Is it time to fork the Findbugs project ?

Discussion:

Freddy Mallet

2014-05-12 14:20:44 UTC

Hi Bill, Andrey and Keith,

Sorry for this aggressive email title but looks like there is absolutely no
way to get any public communication from the Findbugs team about version
3.0 (last official communication on this subject occurred 5 months ago).
And by public communication, I'm not talking about a strong commitment but
just about keeping the Findbugs community informed.

Don't miss my point : I'm ready to hear any kind of answer like "Feel free
to contribute because no one in the Findbugs team has enough free time to
complete this 3.0 version", "We're facing a big technical issue to fully
support Java 8, so we simply don't know when we'll be ready to release this
version", ... but PLEASE say something.

Thanks
Freddy

Andrey Loskutov

2014-05-12 18:38:54 UTC

Permalink

Hi Freddy!

To fork a project one need at least one external committer. I don't see such committer yet, otherwise we schould see lot of opened pull requests, but this is not the case.
So "forking" is probably not what you've really meant.

I apologize personally for the silence on the list here, but Bill alone decides about releases and if he hasn't answered to the people questions yet, I have nothing to say too.

Regarding 3.0: the basic stuff works on Java 8 already (FB is not shocked by 1.8 bytecode anymore). What is missing was already mentioned by Bill in one of previous mails. In short: as long as one uses Java 7 features only, one can run FB on/against Java 8 and it will just work. Lambda's should be ok, but we need more test cases for false positives. JSR 308 support is not there, same with invokedynamic support. Default interface methods might or might not be supported - again, tests are needed.

From the Eclipse point of view (I'm the Eclipse guy in FB) one schould be able to run the nightly 3.0.0 builds in production without any regressions compared with 2.0.3.
From my personal point of view we schould release 3.0.0 FB version ASAP so that people can start migration to Java 8 and report new issues we are not yet aware of.

Regarding the overall project state: currently only me and Bill are committing things, and doing this in our free time. I must honestly say that my prio #1 in my free time is my family. There are not much external contributions either (but many thanks for all patches we've got so far!). Also there are no paid or otherwise sponsored/supported committers on project, therefore also no concrete plans for release or some driving force to release.

Therefore: the best way to help is not to ask same question again and again but to contribute:
- write bug reports
- provide patches
- provide test cases
- help others on the mailing list.

Regards,
Andrey

Hi Bill, Andrey and Keith,
Sorry for this aggressive email title but looks like there is
absolutely no
way to get any public communication from the Findbugs team about version
3.0 (last official communication on this subject occurred 5 months ago).
And by public communication, I'm not talking about a strong commitment but
just about keeping the Findbugs community informed.
Don't miss my point : I'm ready to hear any kind of answer like "Feel free
to contribute because no one in the Findbugs team has enough free time to
complete this 3.0 version", "We're facing a big technical issue to fully
support Java 8, so we simply don't know when we'll be ready to release this
version", ... but PLEASE say something.
Thanks
Freddy
------------------------------------------------------------------------
_______________________________________________
Findbugs-discuss mailing list
https://mailman.cs.umd.edu/mailman/listinfo/findbugs-discuss

--
Kind regards,
Andrey Loskutov

http://google.com/+AndreyLoskutov

Bill Pugh

2014-05-12 20:15:00 UTC

Permalink

Unfortunately, I've been having to spend a lot of time with my parents the last 9 months, and other things have also been keeping me busy. I thought I was going to get some time cleared up, but then a big project at my university came up.

But as Andrey say, it is ready for early adopters who are willing to build from head and test it against JDK 8. Primarily what we need is experience from those early adopters before we can declare that it is ready for the general public.

Bill

Post by Andrey Loskutov
Hi Freddy!
To fork a project one need at least one external committer. I don't see such committer yet, otherwise we schould see lot of opened pull requests, but this is not the case.
So "forking" is probably not what you've really meant.
I apologize personally for the silence on the list here, but Bill alone decides about releases and if he hasn't answered to the people questions yet, I have nothing to say too.
Regarding 3.0: the basic stuff works on Java 8 already (FB is not shocked by 1.8 bytecode anymore). What is missing was already mentioned by Bill in one of previous mails. In short: as long as one uses Java 7 features only, one can run FB on/against Java 8 and it will just work. Lambda's should be ok, but we need more test cases for false positives. JSR 308 support is not there, same with invokedynamic support. Default interface methods might or might not be supported - again, tests are needed.

