Sorry, yes I meant maven On 1 Oct 2009, at 17:19, Paul Gier wrote: > You mean in our Maven repo? Sure, I can add it today. > > Kabir Khan wrote: > >> Paul, >> Can we get the latest findbugs plugin in our svn please? >> On 30 Sep 2009, at 14:50, Anil Saldhana wrote: >> >>> AndyM was saying that before log trace call is finally written to >>> the >>> sink, there is some overhead in creating objects etc which are just >>> thrown away if trace is not enabled. So rather than figure out >>> whether >>> trace is enabled upfront, log4j does this check at the time of >>> writing >>> after having done some processing. >>> >>> David M. Lloyd wrote: >>> >>>> Sometimes. But doing: >>>> >>>> log.trace("foo"); >>>> >>>> is faster than: >>>> >>>> if (log.isTraceEnabled()) log.trace("foo"); >>>> >>>> because there's no computation involved in the log parameter, so >>>> it's just >>>> a plain method call, and the internal impl will do the same check >>>> anyway. >>>> >>>> - DML >>>> >>>> On 09/29/2009 10:53 AM, Anil Saldhana wrote: >>>> >>>> >>>>> Additionally, as we discussed, flagging log.trace/debug without >>>>> the >>>>> log.isTraceEnabled/debugEnabled wrappers. That may be a feature. >>>>> >>>>> Jesper Pedersen wrote: >>>>> >>>>> >>>>>> http://findbugs.sourceforge.net/bugDescriptions.html >>>>>> >>>>>> looks for doPrivileged in the descriptions. >>>>>> >>>>>> >>>>>> On Tuesday 29 September 2009 11:46:36 Anil Saldhana wrote: >>>>>> >>>>>> >>>>>> >>>>>>> I am wondering if FindBugs does flag the lack of privileged >>>>>>> blocks >>>>>>> around sensitive ops such as loadClass, setTCCL etc? I cannot >>>>>>> find any >>>>>>> reference online. >>>>>>> >>>>>>> David M. Lloyd wrote: >>>>>>> >>>>>>> >>>>>>> >>>>>>>> Does FindBugs support using @SuppressWarnings() or similar? >>>>>>>> This is what >>>>>>>> I do with IDEA and it works well. I use @SuppressWarnings >>>>>>>> (on classes, >>>>>>>> members, or local var declarations) or "//noinspection" for >>>>>>>> other cases, >>>>>>>> and then add a comment beforehand explaining why the problem >>>>>>>> isn't really >>>>>>>> a problem. >>>>>>>> >>>>>>>> - DML >>>>>>>> >>>>>>>> On 09/29/2009 08:38 AM, Jesper Pedersen wrote: >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>>> Hi. >>>>>>>>> >>>>>>>>> Please, add a FindBugs filter file to the configuration >>>>>>>>> where we can add >>>>>>>>> exclusions - f.ex. org.jfree (unless someone wants to submit >>>>>>>>> patches >>>>>>>>> upstream). >>>>>>>>> >>>>>>>>> Feel free to rip the JBJCA setup :) >>>>>>>>> >>>>>>>>> Best regards, >>>>>>>>> Jesper >>>>>>>>> >>>>>>>>> On Monday 28 September 2009 22:33:22 Shelly McGowan wrote: >>>>>>>>> >>>>>>>>> >>>>>>>>> >>>>>>>>>> I've published the FindBugs report set up by the JBoss QA >>>>>>>>>> team run >>>>>>>>>> against JBoss AS. The reports can be viewed here: >>>>>>>>>> >>>>>>>>>> http://hudson.jboss.org/hudson/view/JBoss%20AS/job/JBoss-AS-6.0.x-findb >>>>>>>>>> ugs/ 8/findbugsResult >>>>>>>>>> >>>>>>>>>> This report shows a total of 5675 warnings, 877 of which are >>>>>>>>>> categorized as High Priority. >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> The report for Branch_5_x can be viewed here: >>>>>>>>>> >>>>>>>>>> http://hudson.jboss.org/hudson/view/JBoss%20AS/job/JBoss-AS-5.x-findbug >>>>>>>>>> s/2/ findbugsResult/ >>>>>>>>>> >>>>>>>>>> The Branch_5_x report has 6089 warnings, 977 High Priority. >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> These issues should be addressed when committing to trunk or >>>>>>>>>> Branch_5_x. Take time out to look at the report data. Most >>>>>>>>>> of the >>>>>>>>>> warnings can be easily addressed. >>>>>>>>>> >>>>>>>>>> I've started a parent JIRA task for tracking: >>>>>>>>>> >>>>>>>>>> https://jira.jboss.org/jira/browse/JBAS-7295 >>>>>>>>>> >>>>>>>>>> and will create subtasks as needed after additional review >>>>>>>>>> of the >>>>>>>>>> report data.

