[java-metadata-aggregator] 03/03: Nullability

Ian Young ian at iay.org.uk
Wed Apr 5 12:38:18 UTC 2023


This is an automated email from the git hooks/post-receive script.

iay pushed a commit to branch main
in repository java-metadata-aggregator.

View the commit online:
http://git.shibboleth.net/view/?p=java-metadata-aggregator.git;a=commit;h=5ec50a8cb524f3ed23c85dd3eaade003c1535166

commit 5ec50a8cb524f3ed23c85dd3eaade003c1535166
Author: Ian Young <ian at iay.org.uk>
AuthorDate: Wed Apr 5 13:37:51 2023 +0100

    Nullability
---
 .../java/net/shibboleth/metadata/ErrorStatus.java  | 19 +++++++++++++++----
 .../java/net/shibboleth/metadata/InfoStatus.java   | 19 +++++++++++++++----
 .../net/shibboleth/metadata/StatusMetadata.java    | 16 +++++++++++++++-
 .../main/java/net/shibboleth/metadata/Version.java |  2 +-
 .../net/shibboleth/metadata/WarningStatus.java     | 19 +++++++++++++++----
 .../metadata/dom/NamespaceStrippingStage.java      |  3 ++-
 .../metadata/dom/NamespacesStrippingStage.java     |  2 +-
 .../metadata/dom/XMLSignatureSigningStage.java     | 13 +++++++------
 .../metadata/dom/XMLSignatureValidationStage.java  | 11 +++++++----
 .../metadata/dom/XPathItemSelectionStrategy.java   |  9 ++++++---
 .../metadata/dom/XSLTransformationStage.java       |  2 ++
 .../metadata/dom/XSLValidationStage.java           |  1 +
 .../metadata/dom/impl/XMLSignatureSigner.java      | 11 ++++++++---
 .../metadata/dom/impl/XMLSignatureValidator.java   |  7 ++++---
 .../dom/saml/AttributeValueElementMaker.java       |  2 +-
 .../dom/saml/EntitiesDescriptorAssemblerStage.java |  2 +-
 .../metadata/dom/saml/GenerateIdStage.java         |  6 ++++--
 .../dom/saml/PullUpCacheDurationStage.java         | 18 ++++++++++++------
 .../metadata/dom/saml/PullUpValidUntilStage.java   | 20 ++++++++++++++------
 .../metadata/dom/saml/SAMLMetadataSupport.java     | 15 +++++++++++----
 .../dom/saml/SAMLStringElementCheckingStage.java   |  4 +++-
 .../metadata/dom/saml/SetCacheDurationStage.java   |  4 +++-
 .../metadata/dom/saml/SetValidUntilStage.java      |  4 +++-
 .../metadata/dom/saml/ValidateValidUntilStage.java | 12 +++++++++++-
 .../saml/mdattr/EntityAttributeAddingStage.java    |  3 ++-
 ...trationAuthorityItemIdentificationStrategy.java |  4 ++--
 .../dom/saml/mdui/IPHintValidationStage.java       |  1 +
 .../FilesInDirectoryMultiOutputStrategy.java       |  2 +-
 .../metadata/pipeline/ItemMetadataAddingStage.java |  2 +-
 .../pipeline/PipelineDemultiplexerStage.java       | 13 ++++++++-----
 .../metadata/pipeline/PipelineMergeStage.java      | 10 +++++++---
 .../metadata/pipeline/SplitMergeStage.java         |  8 +++++++-
 .../metadata/validate/x509/X509ROCAValidator.java  |  4 +++-
 .../validate/x509/X509RSAExponentValidator.java    | 22 +++++++++++++++++-----
 .../x509/X509RSAOpenSSLBlacklistValidator.java     |  2 ++
 .../java/net/shibboleth/metadata/ItemIdTest.java   | 10 +++++++---
 .../java/net/shibboleth/metadata/MockItemTest.java |  1 +
 .../metadata/dom/XMLSignatureSigningStageTest.java | 16 ++++++++++++----
 .../dom/XMLSignatureValidationStageTest.java       | 12 +++++++-----
 .../metadata/dom/XSLTtransformationStageTest.java  |  9 +++++++--
 .../dom/saml/PullUpCacheDurationStageTest.java     |  5 ++++-
 .../dom/saml/PullUpValidUntilStageTest.java        |  3 +++
 .../x509/X509RSAExponentValidatorTest.java         | 13 +++++++++----
 43 files changed, 263 insertions(+), 98 deletions(-)

diff --git a/mda-framework/src/main/java/net/shibboleth/metadata/ErrorStatus.java b/mda-framework/src/main/java/net/shibboleth/metadata/ErrorStatus.java
index 4715f81..e05b994 100644
--- a/mda-framework/src/main/java/net/shibboleth/metadata/ErrorStatus.java
+++ b/mda-framework/src/main/java/net/shibboleth/metadata/ErrorStatus.java
@@ -17,22 +17,33 @@
 
 package net.shibboleth.metadata;
 
-import javax.annotation.Nonnull;
 import javax.annotation.concurrent.Immutable;
 
-import net.shibboleth.shared.annotation.constraint.NotEmpty;
-
 /** A type of {@link StatusMetadata} that indicates something is definitely wrong with the Item. */
 @Immutable
 public class ErrorStatus extends StatusMetadata {
 
     /**
      * Constructor.
+     *
+     * <p>
+     * Note that the parameters must not be either <code>null</code>
+     * or the empty string. However, as they are often set from
+     * theoretically nullable sources such as a a bean's identifier
+     * (which is not statically known to be non-null until after
+     * initialization) or a <code>toString</code> method result,
+     * this is not not included in the parameter annotations.
+     * </p>
+     * 
+     * <p>
+     * Instead, nullness is checked as a run-time
+     * constraint resulting in a <code>ConstraintViolation</code>.
+     * </p>
      * 
      * @param componentId ID of the component creating the status message, never null or empty
      * @param statusMessage the status message, never null or empty
      */
-    public ErrorStatus(@Nonnull @NotEmpty final String componentId, @Nonnull @NotEmpty final String statusMessage) {
+    public ErrorStatus(final String componentId, final String statusMessage) {
         super(componentId, statusMessage);
     }
 }
diff --git a/mda-framework/src/main/java/net/shibboleth/metadata/InfoStatus.java b/mda-framework/src/main/java/net/shibboleth/metadata/InfoStatus.java
index d4e4273..200719a 100644
--- a/mda-framework/src/main/java/net/shibboleth/metadata/InfoStatus.java
+++ b/mda-framework/src/main/java/net/shibboleth/metadata/InfoStatus.java
@@ -17,11 +17,8 @@
 
 package net.shibboleth.metadata;
 
-import javax.annotation.Nonnull;
 import javax.annotation.concurrent.Immutable;
 
-import net.shibboleth.shared.annotation.constraint.NotEmpty;
-
 /**
  * A type of {@link StatusMetadata} that carries informational messages. These messages should never be used to carry
  * status messages that would indicate an error or failing of the Item in some way.
@@ -31,11 +28,25 @@ public class InfoStatus extends StatusMetadata {
 
     /**
      * Constructor.
+     *
+     * <p>
+     * Note that the parameters must not be either <code>null</code>
+     * or the empty string. However, as they are often set from
+     * theoretically nullable sources such as a a bean's identifier
+     * (which is not statically known to be non-null until after
+     * initialization) or a <code>toString</code> method result,
+     * this is not not included in the parameter annotations.
+     * </p>
+     * 
+     * <p>
+     * Instead, nullness is checked as a run-time
+     * constraint resulting in a <code>ConstraintViolation</code>.
+     * </p>
      * 
      * @param componentId ID of the component creating the status message, never null or empty
      * @param statusMessage the status message, never null or empty
      */
-    public InfoStatus(@Nonnull @NotEmpty final String componentId, @Nonnull @NotEmpty final String statusMessage) {
+    public InfoStatus(final String componentId, final String statusMessage) {
         super(componentId, statusMessage);
     }
 }
diff --git a/mda-framework/src/main/java/net/shibboleth/metadata/StatusMetadata.java b/mda-framework/src/main/java/net/shibboleth/metadata/StatusMetadata.java
index 8cbcb46..e18bb41 100644
--- a/mda-framework/src/main/java/net/shibboleth/metadata/StatusMetadata.java
+++ b/mda-framework/src/main/java/net/shibboleth/metadata/StatusMetadata.java
@@ -36,11 +36,25 @@ public class StatusMetadata implements ItemMetadata {
 
