#1341 Create an artifact that only contains the findbugs specific annotation classes

[hgschmie]

Please create an artifact that only contains the findbugs annotations.

Right now, two artifacts exist:

jsr305, which contains the JSR-305 annotations
annotations, which contains both the JSR-305 annotations and the findbugs specific annotations.

It is not possible to include both jars on the class path without duplicates and it is not possible to only include a jar with the findbugs annotations without the JSR 305 annotations. This leads to problem with e.g. the maven-dependency-plugin or the duplicate-finder-maven-plugin

Please create an artifact that only contains the findbugs specific annotations and does not contain the JSR 305 annotations.

[Tagir Valeev]

Hello!

Seems that we don't have active developers who are maven professionals. I can try to figure this stuff out, but it would be really nice if you submit a proper patch for pom files, etc. I don't even know whether these artifacts were actually published by FB team. Thanks.

[Charles Chan]

Hello Tagir,

I was able to verify the problem described by downloading the .jar file from
http://mvnrepository.com/artifact/com.google.code.findbugs/annotations/3.0.0. The jar file includes the javax.annotation class files mentioned in the report.

I am not sure it's a Maven issue ... (I search around the code but was unable to track down where the POM file generates the annotation.)

I did find and a problem in Ant build.xml:
https://code.google.com/r/charleswhchan-findbugs/source/detail?r=7a013781724e58350a8143292f2f114aa4acea36

Do you know if that is it? Were there other ways to generate the annotation with Maven?

[Richard Fearn]

annotations, which contains both the JSR-305 annotations and the findbugs specific annotations.

...and the JCIP annotations. I guess the idea was to create a single JAR that contains all possible annotations that you might want to use.

annotations.jar is built this way by the Ant build script:

https://github.com/findbugsproject/findbugs/blob/b542531bd3c1305173cfe5e3da3903ef00c1d8a8/findbugs/build.xml#L302-L303

But Tagir made a change in March to produce an additional JAR, findbugs-annotations.jar, which only contains the FindBugs annotations:

https://github.com/findbugsproject/findbugs/commit/31b13e094d3b4a576fdf909a62871c77fadab7f6

NB the Fedora package always omitted the non-FindBugs annotations from annotations.jar (which is actually named findbugs-annotations.jar in Fedora):

http://pkgs.fedoraproject.org/cgit/findbugs.git/tree/findbugs-build.patch?id=5f7ae017f64a9092a2e5a5b854b75bc0326b07d1#n58

[Tagir Valeev]

I've deployed Findbugs-only annotations. The problem is that they actually depend on jsr305 annotations (they are annotated by jsr305). I set the jsr305 dependency as optional in the pom.xml, so you will be able to build without using jsr305. This should not affect the runtime as all of these annotations have RetentionPolicy.CLASS. However you may have a compilation warnings.

https://repo1.maven.org/maven2/com/google/code/findbugs/findbugs-annotations/
https://github.com/findbugsproject/findbugs/commit/f993fa6c4536e4651276f593ca93cf4d0ff4810a