Using custom detectors with FindBugs Maven plugin

Question

I have a nice JAR of some custom FindBugs detectors I'd like to use with the FindBugs Maven plugin. There is a way to do this with the plugin via the <pluginList> configuration parameter, but that only accepts local files, URLs, or resources.

The only way I found for doing so is to somehow copy my JAR to a local file (maybe via the Dependency plugin) and then configure the FindBugs plugin something like this:

<plugin>
    <groupId>org.codehaus.mojo</groupId>
    <artifactId>findbugs-maven-plugin</artifactId>
    <version>2.3.1</version>
    <configuration>
        <pluginList>${project.build.directory}/my-detectors.jar</pluginList>
    </configuration>
</plugin>

But this is not very flexible. Is there a way to use Maven's dependency management features together with FindBugs' plugins? I'd like to use something like this:

<plugin>
    <groupId>org.codehaus.mojo</groupId>
    <artifactId>findbugs-maven-plugin</artifactId>
    <dependencies>
        <dependency>
            <groupId>com.lptr.findbugs</groupId>
            <artifactId>my-detectors</artifactId>
            <version>1.0</version>
        </dependency>
    </dependencies>
</plugin>

...but this simply overrides the core FindBugs detectors.

Answer 1

I found out that this is possible, although through quite some hacking. FindBugs is only able to process plugins that are in local JARs, so you have to create one for it, but there is a more flexible way to do this then via the Dependency plugin.

The <pluginList> parameter can take either a local file path, a URL or a resource (i.e. something from the classpath). Whatever you give to it, the addressed file will be copied to target/<filename>, and passed to FindBugs itself. You can pass FindBugs a JAR file if you create a JAR file that contains your JAR file. You can achieve this in the my-detectors project via the Assembly plugin with a descriptor like this:

<assembly>
    <id>doublepack</id>
    <formats>
        <format>jar</format>
    </formats>
    <includeBaseDirectory>false</includeBaseDirectory>
    <files>
        <file>
            <source>${project.build.directory}/${project.build.finalName}.jar</source>
            <destName>my-detectors.jar</destName>
        </file>
    </files>
</assembly>

The only other problem to solve is that the FindBugs plugin (at least version 2.3.1) uses an outdated version of the Plexus ResourceManager that extracts the my-detectors.jar incorrectly, so you have to "upgrade" that, too. Now your custom detectors will work with this:

<plugin>
    <groupId>org.codehaus.mojo</groupId>
    <artifactId>findbugs-maven-plugin</artifactId>
    <configuration>
        <pluginList>my-detectors.jar</pluginList>
    </configuration>
    <dependencies>
        <dependency>
            <groupId>org.codehaus.plexus</groupId>
            <artifactId>plexus-resources</artifactId>
            <version>1.0-alpha-7</version>
        </dependency>
        <dependency>
            <groupId>com.lptr.findbugs</groupId>
            <artifactId>my-detectors</artifactId>
            <version>1.0</version>
            <classifier>doublepack</classifier>
        </dependency>
    </dependencies>
</plugin>