Runing findbugs

[Kelly O'Hair]

I'm currently looking at how we could possible include a run of findbugs
in the build process, but my conclusion right now is that we cannot do it
by default, it takes way to long to run findbugs over everything. (>12hrs).

But I could add some minor support to the Makefiles to allow someone to
run findbugs on specific classes/packages, using a command line like this:

   findbugs -textui -maxHeap 1024 -javahome /YOUR/jdk1.6.0 -sortByClass \
            -onlyAnalyze "IMPORT_SPEC" -html -output report.html \
            CLASSES_DIRECTORY_OR_JAR

For example, after I have built the jdk, you could run findbugs over just
the java.lang.* classes:

   findbugs -textui -maxHeap 1024 -javahome /opt/java/jdk1.6.0 -sortByClass \
            -onlyAnalyze "java.lang.*" -html -output report.html \
             build/solaris-i586/classes

Ideally you want a fully populated classes directory or jar file so
that it can analyze all the classes properly.
(Note: using java.lang.* does not include the classes in the nested packages).

But people could just run the findbugs GUI and do the same thing, or better
yet, run the findbugs modules in the NetBeans IDE or Eclipse IDE.

So I'm at a loss as to whether I should include anything in the makefiles
for this at all. Maybe I was premature in adding findbugs as a build dependence
on the jdk and it should just be removed?

Any ideas out there? Or comments?

-kto