Repository navigation
spotbugs: add 4.10.5 - #908
Conversation
JVM tool for the Java loadout (#899): upstream release artifact run on our jdk through a /usr/bin wrapper, with Standalone tests that run the tool on a small real input. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
Warning Review limit reached
This review includes 2 billable files and costs up to $0.50.
Reviews can continue after your included limit without a manual trigger. An admin must approve usage-based billing. Or wait 15 minutes for your next included review. View limit details
Comment |
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
There was a problem hiding this comment.
Clean. The sha256 matches, the launcher's deps match runtime_deps, and the test is strong: it compiles a class with a real bug and requires IL_INFINITE_RECURSIVE_LOOP to be reported.
Holding approval only on the shared JVM prebuilt-jar policy question, which is being decided once for the batch.
Generated by Claude Code
|
Thanks @norrietaylor.
🤖 Generated with Claude Code |
There was a problem hiding this comment.
Approving under #970. The branch is past #897 and there's no native code. Please merge after #970.
Generated by Claude Code
What
Adds
spotbugs4.10.5, the bytecode bug finder that succeeds FindBugs. It is a Tier 2 item in the #899 Java loadout checklist. It is usually run as a build plugin, but the CLI is useful for scanning a jar or classes dir you didn't build.spotbugs-4.10.5.tgzfrom GitHub releases. It is extracted withtar -xoftousr/share/spotbugs, minusspotbugs.batandspotbugs.ico. A/usr/bin/spotbugswrapper execsusr/share/spotbugs/bin/spotbugsby its real path, because that script derives its home from$0.jdk, plusbash,coreutilsandsed. Upstream's launcher is a POSIX sh script that callsls,expr,dirname,unameandsed.maven,gradleandjdtlsmake. Recorded asbinary_from.LGPL-2.1-or-later.LICENSE.txtis the LGPL-2.1 text, and the source headers say "either version 2.1 … or (at your option) any later version".lib/bundles Apache-2.0, BSD and MPL jars, with their texts shipped asLICENSE-*.txt.source_provenance = GithubRepo spotbugs/spotbugs. Tags are bare<version>.cce32449…d96007e, computed locally and matching the GitHub release asset digest.version-agewill flag it as under 7 days old (report-only). 4.10.4 (2026-08-20) is the fallback if we'd rather wait.Tests (Standalone)
find_bug: SpotBugs analyses bytecode, so the testjavacs a class with unconditional self-recursion (return loop(x);). Runningspotbugs -textui -low -xml:withMessageson it must reportIL_INFINITE_RECURSIVE_LOOP. A clean class must produce aBugCollectionwith noBugInstance.Verified
Built in a
pkgbuildsession (arm64).min check --packages spotbugspassed every checker, includingstandalone tests,output types validandmissing runtime_deps. Negative control: changing the expected bug type to a non-existent one madefind_bugfail.amd64 is not separately run locally; it is left to CI.
Refs #899
🤖 Generated with Claude Code