Regarding the overall project state: currently only me and Bill are committing things, and doing this in our free time. I must honestly say that my prio #1 in my free time is my family. There are not much external contributions either (but many thanks for all patches we've got so far!). Also there are no paid or otherwise sponsored/supported committers on project, therefore also no concrete plans for release or some driving force to release.
- write bug reports
- provide patches
- provide test cases
- help others on the mailing list.
Regards,
Andrey

Hi Bill, Andrey and Keith,
Sorry for this aggressive email title but looks like there is
absolutely no
way to get any public communication from the Findbugs team about version
3.0 (last official communication on this subject occurred 5 months ago).
And by public communication, I'm not talking about a strong commitment but
just about keeping the Findbugs community informed.
Don't miss my point : I'm ready to hear any kind of answer like "Feel free
to contribute because no one in the Findbugs team has enough free time to
complete this 3.0 version", "We're facing a big technical issue to fully
support Java 8, so we simply don't know when we'll be ready to release this
version", ... but PLEASE say something.
Thanks
Freddy
------------------------------------------------------------------------
_______________________________________________
Findbugs-discuss mailing list
https://mailman.cs.umd.edu/mailman/listinfo/findbugs-discuss

--
Kind regards,
Andrey Loskutov
http://google.com/+AndreyLoskutov
_______________________________________________
Findbugs-discuss mailing list
https://mailman.cs.umd.edu/mailman/listinfo/findbugs-discuss

Nicolas Peru

2014-05-13 14:40:37 UTC

Permalink

Hi Bill,

First let me introduce myself, I am Nicolas PERU and I am the lead
developper of the Java Ecosystem of the SonarQube Platform.

If I understand correctly what you are saying is that findbugs is now ready
to work on java8 projects with no known regression on projects using older
versions of Java ?
So prior to a public release you are now waiting for user feedback and that
is one thing we can help you with.
In order to get that feedback, if you think you can do a release
candidate/beta version, then we would be able to embed that version in the
Sonarqube Java ecosystem to let our user run analysis against java 8
projects (and project using older version of java) with that findbugs
release candidate.
This will not impact our users too much (only users of Java8 language
features which are already blocked by released version of findbugs) while
allowing to make progress by getting feedback for a public release.
Please let me know what you think.
--
*Nicolas PERU | SonarSource*
*Senior Developer*
http://sonarsource.com
https://twitter.com/benzonico

Post by Bill Pugh
Unfortunately, I've been having to spend a lot of time with my parents the
last 9 months, and other things have also been keeping me busy. I thought I
was going to get some time cleared up, but then a big project at my
university came up.
But as Andrey say, it is ready for early adopters who are willing to build
from head and test it against JDK 8. Primarily what we need is experience
from those early adopters before we can declare that it is ready for the
general public.
Bill

Post by Andrey Loskutov
Hi Freddy!
To fork a project one need at least one external committer. I don't see

such committer yet, otherwise we schould see lot of opened pull requests,
but this is not the case.

Post by Andrey Loskutov
So "forking" is probably not what you've really meant.
I apologize personally for the silence on the list here, but Bill alone

decides about releases and if he hasn't answered to the people questions
yet, I have nothing to say too.

Post by Andrey Loskutov
Regarding 3.0: the basic stuff works on Java 8 already (FB is not

shocked by 1.8 bytecode anymore). What is missing was already mentioned by
Bill in one of previous mails. In short: as long as one uses Java 7
features only, one can run FB on/against Java 8 and it will just work.
Lambda's should be ok, but we need more test cases for false positives. JSR
308 support is not there, same with invokedynamic support. Default
interface methods might or might not be supported - again, tests are needed.

Post by Andrey Loskutov

From the Eclipse point of view (I'm the Eclipse guy in FB) one schould

be able to run the nightly 3.0.0 builds in production without any
regressions compared with 2.0.3.

Post by Andrey Loskutov

From my personal point of view we schould release 3.0.0 FB version ASAP

so that people can start migration to Java 8 and report new issues we are
not yet aware of.