So that you can have findbugs configured to be quite sensitive, but also be able to silence false alarms (with an explanation). - DML On 10/01/2009 11:34 AM, Anil Saldhana wrote: > And why would you decorate your source code with FindBugs specific > annotations? > > Kabir Khan wrote: > >> Sorry, yes I meant maven >> On 1 Oct 2009, at 17:19, Paul Gier wrote: >> >> >> >>> You mean in our Maven repo? Sure, I can add it today. >>> >>> Kabir Khan wrote: >>> >>> >>>> Paul, >>>> Can we get the latest findbugs plugin in our svn please? >>>> On 30 Sep 2009, at 14:50, Anil Saldhana wrote: >>>> >>>> >>>>> AndyM was saying that before log trace call is finally written to >>>>> the >>>>> sink, there is some overhead in creating objects etc which are just >>>>> thrown away if trace is not enabled. So rather than figure out >>>>> whether >>>>> trace is enabled upfront, log4j does this check at the time of >>>>> writing >>>>> after having done some processing. >>>>> >>>>> David M. Lloyd wrote: >>>>> >>>>> >>>>>> Sometimes. But doing: >>>>>> >>>>>> log.trace("foo"); >>>>>> >>>>>> is faster than: >>>>>> >>>>>> if (log.isTraceEnabled()) log.trace("foo"); >>>>>> >>>>>> because there's no computation involved in the log parameter, so >>>>>> it's just >>>>>> a plain method call, and the internal impl will do the same check >>>>>> anyway. >>>>>> >>>>>> - DML >>>>>> >>>>>> On 09/29/2009 10:53 AM, Anil Saldhana wrote: >>>>>> >>>>>> >>>>>> >>>>>>> Additionally, as we discussed, flagging log.trace/debug without >>>>>>> the >>>>>>> log.isTraceEnabled/debugEnabled wrappers. That may be a feature. >>>>>>> >>>>>>> Jesper Pedersen wrote: >>>>>>> >>>>>>> >>>>>>> >>>>>>>> http://findbugs.sourceforge.net/bugDescriptions.html >>>>>>>> >>>>>>>> looks for doPrivileged in the descriptions. >>>>>>>> >>>>>>>> >>>>>>>> On Tuesday 29 September 2009 11:46:36 Anil Saldhana wrote: >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>>> I am wondering if FindBugs does flag the lack of privileged >>>>>>>>> blocks >>>>>>>>> around sensitive ops such as loadClass, setTCCL etc? I cannot >>>>>>>>> find any >>>>>>>>> reference online. >>>>>>>>> >>>>>>>>> David M. Lloyd wrote: >>>>>>>>> >>>>>>>>> >>>>>>>>> >>>>>>>>> >>>>>>>>>> Does FindBugs support using @SuppressWarnings() or similar? >>>>>>>>>> This is what >>>>>>>>>> I do with IDEA and it works well. I use @SuppressWarnings >>>>>>>>>> (on classes, >>>>>>>>>> members, or local var declarations) or "//noinspection" for >>>>>>>>>> other cases, >>>>>>>>>> and then add a comment beforehand explaining why the problem >>>>>>>>>> isn't really >>>>>>>>>> a problem. >>>>>>>>>> >>>>>>>>>> - DML >>>>>>>>>> >>>>>>>>>> On 09/29/2009 08:38 AM, Jesper Pedersen wrote: >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> >>>>>>>>>>> Hi. >>>>>>>>>>> >>>>>>>>>>> Please, add a FindBugs filter file to the configuration >>>>>>>>>>> where we can add >>>>>>>>>>> exclusions - f.ex. org.jfree (unless someone wants to submit >>>>>>>>>>> patches >>>>>>>>>>> upstream). >>>>>>>>>>> >>>>>>>>>>> Feel free to rip the JBJCA setup :) >>>>>>>>>>> >>>>>>>>>>> Best regards, >>>>>>>>>>> Jesper >>>>>>>>>>> >>>>>>>>>>> On Monday 28 September 2009 22:33:22 Shelly McGowan wrote: >>>>>>>>>>> >>>>>>>>>>> >>>>>>>>>>> >>>>>>>>>>> >>>>>>>>>>>> I've published the FindBugs report set up by the JBoss QA >>>>>>>>>>>> team run >>>>>>>>>>>> against JBoss AS. The reports can be viewed here: >>>>>>>>>>>> >>>>>>>>>>>> http://hudson.jboss.org/hudson/view/JBoss%20AS/job/JBoss-AS-6.0.x-findb >>>>>>>>>>>> ugs/ 8/findbugsResult >>>>>>>>>>>> >>>>>>>>>>>> This report shows a total of 5675 warnings, 877 of which are >>>>>>>>>>>> categorized as High Priority. >>>>>>>>>>>> >>>>>>>>>>>> >>>>>>>>>>>> The report for Branch_5_x can be viewed here: >>>>>>>>>>>> >>>>>>>>>>>> http://hudson.jboss.org/hudson/view/JBoss%20AS/job/JBoss-AS-5.x-findbug >>>>>>>>>>>> s/2/ findbugsResult/ >>>>>>>>>>>> >>>>>>>>>>>> The Branch_5_x report has 6089 warnings, 977 High Priority. >>>>>>>>>>>> >>>>>>>>>>>> >>>>>>>>>>>> These issues should be addressed when committing to trunk or >>>>>>>>>>>> Branch_5_x. Take time out to look at the report data. Most >>>>>>>>>>>> of the >>>>>>>>>>>> warnings can be easily addressed. >>>>>>>>>>>> >>>>>>>>>>>> I've started a parent JIRA task for tracking: >>>>>>>>>>>> >>>>>>>>>>>> https://jira.jboss.org/jira/browse/JBAS-7295 >>>>>>>>>>>> >>>>>>>>>>>> and will create subtasks as needed after additional review >>>>>>>>>>>> of the >>>>>>>>>>>> report data.

That's OK. Compile-time deps are not a huge deal for anyone but developers. And crazy people. As long as the run-time deps are minimal, it should be OK. - DML On 10/01/2009 12:30 PM, Anil Saldhana wrote: > I was asking because now the source will have a dependence on FindBugs > at compile time? I understand the "suppresswarning" intent. > > David M. Lloyd wrote: >> So that you can have findbugs configured to be quite sensitive, but also be >> able to silence false alarms (with an explanation). >> >> - DML >> >> On 10/01/2009 11:34 AM, Anil Saldhana wrote: >> >>> And why would you decorate your source code with FindBugs specific >>> annotations? >>> >>> Kabir Khan wrote: >>> >>>> Sorry, yes I meant maven >>>> On 1 Oct 2009, at 17:19, Paul Gier wrote: >>>> >>>> >>>> >>>>> You mean in our Maven repo? Sure, I can add it today. >>>>> >>>>> Kabir Khan wrote: >>>>> >>>>> >>>>>> Paul, >>>>>> Can we get the latest findbugs plugin in our svn please? >>>>>> On 30 Sep 2009, at 14:50, Anil Saldhana wrote: >>>>>> >>>>>> >>>>>>> AndyM was saying that before log trace call is finally written to >>>>>>> the >>>>>>> sink, there is some overhead in creating objects etc which are just >>>>>>> thrown away if trace is not enabled. So rather than figure out >>>>>>> whether >>>>>>> trace is enabled upfront, log4j does this check at the time of >>>>>>> writing >>>>>>> after having done some processing. >>>>>>> >>>>>>> David M. Lloyd wrote: >>>>>>> >>>>>>> >>>>>>>> Sometimes. But doing: >>>>>>>> >>>>>>>> log.trace("foo"); >>>>>>>> >>>>>>>> is faster than: >>>>>>>> >>>>>>>> if (log.isTraceEnabled()) log.trace("foo"); >>>>>>>> >>>>>>>> because there's no computation involved in the log parameter, so >>>>>>>> it's just >>>>>>>> a plain method call, and the internal impl will do the same check >>>>>>>> anyway. >>>>>>>> >>>>>>>> - DML >>>>>>>> >>>>>>>> On 09/29/2009 10:53 AM, Anil Saldhana wrote: >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>>> Additionally, as we discussed, flagging log.trace/debug without >>>>>>>>> the >>>>>>>>> log.isTraceEnabled/debugEnabled wrappers. That may be a feature. >>>>>>>>> >>>>>>>>> Jesper Pedersen wrote: >>>>>>>>> >>>>>>>>> >>>>>>>>> >>>>>>>>>> http://findbugs.sourceforge.net/bugDescriptions.html >>>>>>>>>> >>>>>>>>>> looks for doPrivileged in the descriptions. >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> On Tuesday 29 September 2009 11:46:36 Anil Saldhana wrote: >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> >>>>>>>>>>> I am wondering if FindBugs does flag the lack of privileged >>>>>>>>>>> blocks >>>>>>>>>>> around sensitive ops such as loadClass, setTCCL etc? I cannot >>>>>>>>>>> find any >>>>>>>>>>> reference online. >>>>>>>>>>> >>>>>>>>>>> David M. Lloyd wrote: >>>>>>>>>>> >>>>>>>>>>> >>>>>>>>>>> >>>>>>>>>>> >>>>>>>>>>>> Does FindBugs support using @SuppressWarnings() or similar? >>>>>>>>>>>> This is what >>>>>>>>>>>> I do with IDEA and it works well. I use @SuppressWarnings >>>>>>>>>>>> (on classes, >>>>>>>>>>>> members, or local var declarations) or "//noinspection" for >>>>>>>>>>>> other cases, >>>>>>>>>>>> and then add a comment beforehand explaining why the problem >>>>>>>>>>>> isn't really >>>>>>>>>>>> a problem. >>>>>>>>>>>> >>>>>>>>>>>> - DML >>>>>>>>>>>> >>>>>>>>>>>> On 09/29/2009 08:38 AM, Jesper Pedersen wrote: >>>>>>>>>>>> >>>>>>>>>>>> >>>>>>>>>>>> >>>>>>>>>>>> >>>>>>>>>>>>> Hi. >>>>>>>>>>>>> >>>>>>>>>>>>> Please, add a FindBugs filter file to the configuration >>>>>>>>>>>>> where we can add >>>>>>>>>>>>> exclusions - f.ex. org.jfree (unless someone wants to submit >>>>>>>>>>>>> patches >>>>>>>>>>>>> upstream). >>>>>>>>>>>>> >>>>>>>>>>>>> Feel free to rip the JBJCA setup :) >>>>>>>>>>>>> >>>>>>>>>>>>> Best regards, >>>>>>>>>>>>> Jesper >>>>>>>>>>>>> >>>>>>>>>>>>> On Monday 28 September 2009 22:33:22 Shelly McGowan wrote: >>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>>> I've published the FindBugs report set up by the JBoss QA >>>>>>>>>>>>>> team run >>>>>>>>>>>>>> against JBoss AS. The reports can be viewed here: >>>>>>>>>>>>>> >>>>>>>>>>>>>> http://hudson.jboss.org/hudson/view/JBoss%20AS/job/JBoss-AS-6.0.x-findb >>>>>>>>>>>>>> ugs/ 8/findbugsResult >>>>>>>>>>>>>> >>>>>>>>>>>>>> This report shows a total of 5675 warnings, 877 of which are >>>>>>>>>>>>>> categorized as High Priority. >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> The report for Branch_5_x can be viewed here: >>>>>>>>>>>>>> >>>>>>>>>>>>>> http://hudson.jboss.org/hudson/view/JBoss%20AS/job/JBoss-AS-5.x-findbug >>>>>>>>>>>>>> s/2/ findbugsResult/ >>>>>>>>>>>>>> >>>>>>>>>>>>>> The Branch_5_x report has 6089 warnings, 977 High Priority. >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> These issues should be addressed when committing to trunk or >>>>>>>>>>>>>> Branch_5_x. Take time out to look at the report data. Most >>>>>>>>>>>>>> of the >>>>>>>>>>>>>> warnings can be easily addressed. >>>>>>>>>>>>>> >>>>>>>>>>>>>> I've started a parent JIRA task for tracking: >>>>>>>>>>>>>> >>>>>>>>>>>>>> https://jira.jboss.org/jira/browse/JBAS-7295 >>>>>>>>>>>>>> >>>>>>>>>>>>>> and will create subtasks as needed after additional review >>>>>>>>>>>>>> of the >>>>>>>>>>>>>> report data. > _______________________________________________ > jboss-development mailing list > jboss-development(a)lists.jboss.org > https://lists.jboss.org/mailman/listinfo/jboss-development _______________________________________________ jboss-development mailing list jboss-development(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/jboss-development