pmd: add 7.28.0 by bryan-minimal · Pull Request #907 · gominimal/pkgs

bryan-minimal · 2026-10-16T20:31:54Z

What

Adds pmd 7.28.0, the Java static analyser. It also brings CPD, the copy-paste detector. It is a Tier 1 item in the #899 Java loadout checklist.

Artifact: the upstream pmd-dist-7.28.0-bin.zip from GitHub releases, which contains bin/pmd, conf/ and about 115 jars. It is unpacked with unzip to usr/share/pmd, minus pmd.bat. A /usr/bin/pmd wrapper execs usr/share/pmd/bin/pmd by its real path, because that script derives PMD_HOME from $0.
Runtime deps: jdk, plus bash, coreutils, grep and sed. Upstream's bin/pmd is a POSIX sh script that calls uname and dirname, and greps/seds java -XshowSettings:properties before it execs java.
Prebuilt, not built from source: upstream builds with a Maven reactor that resolves dependencies from Maven Central at build time. This is the same tradeoff maven, gradle and jdtls make. Recorded as binary_from.
License: LicenseRef-PMD AND Apache-2.0. Reviewer, please confirm. LICENSE is PMD's own BSD-style text (InfoEther, LLC) followed by the Apache-2.0 text that covers newer parts.
- The BSD-style part adds an end-user-documentation acknowledgement clause: "This product includes software developed in part by support from the Defense Advanced Research Project Agency (DARPA)".
- That makes it neither BSD-3-Clause nor BSD-4-Clause; BSD-4-Clause's extra clause is about advertising materials. SPDX has no id for it.
- So it gets a LicenseRef per LICENSING.md, in the same way as LicenseRef-BuDDy. license_lint.py accepts LicenseRef-* inside compound expressions.
- The bundled third-party jars carry their own licenses (see sbom/pmd-7.28.0-cyclonedx.json, which is shipped). They are not enumerated in license_spdx, consistent with maven and gradle.
Version checking / CVE identity: source_provenance = GithubRepo pmd/pmd. ⚠ The tags are pmd_releases/<version>. I believe pkgmgr's tag normaliser strips pmd_ as a package-name prefix and is left with releases/7.28.0, which does not parse. If so, the GitHub tier will not resolve this package and it will fall through to repology. That is a pkgmgr-side fix and does not block this PR. Advisories still key off the GitHub repo.
sha256: f974ba57…e9fbac2, computed locally and matching the GitHub release asset digest. Upstream also publishes a .asc signature.

Tests (Standalone)

check: the rulesets/java/quickstart.xml ruleset runs on a file with a planted unused private field and an empty catch block.
- It must exit 4 ("violations found") and report both UnusedPrivateField and EmptyCatchBlock.
- A clean file must exit 0. It declares a package, because quickstart includes NoPackage.
cpd: pmd cpd --minimum-tokens 20 runs on two classes that share a 10-line method. It must exit 4 and print Found a … duplication.

Verified

Built in a pkgbuild session (arm64). min check --packages pmd passed every checker, including standalone tests, output types valid and missing runtime_deps. Negative control: the first draft had a clean file with no package, and check correctly failed with exit 4 from NoPackage.

amd64 is not separately run locally; it is left to CI.

Refs #899

🤖 Generated with Claude Code

JVM tool for the Java loadout (#899): upstream release artifact run on our jdk through a /usr/bin wrapper, with Standalone tests that run the tool on a small real input. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

coderabbitai · 2026-10-16T20:32:05Z

Warning

Review limit reached

Run on-demand review

_{This review includes 2 billable files and costs up to $0.50.}

Ask an admin to make reviews automatic

Open in CodeRabbit

Reviews can continue after your included limit without a manual trigger. An admin must approve usage-based billing.

Or wait 15 minutes for your next included review.

Check out review usage here.