Post by Andrey Loskutov
Regarding the overall project state: currently only me and Bill are

committing things, and doing this in our free time. I must honestly say
that my prio #1 in my free time is my family. There are not much external
contributions either (but many thanks for all patches we've got so far!).
Also there are no paid or otherwise sponsored/supported committers on
project, therefore also no concrete plans for release or some driving force
to release.

Post by Andrey Loskutov
Therefore: the best way to help is not to ask same question again and
- write bug reports
- provide patches
- provide test cases
- help others on the mailing list.
Regards,
Andrey

Hi Bill, Andrey and Keith,
Sorry for this aggressive email title but looks like there is absolutely no
way to get any public communication from the Findbugs team about version
3.0 (last official communication on this subject occurred 5 months ago).
And by public communication, I'm not talking about a strong commitment but
just about keeping the Findbugs community informed.
Don't miss my point : I'm ready to hear any kind of answer like "Feel free
to contribute because no one in the Findbugs team has enough free time to
complete this 3.0 version", "We're facing a big technical issue to fully
support Java 8, so we simply don't know when we'll be ready to release this
version", ... but PLEASE say something.
Thanks
Freddy
------------------------------------------------------------------------
_______________________________________________
Findbugs-discuss mailing list
https://mailman.cs.umd.edu/mailman/listinfo/findbugs-discuss

_______________________________________________
Findbugs-discuss mailing list
https://mailman.cs.umd.edu/mailman/listinfo/findbugs-discuss

Graham Allan

2014-05-14 23:10:53 UTC

Permalink

Post by Bill Pugh
it is ready for early adopters who are willing to build from head

Perhaps it would be easier to get feedback if builds could be provided,
lessening the friction in trying them. Is there any objections towards
releasing RC builds to Maven Central? What obstacles are there towards
putting out 3.0.0-RC1, just to get it out there?

Kind regards,
Graham Allan

Post by Bill Pugh
Hi Bill,
First let me introduce myself, I am Nicolas PERU and I am the lead
developper of the Java Ecosystem of the SonarQube Platform.
If I understand correctly what you are saying is that findbugs is now
ready to work on java8 projects with no known regression on projects using
older versions of Java ?
So prior to a public release you are now waiting for user feedback and
that is one thing we can help you with.
In order to get that feedback, if you think you can do a release
candidate/beta version, then we would be able to embed that version in the
Sonarqube Java ecosystem to let our user run analysis against java 8
projects (and project using older version of java) with that findbugs
release candidate.
This will not impact our users too much (only users of Java8 language
features which are already blocked by released version of findbugs) while
allowing to make progress by getting feedback for a public release.
Please let me know what you think.
--
*Nicolas PERU | SonarSource*
*Senior Developer*
http://sonarsource.com
https://twitter.com/benzonico
Unfortunately, I've been having to spend a lot of time with my parents the

Post by Bill Pugh
last 9 months, and other things have also been keeping me busy. I thought I
was going to get some time cleared up, but then a big project at my
university came up.
But as Andrey say, it is ready for early adopters who are willing to
build from head and test it against JDK 8. Primarily what we need is
experience from those early adopters before we can declare that it is ready
for the general public.
Bill

Post by Andrey Loskutov
Hi Freddy!
To fork a project one need at least one external committer. I don't see

such committer yet, otherwise we schould see lot of opened pull requests,
but this is not the case.

Post by Andrey Loskutov
So "forking" is probably not what you've really meant.
I apologize personally for the silence on the list here, but Bill alone

decides about releases and if he hasn't answered to the people questions
yet, I have nothing to say too.

Post by Andrey Loskutov
Regarding 3.0: the basic stuff works on Java 8 already (FB is not

Post by Andrey Loskutov

From the Eclipse point of view (I'm the Eclipse guy in FB) one schould

be able to run the nightly 3.0.0 builds in production without any
regressions compared with 2.0.3.

Post by Andrey Loskutov

From my personal point of view we schould release 3.0.0 FB version

ASAP so that people can start migration to Java 8 and report new issues we
are not yet aware of.

