Mark,
On 10/21/26 8:54 AM, Mark Thomas wrote:
On 21/10/2026 13:30, Christopher Schultz wrote:
Mark,
On 10/21/26 5:01 AM, Mark Thomas wrote:
On 20/10/2026 23:38, Christopher Schultz wrote:
All,
I introduced this into main and did not yet back-port.
I'd like to get some feedback on the way I've done this before I
back- port all the way.
I made a couple of minor tweaks.
I think removing the findsecbugs JAR from the spotbugs classpath ends
up skipping the findsecbugs tests entirely. I tried a few times to
make it work and this seemed like the easiest way to trigger scanning.
The other way was to explicitly add a pluginList="" attribute to the
<spotbugs> call.
My understanding was that findbugs picks up everything from the plugins
directory automatically.
I guess what we need is a temporary change that triggers a report. Any
ideas?
I can just run it (spotbugs) locally in "debug" mode. When run un debug
mode, it tells you which scans are being done, including (or not) the
findsecbugs ones.
Okay, I just ran it in debug mode on main HEAD and everything seems
fine. I have no idea why I wasn't able to get that to work previously.
Oh, right. Because I was putting the JAR into a weird place. Your patch
puts it into the right place, and the findsecbugs.jar property isn't
used by anything at all. I'll remove the full path from it and just use
the JAR file name.
-chris
On 10/20/26 8:07 AM, [email protected] wrote:
This is an automated email from the ASF dual-hosted git repository.
ChristopherSchultz pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/tomcat.git
The following commit(s) were added to refs/heads/main by this push:
new ef4df196ab Add findsecbugs plugin to spotbugs
ef4df196ab is described below
commit ef4df196aba8be70bd2e1b999ad49223599b0830
Author: Christopher Schultz <[email protected]>
AuthorDate: Tue Oct 20 08:06:49 2026 -0400
Add findsecbugs plugin to spotbugs
---
build.properties.default | 8 ++++++++
build.xml | 9 +++++++++
2 files changed, 17 insertions(+)
diff --git a/build.properties.default b/build.properties.default
index 6284d027e0..633f31c6ce 100644
--- a/build.properties.default
+++ b/build.properties.default
@@ -293,6 +293,14 @@ spotbugs.home=${base.path}/spotbugs-
${spotbugs.version}
spotbugs.jar=${spotbugs.home}/lib/spotbugs-ant.jar
spotbugs.loc=${base-maven.loc}/com/github/spotbugs/spotbugs/
${spotbugs.version}/spotbugs-${spotbugs.version}.tgz
+findsecbugs.version=1.14.0
+findsecbugs.loc=${base-maven.loc}/com/h3xstream/findsecbugs/
findsecbugs-plugin/${findsecbugs.version}/findsecbugs-plugin-
${findsecbugs.version}.jar
+findsecbugs.jar=${findsecbugs.home}/findsecbugs-plugin-
${findsecbugs.version}.jar
+findsecbugs.checksum.enabled=true
+findsecbugs.checksum.algorithm=SHA-512
+findsecbugs.checksum.value=9eb87ea65584d6ab9e79cfcc9a2ffe3519adab9356084c74aaead8b3c7ca1e025ae2c2ba1aa70fab701fcd2f960e044ab467da6199d3a7feb64da5db42bc7991
+findsecbugs.home=${base.path}/spotbugs-${spotbugs.version}/plugin
+
# ----- bnd, version 6.3.0 or later -----
# ----- provides OSGI metadata for JARs -----
bnd.version=7.4.0
diff --git a/build.xml b/build.xml
index fbf9148cf5..d82a68a001 100644
--- a/build.xml
+++ b/build.xml
@@ -2321,6 +2321,7 @@
<path id="spotbugs.classpath">
<fileset file="${spotbugs.jar}" />
+ <fileset file="${findsecbugs.jar}" />
</path>
<taskdef classpathref="spotbugs.classpath" name="spotbugs"
classname="edu.umd.cs.findbugs.anttask.FindBugsTask"/>
@@ -3881,6 +3882,14 @@ Configured for ${release.asfusername} to
release Tomcat ${version.major}.${versi
<param name="checksum.value"
value="${spotbugs.checksum.value}"/>
</antcall>
+ <antcall target="downloadfile">
+ <param name="sourcefile" value="${findsecbugs.loc}"/>
+ <param name="destfile" value="${findsecbugs.jar}"/>
+ <param name="checksum.enabled"
value="${findsecbugs.checksum.enabled}"/>
+ <param name="checksum.algorithm"
value="${findsecbugs.checksum.algorithm}"/>
+ <param name="checksum.value"
value="${findsecbugs.checksum.value}"/>
+ </antcall>
+
</target>
<target name="download-dist"
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