     /**
      * Constructor.
+     *
+     * <p>
+     * Note that the parameters must not be either <code>null</code>
+     * or the empty string. However, as they are often set from
+     * theoretically nullable sources such as a a bean's identifier
+     * (which is not statically known to be non-null until after
+     * initialization) or a <code>toString</code> method result,
+     * this is not not included in the parameter annotations.
+     * </p>
+     * 
+     * <p>
+     * Instead, nullness is checked as a run-time
+     * constraint resulting in a <code>ConstraintViolation</code>.
+     * </p>
      * 
      * @param componentId ID of the component creating the status message, never null or empty
      * @param statusMessage the status message, never null or empty
      */
-    public StatusMetadata(@Nonnull @NotEmpty final String componentId, @Nonnull @NotEmpty final String statusMessage) {
+    public StatusMetadata(final String componentId, final String statusMessage) {
         component = Constraint.isNotNull(StringSupport.trimOrNull(componentId),
                 "Component ID can not be null or empty");
         message = Constraint.isNotNull(StringSupport.trimOrNull(statusMessage),
diff --git a/mda-framework/src/main/java/net/shibboleth/metadata/Version.java b/mda-framework/src/main/java/net/shibboleth/metadata/Version.java
index a3c0639..ab7f0d4 100644
--- a/mda-framework/src/main/java/net/shibboleth/metadata/Version.java
+++ b/mda-framework/src/main/java/net/shibboleth/metadata/Version.java
@@ -27,7 +27,7 @@ import javax.annotation.Nonnull;
 public final class Version {
 
     /** Metadata pipeline version. */
-    private static final String VERSION;
+    private static final @Nonnull String VERSION;
 
     /** Metadata pipeline major version number. */
     private static final int MAJOR_VERSION;
diff --git a/mda-framework/src/main/java/net/shibboleth/metadata/WarningStatus.java b/mda-framework/src/main/java/net/shibboleth/metadata/WarningStatus.java
index b1036a2..a0487f2 100644
--- a/mda-framework/src/main/java/net/shibboleth/metadata/WarningStatus.java
+++ b/mda-framework/src/main/java/net/shibboleth/metadata/WarningStatus.java
@@ -17,11 +17,8 @@
 
 package net.shibboleth.metadata;
 
-import javax.annotation.Nonnull;
 import javax.annotation.concurrent.Immutable;
 
-import net.shibboleth.shared.annotation.constraint.NotEmpty;
-
 /**
  * A type of {@link StatusMetadata} that indicates something may be "off" about the {@link Item}. This warning message
  * is stronger than the informational message that would be carried by a {@link InfoStatus} but does not necessarily
@@ -34,11 +31,25 @@ public class WarningStatus extends StatusMetadata {
 
     /**
      * Constructor.
+     *
+     * <p>
+     * Note that the parameters must not be either <code>null</code>
+     * or the empty string. However, as they are often set from
+     * theoretically nullable sources such as a a bean's identifier
+     * (which is not statically known to be non-null until after
+     * initialization) or a <code>toString</code> method result,
+     * this is not not included in the parameter annotations.
+     * </p>
+     * 
+     * <p>
+     * Instead, nullness is checked as a run-time
+     * constraint resulting in a <code>ConstraintViolation</code>.
+     * </p>
      * 
      * @param componentId ID of the component creating the status message, never null or empty
      * @param statusMessage the status message, never null or empty
      */
-    public WarningStatus(@Nonnull @NotEmpty final String componentId, @Nonnull @NotEmpty final String statusMessage) {
+    public WarningStatus(final String componentId, final String statusMessage) {
         super(componentId, statusMessage);
     }
 }
diff --git a/mda-framework/src/main/java/net/shibboleth/metadata/dom/NamespaceStrippingStage.java b/mda-framework/src/main/java/net/shibboleth/metadata/dom/NamespaceStrippingStage.java
index 479cd4f..8bc39be 100644
--- a/mda-framework/src/main/java/net/shibboleth/metadata/dom/NamespaceStrippingStage.java
+++ b/mda-framework/src/main/java/net/shibboleth/metadata/dom/NamespaceStrippingStage.java
@@ -18,6 +18,7 @@
 package net.shibboleth.metadata.dom;
 
 import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
 import javax.annotation.concurrent.GuardedBy;
 import javax.annotation.concurrent.ThreadSafe;
 
@@ -62,7 +63,7 @@ public class NamespaceStrippingStage extends AbstractNamespacesStrippingStage {
     }
 
     @Override
-    protected boolean removingNamespace(final @Nonnull String ns) {
+    protected boolean removingNamespace(final @Nullable String ns) {
         return getNamespace().equals(ns);
     }
 
diff --git a/mda-framework/src/main/java/net/shibboleth/metadata/dom/NamespacesStrippingStage.java b/mda-framework/src/main/java/net/shibboleth/metadata/dom/NamespacesStrippingStage.java
index 6908a15..3f12725 100644
--- a/mda-framework/src/main/java/net/shibboleth/metadata/dom/NamespacesStrippingStage.java
+++ b/mda-framework/src/main/java/net/shibboleth/metadata/dom/NamespacesStrippingStage.java
@@ -77,7 +77,7 @@ public class NamespacesStrippingStage extends AbstractNamespacesStrippingStage {
      */
     public synchronized void setNamespaces(@Nonnull @NonnullElements @Unmodifiable final Collection<String> nss) {
         checkSetterPreconditions();
-        namespaces = Set.copyOf(nss);
+        namespaces = CollectionSupport.copyToSet(nss);
     }
 
     /**
diff --git a/mda-framework/src/main/java/net/shibboleth/metadata/dom/XMLSignatureSigningStage.java b/mda-framework/src/main/java/net/shibboleth/metadata/dom/XMLSignatureSigningStage.java
index efbb423..e17cb6e 100644
--- a/mda-framework/src/main/java/net/shibboleth/metadata/dom/XMLSignatureSigningStage.java
+++ b/mda-framework/src/main/java/net/shibboleth/metadata/dom/XMLSignatureSigningStage.java
@@ -114,7 +114,7 @@ public class XMLSignatureSigningStage extends AbstractStage<Element> {
      * non-namespace-qualified attributes 'ID', 'Id', 'id'
      */
     @Nonnull @NonnullElements @Unmodifiable @GuardedBy("this")
-    private List<QName> idAttributeNames = List.of(new QName("ID"), new QName("id"), new QName("Id"));
+    private List<QName> idAttributeNames = CollectionSupport.listOf(new QName("ID"), new QName("id"), new QName("Id"));
 
     /** Explicit names to associate with the given signing key. Default value: empty list */
     @Nonnull @NonnullElements @Unmodifiable @GuardedBy("this")
@@ -233,7 +233,7 @@ public class XMLSignatureSigningStage extends AbstractStage<Element> {
     public synchronized void setCertificates(
             @Nonnull @NonnullElements @Unmodifiable final List<X509Certificate> certs) {
         checkSetterPreconditions();
-        certificates = List.copyOf(certs);
+        certificates = CollectionSupport.copyToList(certs);
     }
 
     /**
@@ -254,7 +254,7 @@ public class XMLSignatureSigningStage extends AbstractStage<Element> {
     public synchronized void setCrls(
             @Nonnull @NonnullElements @Unmodifiable final List<X509CRL> revocationLists) {
         checkSetterPreconditions();
-        crls = List.copyOf(revocationLists);
+        crls = CollectionSupport.copyToList(revocationLists);
     }
 
     /**
@@ -313,7 +313,7 @@ public class XMLSignatureSigningStage extends AbstractStage<Element> {
     public synchronized void setInclusivePrefixList(
             @Nonnull @NonnullElements @Unmodifiable final List<String> prefixList) {
         checkSetterPreconditions();
-        inclusivePrefixList = List.copyOf(prefixList);
+        inclusivePrefixList = CollectionSupport.copyToList(prefixList);
     }
 
     /**
@@ -336,7 +336,7 @@ public class XMLSignatureSigningStage extends AbstractStage<Element> {
         checkSetterPreconditions();
         Constraint.isNotNull(names, "names property may not be null");
 
-        idAttributeNames = List.copyOf(names);
+        idAttributeNames = CollectionSupport.copyToList(names);
     }
 
     /**
@@ -357,7 +357,7 @@ public class XMLSignatureSigningStage extends AbstractStage<Element> {
     public synchronized void setKeyNames(
             @Nonnull @NonnullElements @Unmodifiable final List<String> names) {
         checkSetterPreconditions();
-        keyNames = List.copyOf(names);
+        keyNames = CollectionSupport.copyToList(names);
     }
 
