Maven Compile Warning for SuppressFBWarnings

[adase11]

Problem:

Introducing the dependency on aws-encryption-sdk-java introduces compile warnings about edu.umd.cs.findbugs.annotations.SuppressFBWarnings

For example:

Cannot find annotation method 'value()' in type 'edu.umd.cs.findbugs.annotations.SuppressFBWarnings': class file for edu.umd.cs.findbugs.annotations.SuppressFBWarnings not found

Solution:

Options:

• Change the scope of the com.google.code.findbugs to compile.
• Document the potential warnings and suggest fixes like declaring dependencies in your own project

Out of scope:

I'm sure there are different options for handling this and they may vary depending on the build tool being used.

[imabhichow]

Hi @adase11,

Thank you for raising this issue and providing potential solutions. We appreciate your engagement in improving the AWS ESDK.

Regarding your proposed solutions:

Change the scope of the com.google.code.findbugs to compile

We appreciate your suggestion, but it's important to note that we do not want the com.google.code.findbugs to be on the user's runtime classpath. Therefore, changing the scope to compile would not be an appropriate solution in this case.

Document the potential warnings and suggest fixes like declaring dependencies in your own project

We would add a suggestion to the README, but this com.google.code.findbugs is deprecated. Rather than documenting workarounds for deprecated libraries, we hope to update the dependency to the new spotbugs code scanner.

Thanks,
AWS Crypto Tools

[adase11]

Thanks for looking into this. An upgrade to SpotBugs Annotations would be great. Although wouldn't that still lead to the same behavior as the retention of that annotation in the spotbugs repository is CLASS as well https://github.com/spotbugs/spotbugs/blob/master/spotbugs-annotations/src/main/java/edu/umd/cs/findbugs/annotations/SuppressFBWarnings.java#L33C4-L33C4 .

@Retention(RetentionPolicy.CLASS)
public @interface SuppressFBWarnings {
...
}

That would mean that dependent projects will have the SuppressFBWarnings annotation retained on the class files but they will not have the dependency on their classpath without explicitly providing it - and therefore the warnings would continue.

[adase11]

Any update on this thread @imabhichow ?