Post by Andrey Loskutov
Regarding the overall project state: currently only me and Bill are

Hi Bill, Andrey and Keith,
Sorry for this aggressive email title but looks like there is absolutely no
way to get any public communication from the Findbugs team about version
3.0 (last official communication on this subject occurred 5 months ago).
And by public communication, I'm not talking about a strong commitment but
just about keeping the Findbugs community informed.
Don't miss my point : I'm ready to hear any kind of answer like "Feel free
to contribute because no one in the Findbugs team has enough free time to
complete this 3.0 version", "We're facing a big technical issue to fully
support Java 8, so we simply don't know when we'll be ready to release this
version", ... but PLEASE say something.
Thanks
Freddy

------------------------------------------------------------------------

Post by Andrey Loskutov

_______________________________________________
Findbugs-discuss mailing list
https://mailman.cs.umd.edu/mailman/listinfo/findbugs-discuss

Freddy Mallet

2014-05-15 15:41:40 UTC

Permalink

@Bill and @Andrey, thanks for your very straightforward answers guys.

I share the same feeling than @Nicolas and @Graham, as long as a 3.0-RC1
version is not published, you'll get very few feedback and as a consequence
you'll postpone again the decision to release 3.0 GA.

++

-----
twitter.com/FreddyMallet
SonarQube for Continuous Inspection

Post by Andrey Loskutov
Hi Freddy!
To fork a project one need at least one external committer. I don't see

such committer yet, otherwise we schould see lot of opened pull requests,
but this is not the case.

Post by Andrey Loskutov
So "forking" is probably not what you've really meant.
I apologize personally for the silence on the list here, but Bill alone

decides about releases and if he hasn't answered to the people questions
yet, I have nothing to say too.

Post by Andrey Loskutov
Regarding 3.0: the basic stuff works on Java 8 already (FB is not

Post by Andrey Loskutov

From the Eclipse point of view (I'm the Eclipse guy in FB) one schould

be able to run the nightly 3.0.0 builds in production without any
regressions compared with 2.0.3.

Post by Andrey Loskutov

From my personal point of view we schould release 3.0.0 FB version ASAP

so that people can start migration to Java 8 and report new issues we are
not yet aware of.

Post by Andrey Loskutov
Regarding the overall project state: currently only me and Bill are

Hi Bill, Andrey and Keith,
Sorry for this aggressive email title but looks like there is absolutely no
way to get any public communication from the Findbugs team about version
3.0 (last official communication on this subject occurred 5 months ago).
And by public communication, I'm not talking about a strong commitment but
just about keeping the Findbugs community informed.
Don't miss my point : I'm ready to hear any kind of answer like "Feel free
to contribute because no one in the Findbugs team has enough free time to
complete this 3.0 version", "We're facing a big technical issue to fully
support Java 8, so we simply don't know when we'll be ready to release this
version", ... but PLEASE say something.
Thanks
Freddy
------------------------------------------------------------------------
_______________________________________________
Findbugs-discuss mailing list
https://mailman.cs.umd.edu/mailman/listinfo/findbugs-discuss

Graham Allan

2014-05-16 15:28:28 UTC

Permalink

... and if there's anything that anyone can do to help the core FB team get
an RC made available, I think you'd find willing helpers. Well, at least
one :)

Post by Freddy Mallet
@Bill and @Andrey, thanks for your very straightforward answers guys.
version is not published, you'll get very few feedback and as a consequence
you'll postpone again the decision to release 3.0 GA.
++
-----
twitter.com/FreddyMallet
SonarQube for Continuous Inspection

Post by Bill Pugh
Unfortunately, I've been having to spend a lot of time with my parents
the last 9 months, and other things have also been keeping me busy. I
thought I was going to get some time cleared up, but then a big project at
my university came up.
But as Andrey say, it is ready for early adopters who are willing to
build from head and test it against JDK 8. Primarily what we need is
experience from those early adopters before we can declare that it is ready
for the general public.
Bill

Post by Andrey Loskutov
Hi Freddy!
To fork a project one need at least one external committer. I don't see

such committer yet, otherwise we schould see lot of opened pull requests,
but this is not the case.

Post by Andrey Loskutov
So "forking" is probably not what you've really meant.
I apologize personally for the silence on the list here, but Bill alone

decides about releases and if he hasn't answered to the people questions
yet, I have nothing to say too.

Post by Andrey Loskutov
Regarding 3.0: the basic stuff works on Java 8 already (FB is not

Post by Andrey Loskutov

From the Eclipse point of view (I'm the Eclipse guy in FB) one schould

be able to run the nightly 3.0.0 builds in production without any
regressions compared with 2.0.3.