     /**
@@ -517,6 +517,7 @@ public class XMLSignatureSigningStage extends AbstractStage<Element> {
             throws StageProcessingException {
         final var signer = new XMLSignatureSigner(this, LOG);
         for (final Item<Element> item : items) {
+            assert item != null;
             signer.sign(item);
         }
     }
diff --git a/mda-framework/src/main/java/net/shibboleth/metadata/dom/XMLSignatureValidationStage.java b/mda-framework/src/main/java/net/shibboleth/metadata/dom/XMLSignatureValidationStage.java
index fabd6b5..8e45809 100644
--- a/mda-framework/src/main/java/net/shibboleth/metadata/dom/XMLSignatureValidationStage.java
+++ b/mda-framework/src/main/java/net/shibboleth/metadata/dom/XMLSignatureValidationStage.java
@@ -183,7 +183,7 @@ public class XMLSignatureValidationStage extends AbstractStage<Element> {
     public synchronized void setBlacklistedDigests(
             @Nonnull @NonnullElements @Unmodifiable final Collection<String> identifiers) {
         checkSetterPreconditions();
-        blacklistedDigests = Set.copyOf(identifiers);
+        blacklistedDigests = CollectionSupport.copyToSet(identifiers);
     }
     
     /**
@@ -203,7 +203,7 @@ public class XMLSignatureValidationStage extends AbstractStage<Element> {
     public synchronized void setBlacklistedSignatureMethods(
             @Nonnull @NonnullElements @Unmodifiable final Collection<String> identifiers) {
         checkSetterPreconditions();
-        blacklistedSignatureMethods = Set.copyOf(identifiers);
+        blacklistedSignatureMethods = CollectionSupport.copyToSet(identifiers);
     }
     
     /**
@@ -285,11 +285,14 @@ public class XMLSignatureValidationStage extends AbstractStage<Element> {
     @Override
     protected void doExecute(@Nonnull @NonnullElements final List<Item<Element>> items) {
         // Create a single non-thread-safe validator
-        final var validator = new XMLSignatureValidator(getVerificationKey(),
+        final var key = getVerificationKey();
+        assert key != null;
+        final var validator = new XMLSignatureValidator(key,
                 getBlacklistedDigests(), getBlacklistedSignatureMethods(), isPermittingEmptyReferences());
 
         // Use it to validate each item in turn
-        for (@Nonnull final var item : items) {
+        for (final var item : items) {
+            assert item != null;
             validateItem(item, validator);
         }
     }
diff --git a/mda-framework/src/main/java/net/shibboleth/metadata/dom/XPathItemSelectionStrategy.java b/mda-framework/src/main/java/net/shibboleth/metadata/dom/XPathItemSelectionStrategy.java
index b9a4af8..558cd4e 100644
--- a/mda-framework/src/main/java/net/shibboleth/metadata/dom/XPathItemSelectionStrategy.java
+++ b/mda-framework/src/main/java/net/shibboleth/metadata/dom/XPathItemSelectionStrategy.java
@@ -20,6 +20,7 @@ package net.shibboleth.metadata.dom;
 import java.util.function.Predicate;
 
 import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
 import javax.annotation.concurrent.GuardedBy;
 import javax.annotation.concurrent.ThreadSafe;
 import javax.xml.namespace.NamespaceContext;
@@ -61,7 +62,7 @@ public class XPathItemSelectionStrategy implements Predicate<Item<Element>> {
      * @throws XPathExpressionException if there is a problem compiling the expression
      */
     public XPathItemSelectionStrategy(@Nonnull @NotEmpty final String expression,
-            @Nonnull final NamespaceContext context) throws XPathExpressionException {
+            final @Nullable NamespaceContext context) throws XPathExpressionException {
         final NamespaceContext namespaceContext;
         if (context == null) {
             namespaceContext = new SimpleNamespaceContext();
@@ -73,11 +74,13 @@ public class XPathItemSelectionStrategy implements Predicate<Item<Element>> {
         final XPath xpath = factory.newXPath();
         xpath.setNamespaceContext(namespaceContext);
 
-        compiledExpression = xpath.compile(expression);
+        final var compiled = xpath.compile(expression);
+        assert compiled != null;
+        compiledExpression = compiled;
     }
 
     @Override
-    public synchronized boolean test(@Nonnull final Item<Element> item) {
+    public synchronized boolean test(final Item<Element> item) {
         try {
             return compiledExpression.evaluateExpression(item.unwrap(), Boolean.class);
         } catch (final XPathExpressionException e) {
diff --git a/mda-framework/src/main/java/net/shibboleth/metadata/dom/XSLTransformationStage.java b/mda-framework/src/main/java/net/shibboleth/metadata/dom/XSLTransformationStage.java
index 8f25e4f..fc6826c 100644
--- a/mda-framework/src/main/java/net/shibboleth/metadata/dom/XSLTransformationStage.java
+++ b/mda-framework/src/main/java/net/shibboleth/metadata/dom/XSLTransformationStage.java
@@ -54,12 +54,14 @@ public class XSLTransformationStage extends AbstractXSLProcessingStage {
         try {
             final ArrayList<Item<Element>> newItems = new ArrayList<>();
             for (final Item<Element> domItem : items) {
+                assert domItem != null;
                 transformer.setErrorListener(new StatusInfoAppendingErrorListener(domItem));
                 final Element element = domItem.unwrap();
 
                 // Create a new document to hold the result of the transform.
                 final DOMImplementation domImpl = element.getOwnerDocument().getImplementation();
                 final Document newDocument = domImpl.createDocument(null, null, null);
+                assert newDocument != null;
 
                 // perform the transformation
                 transformer.transform(new DOMSource(element.getOwnerDocument()), new DOMResult(newDocument));
diff --git a/mda-framework/src/main/java/net/shibboleth/metadata/dom/XSLValidationStage.java b/mda-framework/src/main/java/net/shibboleth/metadata/dom/XSLValidationStage.java
index 1557a22..fea68aa 100644
--- a/mda-framework/src/main/java/net/shibboleth/metadata/dom/XSLValidationStage.java
+++ b/mda-framework/src/main/java/net/shibboleth/metadata/dom/XSLValidationStage.java
@@ -49,6 +49,7 @@ public class XSLValidationStage extends AbstractXSLProcessingStage {
 
         try {
             for (final Item<Element> domItem : items) {
+                assert domItem != null;
                 transformer.setErrorListener(new StatusInfoAppendingErrorListener(domItem));
                 transformer.transform(new DOMSource(domItem.unwrap().getOwnerDocument()), new DOMResult());
             }
diff --git a/mda-framework/src/main/java/net/shibboleth/metadata/dom/impl/XMLSignatureSigner.java b/mda-framework/src/main/java/net/shibboleth/metadata/dom/impl/XMLSignatureSigner.java
index 4d20722..bf1859f 100644
--- a/mda-framework/src/main/java/net/shibboleth/metadata/dom/impl/XMLSignatureSigner.java
+++ b/mda-framework/src/main/java/net/shibboleth/metadata/dom/impl/XMLSignatureSigner.java
@@ -65,6 +65,7 @@ import net.shibboleth.metadata.pipeline.StageProcessingException;
 import net.shibboleth.shared.annotation.constraint.Live;
 import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.Unmodifiable;
+import net.shibboleth.shared.logic.Constraint;
 import net.shibboleth.shared.primitive.StringSupport;
 import net.shibboleth.shared.xml.ElementSupport;
 import net.shibboleth.shared.xml.QNameSupport;
@@ -225,7 +226,7 @@ public class XMLSignatureSigner {
                     break;
             }
 
-            privKey = stage.getPrivateKey();
+            privKey = Constraint.isNotNull(stage.getPrivateKey(), "privateKey may not be null");
             publicKey = stage.getPublicKey();
             inclusivePrefixList = stage.getInclusivePrefixList();
             idAttributeNames = stage.getIdAttributeNames();
@@ -324,7 +325,9 @@ public class XMLSignatureSigner {
 
         final List<Reference> refs = Collections.singletonList(buildSignatureReference(target));
 
-        return xmlSigFactory.newSignedInfo(c14nMethod, sigMethod, refs);
+        final var info = xmlSigFactory.newSignedInfo(c14nMethod, sigMethod, refs);
+        assert info != null;
+        return info;
     }
 
     /**
@@ -377,7 +380,9 @@ public class XMLSignatureSigner {
             throw new StageProcessingException(errMsg, e);
         }
 
-        return xmlSigFactory.newReference(refUri, digestMethod, transforms, null, null);
+        final var ref = xmlSigFactory.newReference(refUri, digestMethod, transforms, null, null);
+        assert ref != null;
+        return ref;
     }
 
