Intent to retire - findbugs / findbugs-bcel / findbugs-contrib / eclipse-findbugs

[Richard Fearn]

Hi everyone,

I'm writing to say that I intend to retire the following packages:

* findbugs
* findbugs-bcel
* findbugs-contrib
* eclipse-findbugs

The rationale behind this is:

* The last FindBugs release was in March 2015 [1].

* Upstream has been dead since 2016 [2].

* The project was forked in 2017 [3] as SpotBugs [4].

* FindBugs depends on an old snapshot of Apache Commons BCEL (packaged as
findbugs-bcel). I don't think it's possible (or worthwhile) to get FindBugs
to build against upstream BCEL.

* It no longer builds against the latest rawhide versions of ASM and
Hamcrest.

* Trying to maintain FindBugs and keep it building/working against the
latest versions of Java libraries isn't really a good use of anyone's time
(and there is no upstream to contribute patches back to).

* findbugs-contrib (known upstream as fb-contrib [5]) is a FindBugs plugin
that provides additional detectors, and is of no use without FindBugs
itself.

* Likewise, eclipse-findbugs makes FindBugs available in the Eclipse IDE,
and is of no use without FindBugs being available.

As far as I can tell, nothing else depends on this set of packages:

$ sudo dnf repoquery --recursive --whatrequires findbugs
Last metadata expiration check: 1:11:19 ago on Sat 29 May 2021 23:00:52 BST.
ant-findbugs-0:3.0.1-25.fc34.noarch
eclipse-findbugs-0:3.0.1-23.fc34.noarch
eclipse-findbugs-contrib-0:7.4.7-6.fc34.noarch
findbugs-contrib-0:7.4.7-6.fc34.noarch
findbugs-contrib-samples-0:7.4.7-6.fc34.noarch
findbugs-tools-0:3.0.1-25.fc34.noarch

$ sudo dnf repoquery --recursive --whatrequires findbugs-bcel
Last metadata expiration check: 1:11:24 ago on Sat 29 May 2021 23:00:52 BST.
ant-findbugs-0:3.0.1-25.fc34.noarch
eclipse-findbugs-0:3.0.1-23.fc34.noarch
eclipse-findbugs-contrib-0:7.4.7-6.fc34.noarch
findbugs-0:3.0.1-25.fc34.noarch
findbugs-contrib-0:7.4.7-6.fc34.noarch
findbugs-contrib-samples-0:7.4.7-6.fc34.noarch
findbugs-tools-0:3.0.1-25.fc34.noarch

$ sudo dnf repoquery --recursive --whatrequires findbugs-contrib
Last metadata expiration check: 1:11:31 ago on Sat 29 May 2021 23:00:52 BST.
eclipse-findbugs-contrib-0:7.4.7-6.fc34.noarch
findbugs-contrib-samples-0:7.4.7-6.fc34.noarch

$ sudo dnf repoquery --recursive --whatrequires eclipse-findbugs
Last metadata expiration check: 1:11:39 ago on Sat 29 May 2021 23:00:52 BST.
eclipse-findbugs-contrib-0:7.4.7-6.fc34.noarch

It's been interesting keeping FindBugs alive since I picked it up in 2010
(11 years ago... where has the time gone?!), but the world has moved on (to
SpotBugs), and I think it's time to let it go.

Regards,

Rich

[1] http://findbugs.sourceforge.net/
[2]
https://mailman.cs.umd.edu/pipermail/findbugs-discuss/2016-November/00432...
[3]
https://mailman.cs.umd.edu/pipermail/findbugs-discuss/2017-September/0043...
[4] https://spotbugs.github.io/
[5] https://github.com/mebigfatguy/fb-contrib

-- 
Richard Fearn
richardfearn(a)gmail.com

[Fabio Valentini]

On Sun, May 30, 2021 at 1:42 AM Richard Fearn <richardfearn(a)gmail.com&gt; wrote:
>  
Hi,

Note that your queries did not check for BuildRequires, since you did
not enable the foo-source repositories.
That would require "--enablerepo fedora-source --enablerepo
updates-source", or "--enablerepo rawhide-source" on rawhide.

> As far as I can tell, nothing else depends on this set of packages:
>  
> $ sudo dnf repoquery --recursive --whatrequires findbugs
> Last metadata expiration check: 1:11:19 ago on Sat 29 May 2021 23:00:52 BST.
> ant-findbugs-0:3.0.1-25.fc34.noarch
> eclipse-findbugs-0:3.0.1-23.fc34.noarch
> eclipse-findbugs-contrib-0:7.4.7-6.fc34.noarch
> findbugs-contrib-0:7.4.7-6.fc34.noarch
> findbugs-contrib-samples-0:7.4.7-6.fc34.noarch
> findbugs-tools-0:3.0.1-25.fc34.noarch

When querying the source repos as well, this yields those additional
dependent packages on rawhide:

eclipse-findbugs-0:3.0.1-23.fc34.src (already a binary dependency as well)
findbugs-contrib-0:7.4.7-6.fc34.src (already a binary dependency as well)
libidn-0:1.37-1.fc35.src
nom-tam-fits-0:1.15.2-6.fc34.src
ongres-scram-0:2.1-1.fc35.src

Since findbugs contains code quality checks, I suspect those three
packages could be built without those checks without problems, since
they do not require findbugs at install-/ or runtime.

Fabio

[Richard Fearn]

>  Note that your queries did not check for BuildRequires, since you
> did
>  not enable the foo-source repositories.
>  That would require "--enablerepo fedora-source --enablerepo
>  updates-source", or "--enablerepo rawhide-source" on rawhide. 
Thanks Fabio - I knew I would get something wrong with that query :-)

>  Since findbugs contains code quality checks, I suspect those three
>  packages could be built without those checks without problems, since
>  they do not require findbugs at install-/ or runtime. 
I expect so too - I doubt the packages need FindBugs in order to
build. I'll take a look at those packages and contact the maintainers
as necessary.

Thanks,

Rich

-- 
Richard Fearn
richardfearn(a)gmail.com

[Mat Booth]

On Tue, 1 Jun 2021 at 10:14, Richard Fearn <richardfearn(a)gmail.com&gt; wrote:
>  > Note that your queries did not check for BuildRequires, since you did
>  > not enable the foo-source repositories.
>  > That would require "--enablerepo fedora-source --enablerepo
>  > updates-source", or "--enablerepo rawhide-source" on rawhide.
>
>  Thanks Fabio - I knew I would get something wrong with that query :-)
>
>  > Since findbugs contains code quality checks, I suspect those three
>  > packages could be built without those checks without problems, since
>  > they do not require findbugs at install-/ or runtime.
>
>  I expect so too - I doubt the packages need FindBugs in order to
>  build. I'll take a look at those packages and contact the maintainers
>  as necessary.
>  
FWIW, many maven-based packages in Fedora already include the
following snippet(s) to avoid build-time quality checks that are only
of interest to upstream:

%pom_remove_plugin :spotbugs-maven-plugin
# and/or
%pom_remove_plugin :findbugs-maven-plugin

That's probably the only change needed by packages that still express
a BR on findbugs.