Post by Andrey Loskutov

From my personal point of view we schould release 3.0.0 FB version

ASAP so that people can start migration to Java 8 and report new issues we
are not yet aware of.

Post by Andrey Loskutov
Regarding the overall project state: currently only me and Bill are

Hi Bill, Andrey and Keith,
Sorry for this aggressive email title but looks like there is absolutely no
way to get any public communication from the Findbugs team about version
3.0 (last official communication on this subject occurred 5 months ago).
And by public communication, I'm not talking about a strong commitment but
just about keeping the Findbugs community informed.
Don't miss my point : I'm ready to hear any kind of answer like "Feel free
to contribute because no one in the Findbugs team has enough free time to
complete this 3.0 version", "We're facing a big technical issue to fully
support Java 8, so we simply don't know when we'll be ready to release this
version", ... but PLEASE say something.
Thanks
Freddy

------------------------------------------------------------------------

Post by Andrey Loskutov

_______________________________________________
Findbugs-discuss mailing list
https://mailman.cs.umd.edu/mailman/listinfo/findbugs-discuss

Peter Dillinger

2014-05-16 21:54:16 UTC

Permalink

Post by Bill Pugh
But as Andrey say, it is ready for early adopters who are willing to build
from head and test it against JDK 8. Primarily what we need is experience
from those early adopters before we can declare that it is ready for the
general public.

Coverity's upcoming 7.5.0 release of Quality Advisor, Security Advisor, and Test Advisor this summer will include basic support for Java 8. As part of that, we are well into the process of validating an upgrade of our included version of FindBugs to 3.0.0-dev-20140429-1103397. Since we aren't yet claiming full support for Java 8, we are OK if the results aren't spectacular on code using Java 8 constructs.

However, stability is important to us. We have tested that version against > 10MLoC of open source Java code (compiled with Java 7 and earlier) and ~16k classes from the Java 8 API (obviously compiled with Java 8). I reported earlier the only crash I found, and it is fixed in the version cited above. When we receive customer reports of FindBugs crashes, we generally report them back to the project with a reproducer.

We don't do much validation of the FindBugs results themselves. Don't expect that kind of feedback from us, but you might get it directly from our customers.

--
Peter Dillinger | Principle Engineer
Coverity, a Synopsys Company | 701 Fifth Avenue, Suite 1220, Seattle, WA 98104
The Leader in Development Testing

Nicolas Peru

2014-06-06 12:56:06 UTC

Permalink

Hi findbugs team,
To continue on this topic :
Do you have any idea/plans about when the testing period will be over and a
public (even beta) release would be available with support of Java 8 ?

Thanks for your reply.

*Nicolas PERU | SonarSource*
*Senior Developer*
http://sonarsource.com
https://twitter.com/benzonico

Post by Peter Dillinger

Post by Bill Pugh
But as Andrey say, it is ready for early adopters who are willing to

build

Post by Bill Pugh
from head and test it against JDK 8. Primarily what we need is experience
from those early adopters before we can declare that it is ready for the
general public.

Coverity's upcoming 7.5.0 release of Quality Advisor, Security Advisor,
and Test Advisor this summer will include basic support for Java 8. As
part of that, we are well into the process of validating an upgrade of our
included version of FindBugs to 3.0.0-dev-20140429-1103397. Since we
aren't yet claiming full support for Java 8, we are OK if the results
aren't spectacular on code using Java 8 constructs.
However, stability is important to us. We have tested that version
against > 10MLoC of open source Java code (compiled with Java 7 and
earlier) and ~16k classes from the Java 8 API (obviously compiled with Java
8). I reported earlier the only crash I found, and it is fixed in the
version cited above. When we receive customer reports of FindBugs crashes,
we generally report them back to the project with a reproducer.
We don't do much validation of the FindBugs results themselves. Don't
expect that kind of feedback from us, but you might get it directly from
our customers.
--
Peter Dillinger | Principle Engineer
Coverity, a Synopsys Company | 701 Fifth Avenue, Suite 1220, Seattle, WA 98104
The Leader in Development Testing
_______________________________________________
Findbugs-discuss mailing list
https://mailman.cs.umd.edu/mailman/listinfo/findbugs-discuss