     /**
diff --git a/mda-framework/src/main/java/net/shibboleth/metadata/dom/impl/XMLSignatureValidator.java b/mda-framework/src/main/java/net/shibboleth/metadata/dom/impl/XMLSignatureValidator.java
index bf34fca..457909f 100644
--- a/mda-framework/src/main/java/net/shibboleth/metadata/dom/impl/XMLSignatureValidator.java
+++ b/mda-framework/src/main/java/net/shibboleth/metadata/dom/impl/XMLSignatureValidator.java
@@ -245,8 +245,9 @@ public final class XMLSignatureValidator {
 
         if (LOG.isDebugEnabled()) {
             try {
-                LOG.debug("Verifying XML signature with key\n{}",
-                        Base64Support.encode(verificationKey.getEncoded(), false));
+                final var bytes = verificationKey.getEncoded();
+                assert bytes != null;
+                LOG.debug("Verifying XML signature with key\n{}", Base64Support.encode(bytes, false));
             } catch (final EncodingException e) {
                 //do nothing, as only logging, and this is unlikely. 
             }
@@ -286,7 +287,7 @@ public final class XMLSignatureValidator {
      * @return the extracted reference
      * @throws ValidationException if a reference could not be extracted
      */
-    private Reference extractReference(@Nonnull final XMLSignature signature) throws ValidationException {
+    private @Nonnull Reference extractReference(@Nonnull final XMLSignature signature) throws ValidationException {
         final int numReferences = signature.getSignedInfo().getLength();
         if (numReferences != 1) {
             throw new ValidationException("Signature SignedInfo had invalid number of References: " + numReferences);
diff --git a/mda-framework/src/main/java/net/shibboleth/metadata/dom/saml/AttributeValueElementMaker.java b/mda-framework/src/main/java/net/shibboleth/metadata/dom/saml/AttributeValueElementMaker.java
index e59d744..0ae119e 100644
--- a/mda-framework/src/main/java/net/shibboleth/metadata/dom/saml/AttributeValueElementMaker.java
+++ b/mda-framework/src/main/java/net/shibboleth/metadata/dom/saml/AttributeValueElementMaker.java
@@ -48,7 +48,7 @@ public class AttributeValueElementMaker extends SimpleElementMaker {
     }
 
     @Override
-    public Element make(@Nonnull final Container container) {
+    public @Nonnull Element make(@Nonnull final Container container) {
         final Element newElement = super.make(container);
         newElement.setTextContent(attributeValue);
         return newElement;
diff --git a/mda-framework/src/main/java/net/shibboleth/metadata/dom/saml/EntitiesDescriptorAssemblerStage.java b/mda-framework/src/main/java/net/shibboleth/metadata/dom/saml/EntitiesDescriptorAssemblerStage.java
index dad6d3b..4b5ed9a 100644
--- a/mda-framework/src/main/java/net/shibboleth/metadata/dom/saml/EntitiesDescriptorAssemblerStage.java
+++ b/mda-framework/src/main/java/net/shibboleth/metadata/dom/saml/EntitiesDescriptorAssemblerStage.java
@@ -150,7 +150,7 @@ public class EntitiesDescriptorAssemblerStage extends AbstractStage<Element> {
                 ElementSupport.constructElement(entitiesDescriptorDocument,
                         SAMLMetadataSupport.ENTITIES_DESCRIPTOR_NAME);
         NamespaceSupport.appendNamespaceDeclaration(entitiesDescriptor,
-                entitiesDescriptor.getNamespaceURI(), entitiesDescriptor.getPrefix());
+                SAMLMetadataSupport.MD_NS, SAMLMetadataSupport.MD_PREFIX);
         entitiesDescriptorDocument.appendChild(entitiesDescriptor);
         addDescriptorName(entitiesDescriptor);
 
diff --git a/mda-framework/src/main/java/net/shibboleth/metadata/dom/saml/GenerateIdStage.java b/mda-framework/src/main/java/net/shibboleth/metadata/dom/saml/GenerateIdStage.java
index 7b2334d..aee9979 100644
--- a/mda-framework/src/main/java/net/shibboleth/metadata/dom/saml/GenerateIdStage.java
+++ b/mda-framework/src/main/java/net/shibboleth/metadata/dom/saml/GenerateIdStage.java
@@ -59,14 +59,16 @@ public class GenerateIdStage extends AbstractIteratingStage<Element> {
 
     @Override
     protected void doExecute(@Nonnull final Item<Element> item) throws StageProcessingException {
-        final Element element = item.unwrap();
+        final var element = item.unwrap();
         if (!SAMLMetadataSupport.isEntityOrEntitiesDescriptor(element)) {
             return;
         }
 
         Attr idAttribute = AttributeSupport.getAttribute(element, ID_ATTRIB);
         if (idAttribute == null) {
-            idAttribute = AttributeSupport.constructAttribute(element.getOwnerDocument(), ID_ATTRIB);
+            final var ownerDocument = element.getOwnerDocument();
+            assert ownerDocument != null;
+            idAttribute = AttributeSupport.constructAttribute(ownerDocument, ID_ATTRIB);
             element.setAttributeNode(idAttribute);
         }
 
diff --git a/mda-framework/src/main/java/net/shibboleth/metadata/dom/saml/PullUpCacheDurationStage.java b/mda-framework/src/main/java/net/shibboleth/metadata/dom/saml/PullUpCacheDurationStage.java
index b805831..d2766ac 100644
--- a/mda-framework/src/main/java/net/shibboleth/metadata/dom/saml/PullUpCacheDurationStage.java
+++ b/mda-framework/src/main/java/net/shibboleth/metadata/dom/saml/PullUpCacheDurationStage.java
@@ -44,12 +44,14 @@ import net.shibboleth.shared.xml.ElementSupport;
 public class PullUpCacheDurationStage extends AbstractIteratingStage<Element> {
 
     /** The minimum cache duration. Default value: <code>0</code> */
-    @Nonnull @GuardedBy("this")
-    private Duration minCacheDuration = Duration.ZERO;
+    @SuppressWarnings("null")
+    @GuardedBy("this")
+    private @Nonnull Duration minCacheDuration = Duration.ZERO;
 
     /** The maximum cache duration. Default value: {@value java.lang.Long#MAX_VALUE} */
-    @Nonnull @GuardedBy("this")
-    private Duration maxCacheDuration = Duration.ofMillis(Long.MAX_VALUE);
+    @SuppressWarnings("null")
+    @GuardedBy("this")
+    private @Nonnull Duration maxCacheDuration = Duration.ofMillis(Long.MAX_VALUE);
 
     /**
      * Gets the minimum cache duration.
@@ -66,10 +68,12 @@ public class PullUpCacheDurationStage extends AbstractIteratingStage<Element> {
      * 
      * @param duration the minimum cache duration
      */
-    public synchronized void setMinimumCacheDuration(final Duration duration) {
+    public synchronized void setMinimumCacheDuration(final @Nonnull Duration duration) {
         checkSetterPreconditions();
         if (duration.isNegative()) {
-            minCacheDuration = Duration.ZERO;
+            final var dur = Duration.ZERO;
+            assert dur != null;
+            minCacheDuration = dur;
         } else {
             minCacheDuration = duration;
         }
@@ -122,6 +126,7 @@ public class PullUpCacheDurationStage extends AbstractIteratingStage<Element> {
         final List<Element> entitiesDescriptors =
                 ElementSupport.getChildElements(descriptor, SAMLMetadataSupport.ENTITIES_DESCRIPTOR_NAME);
         for (final Element entitiesDescriptor : entitiesDescriptors) {
+            assert entitiesDescriptor != null;
             cacheDuration = getShortestCacheDuration(entitiesDescriptor);
             if (cacheDuration != null &&
                     (shortestCacheDuration == null || (cacheDuration.compareTo(shortestCacheDuration) < 0))) {
@@ -132,6 +137,7 @@ public class PullUpCacheDurationStage extends AbstractIteratingStage<Element> {
         final List<Element> entityDescriptors =
                 ElementSupport.getChildElements(descriptor, SAMLMetadataSupport.ENTITY_DESCRIPTOR_NAME);
         for (final Element entityDescriptor : entityDescriptors) {
+            assert entityDescriptor != null;
             cacheDuration = getShortestCacheDuration(entityDescriptor);
             if (cacheDuration != null &&
                     (shortestCacheDuration == null || (cacheDuration.compareTo(shortestCacheDuration) < 0))) {
diff --git a/mda-framework/src/main/java/net/shibboleth/metadata/dom/saml/PullUpValidUntilStage.java b/mda-framework/src/main/java/net/shibboleth/metadata/dom/saml/PullUpValidUntilStage.java
index edfe906..518c323 100644
--- a/mda-framework/src/main/java/net/shibboleth/metadata/dom/saml/PullUpValidUntilStage.java
+++ b/mda-framework/src/main/java/net/shibboleth/metadata/dom/saml/PullUpValidUntilStage.java
@@ -45,15 +45,17 @@ import net.shibboleth.shared.xml.ElementSupport;
 public class PullUpValidUntilStage extends AbstractIteratingStage<Element> {
 
