Sonar maven analysis - class not found

Question

I'm trying to setup SonarQube (v.4.5.6) with maven support. I believe my configuration is correct but I can't get SonarQube analysis to run without errors.

My project's dependencies:

<dependencies>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-actuator</artifactId>
    </dependency>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-web</artifactId>
        <exclusions>
            <exclusion>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-starter-tomcat</artifactId>
            </exclusion>
        </exclusions>
    </dependency>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-jetty</artifactId>
    </dependency>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-security</artifactId>
    </dependency>
    <dependency>
        <groupId>org.springframework.security</groupId>
        <artifactId>spring-security-ldap</artifactId>
    </dependency>
    <dependency>
        <groupId>org.apache.httpcomponents</groupId>
        <artifactId>httpclient</artifactId>
        <exclusions>
            <exclusion>
                <artifactId>commons-logging</artifactId>
                <groupId>commons-logging</groupId>
            </exclusion>
        </exclusions>
    </dependency>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-redis</artifactId>
    </dependency>
    <dependency>
        <groupId>com.google.guava</groupId>
        <artifactId>guava</artifactId>
        <version>${guava.version}</version>
    </dependency>
    <dependency>
        <groupId>net.logstash.logback</groupId>
        <artifactId>logstash-logback-encoder</artifactId>
        <version>${logstash-logback-encoder.version}</version>
    </dependency>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-test</artifactId>
        <scope>test</scope>
    </dependency>
    <dependency>
        <groupId>org.powermock</groupId>
        <artifactId>powermock-module-junit4</artifactId>
        <version>${powermock.version}</version>
        <scope>test</scope>
    </dependency>
    <dependency>
        <groupId>org.powermock</groupId>
        <artifactId>powermock-api-mockito</artifactId>
        <version>${powermock.version}</version>
        <scope>test</scope>
    </dependency>
    <dependency>
        <groupId>org.springframework.security</groupId>
        <artifactId>spring-security-test</artifactId>
        <version>${spring-security-test.version}</version>
        <scope>test</scope>
    </dependency>
</dependencies>

sonar-maven-plugin:

<plugin>
    <groupId>org.codehaus.mojo</groupId>
    <artifactId>sonar-maven-plugin</artifactId>
    <version>2.7.1</version>
</plugin>

SonarQube analysis throws the following errors:

[INFO] [19:07:06.235] Source paths: pom.xml, src/main/java
[INFO] [19:07:06.235] Test paths: src/test/java
[INFO] [19:07:06.235] Binary dirs: target/classes
[INFO] [19:07:08.046] Sensor JavaSquidSensor...
[INFO] [19:07:08.154] Configured Java source version: none
[INFO] [19:07:08.157] JavaClasspath initialization...
[INFO] [19:07:08.173] JavaClasspath initialization done: 16 ms
[INFO] [19:07:08.173] JavaTestClasspath initialization...
[INFO] [19:07:08.202] JavaTestClasspath initialization done: 29 ms
[INFO] [19:07:08.412] Java Main Files AST scan...
[INFO] [19:07:08.414] 27 source files to be analyzed
[ERROR] [19:07:08.849] Class not found: org.springframework.security.openid.OpenIDAuthenticationFilter
[ERROR] [19:07:08.850] Class not found: org.springframework.security.openid.OpenIDConsumer
[ERROR] [19:07:08.850] Class not found: org.openid4java.consumer.ConsumerManager
[ERROR] [19:07:08.850] Class not found: org.springframework.security.openid.OpenIDAuthenticationToken
[ERROR] [19:07:08.851] Class not found: org.openid4java.consumer.ConsumerException
[ERROR] [19:07:08.851] Class not found: org.springframework.security.openid.AxFetchListFactory
[ERROR] [19:07:08.872] Class not found: org.springframework.jdbc.datasource.init.DatabasePopulator
[ERROR] [19:07:08.872] Class not found: org.springframework.jdbc.datasource.init.DataSourceInitializer
[ERROR] [19:07:09.798] Class not found: javax.annotation.Nullable
[INFO] [19:07:10.163] 27/27 source files have been analyzed
[INFO] [19:07:10.163] Java Main Files AST scan done: 1751 ms
[INFO] [19:07:10.165] Java bytecode scan...
[INFO] [19:07:10.238] Java bytecode scan done: 73 ms
[INFO] [19:07:10.239] Java Test Files AST scan...
[INFO] [19:07:10.239] 17 source files to be analyzed
[ERROR] [19:07:10.400] Class not found: org.springframework.security.openid.OpenIDAuthenticationFilter
[ERROR] [19:07:10.400] Class not found: org.springframework.security.openid.OpenIDConsumer
[ERROR] [19:07:10.401] Class not found: org.openid4java.consumer.ConsumerManager
[ERROR] [19:07:10.401] Class not found: org.springframework.security.openid.OpenIDAuthenticationToken
[ERROR] [19:07:10.401] Class not found: org.openid4java.consumer.ConsumerException
[ERROR] [19:07:10.401] Class not found: org.springframework.security.openid.AxFetchListFactory
[INFO] [19:07:11.114] Java Test Files AST scan done: 875 ms
[INFO] [19:07:11.114] 17/17 source files have been analyzed

All mentioned classes are not used in project, which I for me makes more confusing what could be wrong.

Answer 1

You can see that the analysis run until the end without saying it failed. The analysis succeed.

What this message ´Class not found:´ means ?

This is raised by sonarqube java analyzer when it analyzes the dependency of a source file. For instance, if you extends a class from spring, sonarqube java analyzer will look for the corresponding .class file.

If we have a rule that will count the number of hierarchy level, it will then look for the dependency of this .class file and so on. Meaning it will look for some classes that might not be directly in your project.

This message is harmless, it just warns you that the analyzer was not able to find some .class files so you might end up with less accurate results and/or you might want to fix the classpath provided to the analysis.