dev@glassfish.java.net

Re: verifying findbugs errors

From: Tim Quinn <tim.quinn_at_oracle.com>
Date: Mon, 4 Apr 2011 17:31:12 -0500

Can whoever maintains that list please divert nasradu8 to someone on
the security team instead of me?

Thanks.

- Tim

On Apr 4, 2011, at 5:23 PM, Tom Mueller wrote:

> There is a users.alias file that translates users that are no longer
> on the project into users that are.
> See:
> http://gf-hudson.us.oracle.com/hudson/job/gf-trunk-findbugs/ws/findbugstotext/users.alias/*view*/
>
> Tom
>
> On 4/4/2011 3:17 PM, Tim Quinn wrote:
>>
>> On Apr 4, 2011, at 5:08 PM, Justin Lee wrote:
>>
>>> Like many of you, I've received a glut of findbugs emails listing
>>> various issues. I've started to whittle away on my list but I
>>> can't seem to recreate that error report locally to verify the
>>> issue. In fact, when I check the (internal) hudson job listed on
>>> the wiki, it doesn't even list the issues I've been emailed
>>> about. Running it locally on, say, admin/config-api, I get 0
>>> errors before even changing the code. So my question, how can I
>>> create that report locally so that I can do a pre/post check to
>>> verify i'm satisfying the analysis parameters. Running "mvn
>>> findbugs:findbugs" in that directory or the root doesn't seem
>>> sufficient.
>>
>> I have found the same.
>>
>> I have aliased mvn to include -Dfindbugs.threshold=Low so the level
>> should not explain the differences I see.
>>
>> Also, today I have received several messages in which all of the
>> flagged lines have someone else's ID. The message says "...in the
>> lines of code that you last modified..." but that doesn't seem to
>> be accurate.
>>
>> Can anyone shed some light?
>>
>> - Tim