     /** The minimum amount of time a descriptor may be valid. Default value: 0 */
-    @Nonnull @GuardedBy("this")
-    private Duration minValidityDuration = Duration.ZERO;
+    @SuppressWarnings("null")
+    @GuardedBy("this")
+    private @Nonnull Duration minValidityDuration = Duration.ZERO;
 
     /**
      * The maximum amount of time a descriptor may be valid. Default value:
      * {@value java.lang.Long#MAX_VALUE}
      */
-    @Nonnull @GuardedBy("this")
-    private Duration maxValidityDuration = Duration.ofMillis(Long.MAX_VALUE);
+    @SuppressWarnings("null")
+    @GuardedBy("this")
+    private @Nonnull Duration maxValidityDuration = Duration.ofMillis(Long.MAX_VALUE);
 
     /**
      * Gets the minimum amount of time a descriptor may be valid.
@@ -73,7 +75,9 @@ public class PullUpValidUntilStage extends AbstractIteratingStage<Element> {
     public synchronized void setMinimumValidityDuration(@Nonnull final Duration duration) {
         checkSetterPreconditions();
         if (duration.isNegative()) {
-            minValidityDuration = Duration.ZERO;
+            final var dur = Duration.ZERO;
+            assert dur != null;
+            minValidityDuration = dur;
         } else {
             minValidityDuration = duration;
         }
@@ -126,6 +130,7 @@ public class PullUpValidUntilStage extends AbstractIteratingStage<Element> {
         final List<Element> entitiesDescriptors =
                 ElementSupport.getChildElements(descriptor, SAMLMetadataSupport.ENTITIES_DESCRIPTOR_NAME);
         for (final Element entitiesDescriptor : entitiesDescriptors) {
+            assert entitiesDescriptor != null;
             validUntil = getNearestValidUntil(entitiesDescriptor);
             if (validUntil != null && (nearestValidUntil == null || (validUntil.isBefore(nearestValidUntil)))) {
                 nearestValidUntil = validUntil;
@@ -135,6 +140,7 @@ public class PullUpValidUntilStage extends AbstractIteratingStage<Element> {
         final List<Element> entityDescriptors =
                 ElementSupport.getChildElements(descriptor, SAMLMetadataSupport.ENTITY_DESCRIPTOR_NAME);
         for (final Element entityDescriptor : entityDescriptors) {
+            assert entityDescriptor != null;
             validUntil = getNearestValidUntil(entityDescriptor);
             if (validUntil != null && (nearestValidUntil == null || (validUntil.isBefore(nearestValidUntil)))) {
                 nearestValidUntil = validUntil;
@@ -171,9 +177,11 @@ public class PullUpValidUntilStage extends AbstractIteratingStage<Element> {
 
         final Instant now = Instant.now();
         final Instant minValidUntil = now.plus(getMinimumValidityDuration());
+        assert minValidUntil != null;
         final Instant maxValidUntil = now.plus(getMaximumValidityDuration());
+        assert maxValidUntil != null;
 
-        final Instant boundedValidUntil;
+        final @Nonnull Instant boundedValidUntil;
         if (validUntil.isBefore(minValidUntil)) {
             boundedValidUntil = minValidUntil;
         } else if (validUntil.isAfter(maxValidUntil)) {
diff --git a/mda-framework/src/main/java/net/shibboleth/metadata/dom/saml/SAMLMetadataSupport.java b/mda-framework/src/main/java/net/shibboleth/metadata/dom/saml/SAMLMetadataSupport.java
index b8f0e53..08e1e05 100644
--- a/mda-framework/src/main/java/net/shibboleth/metadata/dom/saml/SAMLMetadataSupport.java
+++ b/mda-framework/src/main/java/net/shibboleth/metadata/dom/saml/SAMLMetadataSupport.java
@@ -189,7 +189,9 @@ public final class SAMLMetadataSupport {
             return extensions;
         }
         
-        return ElementSupport.getChildElements(extensions.get(0), extensionName);
+        final var exten = extensions.get(0);
+        assert exten != null;
+        return ElementSupport.getChildElements(exten, extensionName);
     }
 
     /**
@@ -229,17 +231,20 @@ public final class SAMLMetadataSupport {
             return;
         }
 
-        final Element extensionsElement;
+        final @Nonnull Element extensionsElement;
 
         final Map<QName, List<Element>> descriptorChildren = ElementSupport.getIndexedChildElements(descriptor);
         final List<Element> extensionsElements = descriptorChildren.get(EXTENSIONS_NAME);
         if (extensionsElements.isEmpty()) {
-            extensionsElement = ElementSupport.constructElement(descriptor.getOwnerDocument(), EXTENSIONS_NAME);
+            final var ownerDocument = descriptor.getOwnerDocument();
+            assert ownerDocument != null;
+            extensionsElement = ElementSupport.constructElement(ownerDocument, EXTENSIONS_NAME);
 
             Element insertExtensionsElementBefore = null;
             final List<Element> signatureElements = descriptorChildren.get(XMLDSIGSupport.SIGNATURE_NAME);
             if (!signatureElements.isEmpty()) {
                 final Element lastSignatureElement = signatureElements.get(signatureElements.size() - 1);
+                assert lastSignatureElement != null;
                 insertExtensionsElementBefore = ElementSupport.getNextSiblingElement(lastSignatureElement);
             } else {
                 insertExtensionsElementBefore = ElementSupport.getFirstChildElement(descriptor);
@@ -251,7 +256,9 @@ public final class SAMLMetadataSupport {
                 descriptor.insertBefore(extensionsElement, insertExtensionsElementBefore);
             }
         } else {
-            extensionsElement = extensionsElements.get(0);
+            final var exten = extensionsElements.get(0);
+            assert exten != null;
+            extensionsElement = exten;
         }
 
         ElementSupport.appendChildElement(extensionsElement, extension);
diff --git a/mda-framework/src/main/java/net/shibboleth/metadata/dom/saml/SAMLStringElementCheckingStage.java b/mda-framework/src/main/java/net/shibboleth/metadata/dom/saml/SAMLStringElementCheckingStage.java
index f32135f..bbad88a 100644
--- a/mda-framework/src/main/java/net/shibboleth/metadata/dom/saml/SAMLStringElementCheckingStage.java
+++ b/mda-framework/src/main/java/net/shibboleth/metadata/dom/saml/SAMLStringElementCheckingStage.java
@@ -80,7 +80,9 @@ public class SAMLStringElementCheckingStage extends AbstractElementVisitingStage
             b.append(QNameSupport.getNodeQName(e));
             b.append(" must contain at least one non-whitespace character");
             final Element entity = ancestorEntity(e);
-            addError(context.getItem(), entity, b.toString());
+            final var message = b.toString();
+            assert message != null;
+            addError(context.getItem(), entity, message);
         }
     }
 
diff --git a/mda-framework/src/main/java/net/shibboleth/metadata/dom/saml/SetCacheDurationStage.java b/mda-framework/src/main/java/net/shibboleth/metadata/dom/saml/SetCacheDurationStage.java
index f4f2650..116bbd6 100644
--- a/mda-framework/src/main/java/net/shibboleth/metadata/dom/saml/SetCacheDurationStage.java
+++ b/mda-framework/src/main/java/net/shibboleth/metadata/dom/saml/SetCacheDurationStage.java
@@ -77,9 +77,11 @@ public class SetCacheDurationStage extends AbstractIteratingStage<Element> {
     protected void doExecute(@Nonnull final Item<Element> item) throws StageProcessingException {
         final Element descriptor = item.unwrap();
         if (SAMLMetadataSupport.isEntityOrEntitiesDescriptor(descriptor)) {
+            final var dur = getCacheDuration();
+            assert dur != null;
             AttributeSupport.removeAttribute(descriptor, SAMLMetadataSupport.CACHE_DURATION_ATTRIB_NAME);
             AttributeSupport.appendDurationAttribute(descriptor, SAMLMetadataSupport.CACHE_DURATION_ATTRIB_NAME,
-                    getCacheDuration());
+                    dur);
         }
     }
 
