A list of unmaintained/unmaintainable cruft

[sewe]

Looking at the spotbugs repository, there’s a lot of files in there that I would wager none of the current maintainers can maintain or want to.

I think we should compile a list of these files here along with the reason why we think they can be removed.

Here’s a start:

• findbugs.keystore: The certificate expired 24 April 2014 and AFAIK we don’t even have the keystore’s password.
• jnlp: I doubt that anyone uses these. There used to be a way of using Java Webstart for a demo, but I don’t think we offer something similar at the moment.

What else?

[sewe]

• YourKitController: Does any committer have a license for YourKit? We currently ship an YourKit JAR (of indeterminate version) with every SpotBugs download, but I don’t think anyone uses YourKit. (Not that I’m saying that some performance analysis with a profiler wouldn’t do us any good.)

[henrik242]

The YourKit jar was last updated in 2013. I vouch for ditching it.

[sewe]

The YourKit jar was last updated in 2013. I vouch for ditching it.

I’ll prepare a pull request then.

[mebigfatguy]

1. I think you can get free licenses for open source.
2. I think there is actual yourkit code in the code base itself.

Fine with removing tho

[sewe]

@mebigfatguy Thanks for joining the discussion.

1. I think you can get free licenses for open source.

Yes, that’s true and we may want to consider their offer.

2. I think there is actual yourkit code in the code base itself.

Yes, there’s some code that uses the YourKit profiler API to capture a memory snapshot.

Since no one of us is (AFAIK) using YourKit at the moment to profile SpotBugs, I think we should remove the logic to capture a memory snapshot, as this seems to have been inserted for a very specific profiling task – which no one of the current SpotBugs maintainers knows anything about.

That being said, we IMHO should be looking into profiling SpotBugs again – but first without invasive callbacks.