search

spotbugs / discuss

SpotBugs mailing list
6 stars 1 forks source link

Alternative to LGPL-licensed `@SuppressFBWarnings` annotation? #64

Closed fcurts closed 5 years ago

fcurts commented 5 years ago

com.github.spotbugs:spotbugs-annotations:3.1.10 is LGPL licensed, which means I can't use it in my Apache 2 licensed software. Are there any alternatives, such as defining my own annotation recognized by SpotBugs? It would be a pity if I had to list every warning identified as false positive in a suppression file.

iloveeclipse commented 5 years ago

If I recall it right, the code accepts any annotation matching the annotation names from FB own package. So feel free to create your own version with your own license.

fcurts commented 5 years ago

@iloveeclipse thanks! works great and is immensely useful. didn't find this information when searching docs/web.

iloveeclipse commented 5 years ago

code is the docs :-)

KengoTODA commented 5 years ago

I have another workaround: you can depends on spotbugs-annotation as compileOnly (gradle) or as optional (maven). Then you do not distribute its jar file with your product. It won't trigger ClassNotFoundException in runtime.

fcurts commented 5 years ago

@KengoTODA That's the standard solution I had used so far, but it's not clear to me what the licensing implications are, and I'd rather not spend my time arguing with lawyers over this.

Would be nice to see spotbugs-annotations relicensed under a more permissive license.

KengoTODA commented 5 years ago

We're not copyright holder so we cannot change OSS license of this product. We may consider to make a new annotations from scratch, but it's not listed in roadmap for now.