diff --git a/mda-framework/src/main/java/net/shibboleth/metadata/dom/saml/SetValidUntilStage.java b/mda-framework/src/main/java/net/shibboleth/metadata/dom/saml/SetValidUntilStage.java
index fecea09..17c6c1d 100644
--- a/mda-framework/src/main/java/net/shibboleth/metadata/dom/saml/SetValidUntilStage.java
+++ b/mda-framework/src/main/java/net/shibboleth/metadata/dom/saml/SetValidUntilStage.java
@@ -79,8 +79,10 @@ public class SetValidUntilStage extends AbstractIteratingStage<Element> {
         final Element descriptor = item.unwrap();
         if (SAMLMetadataSupport.isEntityOrEntitiesDescriptor(descriptor)) {
             AttributeSupport.removeAttribute(descriptor, SAMLMetadataSupport.VALID_UNTIL_ATTRIB_NAME);
+            final var until = Instant.now().plus(getValidityDuration());
+            assert until != null;
             AttributeSupport.appendDateTimeAttribute(descriptor, SAMLMetadataSupport.VALID_UNTIL_ATTRIB_NAME,
-                    Instant.now().plus(getValidityDuration()));
+                    until);
         }
     }
 
diff --git a/mda-framework/src/main/java/net/shibboleth/metadata/dom/saml/ValidateValidUntilStage.java b/mda-framework/src/main/java/net/shibboleth/metadata/dom/saml/ValidateValidUntilStage.java
index d287994..cc82271 100644
--- a/mda-framework/src/main/java/net/shibboleth/metadata/dom/saml/ValidateValidUntilStage.java
+++ b/mda-framework/src/main/java/net/shibboleth/metadata/dom/saml/ValidateValidUntilStage.java
@@ -49,7 +49,17 @@ public class ValidateValidUntilStage extends AbstractIteratingStage<Element> {
      * Interval from now within which the validUntil date must fall. A value of 0 indicates that no
      * maximum interval is checked. Default value: 1 week
      */
-    @Nonnull @GuardedBy("this") private Duration maxValidityInterval = Duration.ofDays(7);
+    @GuardedBy("this")
+    private @Nonnull Duration maxValidityInterval;
+
+    /**
+     * Constructor.
+     */
+    public ValidateValidUntilStage() {
+        final var dur = Duration.ofDays(7);
+        assert dur != null;
+        maxValidityInterval = dur;
+    }
 
     /**
      * Gets whether the item is required to have a validUntil attribute.
diff --git a/mda-framework/src/main/java/net/shibboleth/metadata/dom/saml/mdattr/EntityAttributeAddingStage.java b/mda-framework/src/main/java/net/shibboleth/metadata/dom/saml/mdattr/EntityAttributeAddingStage.java
index 9df0610..d3410f3 100644
--- a/mda-framework/src/main/java/net/shibboleth/metadata/dom/saml/mdattr/EntityAttributeAddingStage.java
+++ b/mda-framework/src/main/java/net/shibboleth/metadata/dom/saml/mdattr/EntityAttributeAddingStage.java
@@ -126,7 +126,7 @@ public class EntityAttributeAddingStage extends AbstractStage<Element> {
      * 
      * @return the attributeValue
      */
-    @Nonnull
+    @NonnullAfterInit
     public final synchronized String getAttributeValue() {
         return attributeValue;
     }
@@ -188,6 +188,7 @@ public class EntityAttributeAddingStage extends AbstractStage<Element> {
         final var attributeMaker = new AttributeElementMaker(name, format);
 
         final var value = getAttributeValue();
+        assert value != null;
         final var attributeValueMatcher = new AttributeValueElementMatcher(value);
         final var attributeValueMaker = new AttributeValueElementMaker(value);
 
diff --git a/mda-framework/src/main/java/net/shibboleth/metadata/dom/saml/mdrpi/RegistrationAuthorityItemIdentificationStrategy.java b/mda-framework/src/main/java/net/shibboleth/metadata/dom/saml/mdrpi/RegistrationAuthorityItemIdentificationStrategy.java
index 0619c3f..bc478e1 100644
--- a/mda-framework/src/main/java/net/shibboleth/metadata/dom/saml/mdrpi/RegistrationAuthorityItemIdentificationStrategy.java
+++ b/mda-framework/src/main/java/net/shibboleth/metadata/dom/saml/mdrpi/RegistrationAuthorityItemIdentificationStrategy.java
@@ -79,7 +79,7 @@ public class RegistrationAuthorityItemIdentificationStrategy<T> extends FirstIte
      */
     public synchronized void setIgnoredRegistrationAuthorities(
             @Nonnull @NonnullElements @Unmodifiable final Collection<String> registrars) {
-        ignoredRegistrationAuthorities = Set.copyOf(registrars);
+        ignoredRegistrationAuthorities = CollectionSupport.copyToSet(registrars);
     }
 
     /**
@@ -99,7 +99,7 @@ public class RegistrationAuthorityItemIdentificationStrategy<T> extends FirstIte
      */
     public synchronized void setRegistrationAuthorityDisplayNames(
             @Nonnull @NonnullElements @Unmodifiable final Map<String, String> names) {
-        registrationAuthorityDisplayNames = Map.copyOf(names);
+        registrationAuthorityDisplayNames = CollectionSupport.copyToMap(names);
     }
     
     /**
diff --git a/mda-framework/src/main/java/net/shibboleth/metadata/dom/saml/mdui/IPHintValidationStage.java b/mda-framework/src/main/java/net/shibboleth/metadata/dom/saml/mdui/IPHintValidationStage.java
index 5b9f042..c80bae8 100644
--- a/mda-framework/src/main/java/net/shibboleth/metadata/dom/saml/mdui/IPHintValidationStage.java
+++ b/mda-framework/src/main/java/net/shibboleth/metadata/dom/saml/mdui/IPHintValidationStage.java
@@ -68,6 +68,7 @@ public class IPHintValidationStage extends AbstractDOMTraversalStage<DOMTraversa
     @Override
     protected void visit(@Nonnull final Element ipHint, @Nonnull final DOMTraversalContext context) {
         final String hint = ipHint.getTextContent();
+        assert hint != null;
         try {
             final IPRange range = IPRange.parseCIDRBlock(hint);
             if (isCheckingNetworks()) {
diff --git a/mda-framework/src/main/java/net/shibboleth/metadata/pipeline/FilesInDirectoryMultiOutputStrategy.java b/mda-framework/src/main/java/net/shibboleth/metadata/pipeline/FilesInDirectoryMultiOutputStrategy.java
index 3852f3f..7f3c6b2 100644
--- a/mda-framework/src/main/java/net/shibboleth/metadata/pipeline/FilesInDirectoryMultiOutputStrategy.java
+++ b/mda-framework/src/main/java/net/shibboleth/metadata/pipeline/FilesInDirectoryMultiOutputStrategy.java
@@ -166,7 +166,7 @@ public class FilesInDirectoryMultiOutputStrategy<T> extends AbstractInitializabl
      * 
      * @return the directory in use
      */
-    @Nonnull public final synchronized File getDirectory() {
+    public final synchronized @NonnullAfterInit File getDirectory() {
         return directory;
     }
 
diff --git a/mda-framework/src/main/java/net/shibboleth/metadata/pipeline/ItemMetadataAddingStage.java b/mda-framework/src/main/java/net/shibboleth/metadata/pipeline/ItemMetadataAddingStage.java
index 3c2c4f7..2843347 100644
--- a/mda-framework/src/main/java/net/shibboleth/metadata/pipeline/ItemMetadataAddingStage.java
+++ b/mda-framework/src/main/java/net/shibboleth/metadata/pipeline/ItemMetadataAddingStage.java
@@ -65,7 +65,7 @@ public class ItemMetadataAddingStage<T> extends AbstractIteratingStage<T> {
         checkSetterPreconditions();
 
         Constraint.isNotNull(metadata, "additional metadata collection must not be null");
-        additionalItemMetadata = List.copyOf(metadata);
+        additionalItemMetadata = CollectionSupport.copyToList(metadata);
     }
 
     @Override
diff --git a/mda-framework/src/main/java/net/shibboleth/metadata/pipeline/PipelineDemultiplexerStage.java b/mda-framework/src/main/java/net/shibboleth/metadata/pipeline/PipelineDemultiplexerStage.java
index 033a994..9c85aed 100644
--- a/mda-framework/src/main/java/net/shibboleth/metadata/pipeline/PipelineDemultiplexerStage.java
+++ b/mda-framework/src/main/java/net/shibboleth/metadata/pipeline/PipelineDemultiplexerStage.java
@@ -213,7 +213,7 @@ public class PipelineDemultiplexerStage<T> extends AbstractStage<T> {
             Constraint.isNotNull(pass.getSecond(), "Predicate can not be null");
         }
 
-        pipelineAndStrategies = List.copyOf(passes);
+        pipelineAndStrategies = CollectionSupport.copyToList(passes);
     }
 
     @Override
@@ -222,9 +222,12 @@ public class PipelineDemultiplexerStage<T> extends AbstractStage<T> {
         final @Nonnull @NonnullElements List<Future<List<Item<T>>>> pipelineFutures = new ArrayList<>();
 
         for (final Pair<Pipeline<T>, Predicate<Item<T>>> pipelineAndStrategy : getPipelineAndSelectionStrategies()) {
-            final @Nonnull Pipeline<T> pipeline = pipelineAndStrategy.getFirst();
-            final @Nonnull Predicate<Item<T>> selectionStrategy = pipelineAndStrategy.getSecond();
-            final @Nonnull List<Item<T>> selectedItems = getCollectionFactory().get();
+            final @Nonnull Pipeline<T> pipeline =
+                    Constraint.isNotNull(pipelineAndStrategy.getFirst(), "pipeline may not be null");
+            final @Nonnull Predicate<Item<T>> selectionStrategy =
+                    Constraint.isNotNull(pipelineAndStrategy.getSecond(), "strategy may not be null");
+            final List<Item<T>> selectedItems = getCollectionFactory().get();
+            assert selectedItems != null;
 
             for (final Item<T> item : items) {
                 if (selectionStrategy.test(item)) {
@@ -256,7 +259,7 @@ public class PipelineDemultiplexerStage<T> extends AbstractStage<T> {
         }
 
         for (final Pair<Pipeline<T>, Predicate<Item<T>>> pipelineAndStrategy : pipelineAndStrategies) {
-            final var pipeline = pipelineAndStrategy.getFirst();
+            final var pipeline = Constraint.isNotNull(pipelineAndStrategy.getFirst(), "pipeline may not be null");
             if (!pipeline.isInitialized()) {
                 pipeline.initialize();
             }
diff --git a/mda-framework/src/main/java/net/shibboleth/metadata/pipeline/PipelineMergeStage.java b/mda-framework/src/main/java/net/shibboleth/metadata/pipeline/PipelineMergeStage.java
index d1830cd..ec8371b 100644
--- a/mda-framework/src/main/java/net/shibboleth/metadata/pipeline/PipelineMergeStage.java
+++ b/mda-framework/src/main/java/net/shibboleth/metadata/pipeline/PipelineMergeStage.java
@@ -160,7 +160,7 @@ public class PipelineMergeStage<T> extends AbstractStage<T> {
     public synchronized void setMergedPipelines(
             @Nonnull @NonnullElements @Unmodifiable final List<? extends Pipeline<T>> pipelines) {
         checkSetterPreconditions();
-        mergedPipelines = List.copyOf(pipelines);
+        mergedPipelines = CollectionSupport.copyToList(pipelines);
     }
 
     /**
@@ -207,8 +207,11 @@ public class PipelineMergeStage<T> extends AbstractStage<T> {
             throws StageProcessingException {
         final @Nonnull List<Future<List<Item<T>>>> pipelineResultFutures = new ArrayList<>();
 
-        for (final @Nonnull Pipeline<T> pipeline : getMergedPipelines()) {
-            final @Nonnull var callable = new PipelineCallable<T>(pipeline, getCollectionFactory().get());
+        for (final Pipeline<T> pipeline : getMergedPipelines()) {
+            assert pipeline != null;
+            final var collection = getCollectionFactory().get();
+            assert collection != null;
+            final @Nonnull var callable = new PipelineCallable<T>(pipeline, collection);
             final @Nonnull var future = new FutureTask<List<Item<T>>>(callable);
             getExecutor().execute(future);
             pipelineResultFutures.add(future);
@@ -216,6 +219,7 @@ public class PipelineMergeStage<T> extends AbstractStage<T> {
 
         final List<List<Item<T>>> pipelineResults = new ArrayList<>();
         for (final Future<List<Item<T>>> future : pipelineResultFutures) {
+            assert future != null;
             pipelineResults.add(FutureSupport.futureItems(future));
         }
 
diff --git a/mda-framework/src/main/java/net/shibboleth/metadata/pipeline/SplitMergeStage.java b/mda-framework/src/main/java/net/shibboleth/metadata/pipeline/SplitMergeStage.java
index 5dc8a2c..c91837a 100644
--- a/mda-framework/src/main/java/net/shibboleth/metadata/pipeline/SplitMergeStage.java
+++ b/mda-framework/src/main/java/net/shibboleth/metadata/pipeline/SplitMergeStage.java
@@ -272,7 +272,9 @@ public class SplitMergeStage<T> extends AbstractStage<T> {
     protected void doExecute(@Nonnull @NonnullElements final List<Item<T>> items)
             throws StageProcessingException {
         final List<Item<T>> selectedItems = getCollectionFactory().get();
+        assert selectedItems != null;
         final List<Item<T>> nonselectedItems = getCollectionFactory().get();
+        assert nonselectedItems != null;
 
         final var strategy = getSelectionStrategy();
         for (final Item<T> item : items) {
@@ -314,7 +316,9 @@ public class SplitMergeStage<T> extends AbstractStage<T> {
          * an already completed {@link CompletableFuture}.
          */
         if (pipeline == null) {
-            return CompletableFuture.completedFuture(items);
+            final var future = CompletableFuture.completedFuture(items);
+            assert future != null;
+            return future;
         }
 
         final PipelineCallable<T> callable = new PipelineCallable<>(pipeline, items);
@@ -333,11 +337,13 @@ public class SplitMergeStage<T> extends AbstractStage<T> {
 
         if (selectedItemPipeline != null && !selectedItemPipeline.isInitialized()) {
             LOG.debug("Selected item pipeline was not initialized, initializing it now.");
+            assert selectedItemPipeline != null;
             selectedItemPipeline.initialize();
         }
 
         if (nonselectedItemPipeline != null && !nonselectedItemPipeline.isInitialized()) {
             LOG.debug("Non-selected item pipeline was not initialized, initializing it now.");
+            assert nonselectedItemPipeline != null;
             nonselectedItemPipeline.initialize();
         }
     }
diff --git a/mda-framework/src/main/java/net/shibboleth/metadata/validate/x509/X509ROCAValidator.java b/mda-framework/src/main/java/net/shibboleth/metadata/validate/x509/X509ROCAValidator.java
index 634e371..683d0d5 100644
--- a/mda-framework/src/main/java/net/shibboleth/metadata/validate/x509/X509ROCAValidator.java
+++ b/mda-framework/src/main/java/net/shibboleth/metadata/validate/x509/X509ROCAValidator.java
@@ -126,7 +126,9 @@ public class X509ROCAValidator extends AbstractX509Validator {
         final PublicKey key = cert.getPublicKey();
         if ("RSA".equals(key.getAlgorithm())) {
             final RSAPublicKey rsaKey = (RSAPublicKey) key;
-            if (BrokenKey.isAffected(rsaKey.getModulus())) {
+            final var modulus = rsaKey.getModulus();
+            assert modulus != null;
+            if (BrokenKey.isAffected(modulus)) {
                 addError("RSA public key is vulnerable to ROCA", item, stageId);
             }
         }
diff --git a/mda-framework/src/main/java/net/shibboleth/metadata/validate/x509/X509RSAExponentValidator.java b/mda-framework/src/main/java/net/shibboleth/metadata/validate/x509/X509RSAExponentValidator.java
index 5db825d..cdac401 100644
--- a/mda-framework/src/main/java/net/shibboleth/metadata/validate/x509/X509RSAExponentValidator.java
+++ b/mda-framework/src/main/java/net/shibboleth/metadata/validate/x509/X509RSAExponentValidator.java
@@ -46,11 +46,23 @@ public class X509RSAExponentValidator extends AbstractX509Validator {
 
     /** The RSA public exponent value below which an error should result. Default: 5. */
     @Nonnull @GuardedBy("this")
-    private BigInteger errorBoundary = BigInteger.valueOf(5);
+    private BigInteger errorBoundary = bigInteger(5);
     
     /** The RSA public exponent value below which a warning should result. Default: 0 (disabled). */
     @Nonnull @GuardedBy("this")
-    private BigInteger warningBoundary = BigInteger.ZERO;
+    private BigInteger warningBoundary = bigInteger(0);
+
+    /**
+     * Private method to wrap construction of {@link BigInteger} literals.
+     *
+     * @param value value to be converted to {@link BigInteger}
+     * @return the converted {@link BigInteger}
+     */
+    private static final @Nonnull BigInteger bigInteger(final long value) {
+        final var bi = BigInteger.valueOf(value);
+        assert bi != null;
+        return bi;
+    }
 
