FindBugs upstream has been dead since 2016 and I would like to retire it from Fedora [1].

ongres-scram currently has this dependency:

  BuildRequires:  findbugs

This is due to this dependency in the ongres-scram POM:

        <dependency>
            <groupId>com.google.code.findbugs</groupId>
            <artifactId>annotations</artifactId>
            <version>3.0.1</version>
            <scope>provided</scope>
        </dependency>

That dependency can be downloaded here:

  https://search.maven.org/artifact/com.google.code.findbugs/annotations/3.0.1/jar

It provides classes in these packages:

  * edu.umd.cs.findbugs.annotations
  * javax.annotation (and subpackages)
  * net.jcip.annotations

All these packages contain the word "annotation". Searching the ongres-scram source for "annotation", I can only see one usage of the SuppressFBWarnings annotation, in com.ongres.scram.common.message.ServerFinalMessage.

Removing the use of this annotation would allow ongres-scram to build without FindBugs.

[1] https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/thread/YI723NBFFXAOQSRMYIEFAD6CYGX7S6MM/