View limit details

Limit details: You’ve used all 2 included reviews currently available. Your 58 included PR review attempts over the past 7 days set your current allowance at 2 reviews per hour.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Repository: gominimal/pkgs/.coderabbit.yaml
Review profile: CHILL
Plan: Essentials
Run ID: 607a827f-66ec-46e0-b2f3-5c2fd2f4dbfd

📥 Commits

Reviewing files that changed from the base of the PR and between 0618acc and 0da916a.

📒 Files selected for processing: 2

packages/pmd/build.ncl
packages/pmd/build.sh

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

bryan-minimal · 2026-10-16T21:40:58Z

The PMD version-check concern in the description is resolved: minimal-supply-chain#515 pins pmd_releases/7.28.0 → 7.28.0 in the canonicaliser's fleet table and passes CI. The guarded last-resort step splits on /, so PMD is version-checkable as-is.

🤖 Generated with Claude Code

norrietaylor

Clean:

The sha256 matches and test -x guards the launcher.
The tests cover pmd check (exit 4 on violations, 0 on a clean file) and CPD.
LicenseRef-PMD AND Apache-2.0 is well argued and follows the LicenseRef-BuDDy precedent.
I read the launcher, and the tools it calls match runtime_deps.

Holding approval only on the shared JVM prebuilt-jar policy question, which is being decided once for the batch.

Generated by Claude Code

…minimal#776) One comment line per frozen bootstrap rung already on main (39): hex0/stage0/ bedrock -> "hex0", go-1.x chain -> "go", mrustc..rustc-1.97.1 -> "rust". Read by pkgmgr (pkgmgr-rs#904/gominimal#907) to freeze the rung; comments are not evaluated and not in the spec hash, so nothing rebuilds. Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

bryan-minimal · 2026-10-22T02:07:15Z

Thanks @norrietaylor.

Rebase onto jdk: current LTS (meta over jdk-25); add jdk-25 (Temurin 25) and jdk-21 (Temurin 21) #897: I merged main instead of rebasing, so there was no force-push. jdk now resolves to Temurin 25, and the build bot rebuilds the branch on its own (it's in this repo), so that build is the run on 25.
Prebuilt-jar policy: AGENTS.md: JVM tools may ship upstream jars until #969 #970 writes the exception into AGENTS.md for the whole JVM batch, conditional on JVM tools from source: maven and gradle from source, plus offline Maven staging #969. It now also requires the tool's own code to be complete in the checksummed artifact, so the tool runs offline and fetches no code of its own.

bash -n, nickel format --check and mip dump --packages (amd64) are clean after the merge.

🤖 Generated with Claude Code

norrietaylor

Approving under #970. The branch is past #897 and CI is green. Please merge after #970.

Non-blocking: the distribution ships jna-5.12.1, jline-native-3.29.0 and kotlin-compiler-embeddable with JNI .so resources, which #970's "bundled .so files" wording arguably excludes (raised there).

Generated by Claude Code

pmd: add 7.28.0

41131d8

JVM tool for the Java loadout (#899): upstream release artifact run on our jdk through a /usr/bin wrapper, with Standalone tests that run the tool on a small real input. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

bryan-minimal requested a review from a team as a code owner October 16, 2026 20:31

ci: retrigger buildbot (opened-PR webhook was not received)

deee1bb

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

norrietaylor reviewed Oct 19, 2026

View reviewed changes

Merge remote-tracking branch 'origin/main' into HEAD

0da916a

norrietaylor mentioned this pull request Oct 22, 2026

AGENTS.md: JVM tools may ship upstream jars until #969 #970

Merged

norrietaylor approved these changes Oct 22, 2026

View reviewed changes

bryan-minimal added this pull request to the merge queue Oct 22, 2026

Merged via the queue into main with commit 5fbea71 Oct 22, 2026
11 checks passed

bryan-minimal deleted the add-pmd branch October 22, 2026 23:24

Navigation Menu

Repository navigation

pmd: add 7.28.0 - #907

pmd: add 7.28.0#907
bryan-minimal merged 3 commits into
mainfrom
add-pmd

Uh oh!

Review limit reached

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

What

Tests (Standalone)

Verified

Uh oh!

Uh oh!

Review limit reached

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants