,6 +2321,7 @@
<path id="spotbugs.classpath">
<fileset file="${spotbugs.jar}" />
+ <fileset file="${findsecbugs.jar}" />
</path>
<taskdef classpathref="spotbugs.classpath" name="spotbugs"
classname="edu.umd.cs.findbugs.anttask.FindBugsTask"/>
@@ -3881,6 +3882,14 @@ Configured for ${release.asfusername} to
release Tomcat ${version.major}.${versi
<param name="checksum.value"
value="${spotbugs.checksum.value}"/>
</antcall>
+ <antcall target="downloadfile">
+ <param name="sourcefile" value="${findsecbugs.loc}"/>
+ <param name="destfile" value="${findsecbugs.jar}"/>
+ <param name="checksum.enabled"
value="${findsecbugs.checksum.enabled}"/>
+ <param name="checksum.algorithm"
value="${findsecbugs.checksum.algorithm}"/>
+ <param name="checksum.value"
value="${findsecbugs.checksum.value}"/>
+ </antcall>
+
</target>
<target name="download-dist"
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