     /**
      * Get the RSA public exponent below which an error will result.
@@ -67,7 +79,7 @@ public class X509RSAExponentValidator extends AbstractX509Validator {
      * @param length the RSA public exponent below which an error should result
      */
     public synchronized void setErrorBoundary(@Nonnull final BigInteger length) {
-        Constraint.isGreaterThanOrEqual(0, length.compareTo(BigInteger.ZERO), "boundary value must not be negative");
+        Constraint.isGreaterThanOrEqual(0, length.compareTo(bigInteger(0)), "boundary value must not be negative");
         errorBoundary = length;
     }
 
@@ -77,7 +89,7 @@ public class X509RSAExponentValidator extends AbstractX509Validator {
      * @param length the RSA public exponent below which an error should result
      */
     public void setErrorBoundary(final long length) {
-        setErrorBoundary(BigInteger.valueOf(length));
+        setErrorBoundary(bigInteger(length));
     }
     
     /**
@@ -105,7 +117,7 @@ public class X509RSAExponentValidator extends AbstractX509Validator {
      * @param length the RSA public exponent below which a warning should result
      */
     public synchronized void setWarningBoundary(final long length) {
-        setWarningBoundary(BigInteger.valueOf(length));
+        setWarningBoundary(bigInteger(length));
     }
     
     @Override
diff --git a/mda-framework/src/main/java/net/shibboleth/metadata/validate/x509/X509RSAOpenSSLBlacklistValidator.java b/mda-framework/src/main/java/net/shibboleth/metadata/validate/x509/X509RSAOpenSSLBlacklistValidator.java
index b3b33ca..631223d 100644
--- a/mda-framework/src/main/java/net/shibboleth/metadata/validate/x509/X509RSAOpenSSLBlacklistValidator.java
+++ b/mda-framework/src/main/java/net/shibboleth/metadata/validate/x509/X509RSAOpenSSLBlacklistValidator.java
@@ -151,6 +151,7 @@ public class X509RSAOpenSSLBlacklistValidator extends AbstractX509Validator {
             final char [] encodedDigest = Hex.encodeHex(bytes, true);
             final String strValue = String.valueOf(encodedDigest);
             final String trimmed = strValue.substring(20);
+            assert trimmed != null;
             //System.out.println("Digest: " + strValue + " trimmed " + trimmed);
             return trimmed;
         } catch (final NoSuchAlgorithmException e) {
@@ -167,6 +168,7 @@ public class X509RSAOpenSSLBlacklistValidator extends AbstractX509Validator {
         if ("RSA".equals(key.getAlgorithm())) {
             final RSAPublicKey rsaKey = (RSAPublicKey) key;
             final BigInteger modulus = rsaKey.getModulus();
+            assert modulus != null;
 
             final Set<String> values;
             final int keySz;
diff --git a/mda-framework/src/test/java/net/shibboleth/metadata/ItemIdTest.java b/mda-framework/src/test/java/net/shibboleth/metadata/ItemIdTest.java
index 37916dc..837685f 100644
--- a/mda-framework/src/test/java/net/shibboleth/metadata/ItemIdTest.java
+++ b/mda-framework/src/test/java/net/shibboleth/metadata/ItemIdTest.java
@@ -34,9 +34,13 @@ public class ItemIdTest {
         } catch (ConstraintViolationException e) {
             // expected this
         }
-
+    }
+    
+    @SuppressWarnings("null")
+    @Test
+    public void testNull() {
         try {
-            info = new ItemId(null);
+            new ItemId(null);
         } catch (ConstraintViolationException e) {
             // expected this
         }
@@ -65,4 +69,4 @@ public class ItemIdTest {
         ItemId two = new ItemId("two");
         Assert.assertFalse(one.hashCode() == two.hashCode());
     }
-}
\ No newline at end of file
+}
diff --git a/mda-framework/src/test/java/net/shibboleth/metadata/MockItemTest.java b/mda-framework/src/test/java/net/shibboleth/metadata/MockItemTest.java
index 34317aa..6b425e5 100644
--- a/mda-framework/src/test/java/net/shibboleth/metadata/MockItemTest.java
+++ b/mda-framework/src/test/java/net/shibboleth/metadata/MockItemTest.java
@@ -7,6 +7,7 @@ import net.shibboleth.shared.logic.ConstraintViolationException;
 
 public class MockItemTest {
 
+    @SuppressWarnings("null")
     @Test(expectedExceptions=ConstraintViolationException.class)
     public void testNull() {
         new MockItem(null);
diff --git a/mda-framework/src/test/java/net/shibboleth/metadata/dom/XMLSignatureSigningStageTest.java b/mda-framework/src/test/java/net/shibboleth/metadata/dom/XMLSignatureSigningStageTest.java
index d337d34..5c2f75f 100644
--- a/mda-framework/src/test/java/net/shibboleth/metadata/dom/XMLSignatureSigningStageTest.java
+++ b/mda-framework/src/test/java/net/shibboleth/metadata/dom/XMLSignatureSigningStageTest.java
@@ -39,6 +39,7 @@ import org.xmlunit.input.NormalizedSource;
 
 import net.shibboleth.metadata.Item;
 import net.shibboleth.metadata.dom.ds.XMLDSIGSupport;
+import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.logic.ConstraintViolationException;
 import net.shibboleth.shared.xml.ElementSupport;
 import net.shibboleth.shared.xml.SerializeSupport;
@@ -59,7 +60,7 @@ public class XMLSignatureSigningStageTest extends BaseDOMTest {
      * @return collection made from the resource
      * @throws XMLParserException if the resource can't be parsed
      */
-    private List<Item<Element>> getInput(@Nonnull final String fileName) throws XMLParserException {
+    private @Nonnull List<Item<Element>> getInput(@Nonnull final String fileName) throws XMLParserException {
         final Element testInput = readXMLData(fileName);
         final List<Item<Element>> list = new ArrayList<>();
         list.add(new DOMElementItem(testInput));
@@ -94,6 +95,7 @@ public class XMLSignatureSigningStageTest extends BaseDOMTest {
 
         PrivateKey signingKey = KeyPairUtil.readPrivateKey(XMLSignatureSigningStageTest.class
                 .getResourceAsStream(classRelativeResource("signingKey.pem")));
+        assert signingKey != null;
         X509Certificate signingCert = CertUtil.readCertificate(XMLSignatureSigningStageTest.class
                 .getResourceAsStream(classRelativeResource("signingCert.pem")));
         final List<X509Certificate> certs = new ArrayList<>();
@@ -131,6 +133,7 @@ public class XMLSignatureSigningStageTest extends BaseDOMTest {
 
         final PrivateKey signingKey = KeyPairUtil.readPrivateKey(XMLSignatureSigningStageTest.class
                 .getResourceAsStream(classRelativeResource("signingKey.pem")));
+        assert signingKey != null;
         final X509Certificate signingCert = CertUtil.readCertificate(XMLSignatureSigningStageTest.class
                 .getResourceAsStream(classRelativeResource("signingCert.pem")));
         final List<X509Certificate> certs = new ArrayList<>();
@@ -155,6 +158,7 @@ public class XMLSignatureSigningStageTest extends BaseDOMTest {
         assertXMLIdentical(expected, result.unwrap());
     }
 
+    @SuppressWarnings("null")
     @Test
     public void testSetIdAttributeNamesNull() throws Exception {
         final XMLSignatureSigningStage stage = new XMLSignatureSigningStage();
@@ -186,6 +190,7 @@ public class XMLSignatureSigningStageTest extends BaseDOMTest {
     public void setRemovingCRsFromSignature() throws Exception {
         PrivateKey signingKey = KeyPairUtil.readPrivateKey(XMLSignatureSigningStageTest.class
                 .getResourceAsStream(classRelativeResource("signingKey.pem")));
+        assert signingKey != null;
         X509Certificate signingCert = CertUtil.readCertificate(XMLSignatureSigningStageTest.class
                 .getResourceAsStream(classRelativeResource("signingCert.pem")));
         final List<X509Certificate> certs = new ArrayList<>();
@@ -194,7 +199,7 @@ public class XMLSignatureSigningStageTest extends BaseDOMTest {
         /*
          * The first result uses the default value.
          */
-        final List<Item<Element>> mdCol1 = getInput("input.xml");
+        final @Nonnull List<Item<Element>> mdCol1 = getInput("input.xml");
 
         final XMLSignatureSigningStage stage1 = new XMLSignatureSigningStage();
         stage1.setId("test");
@@ -254,12 +259,14 @@ public class XMLSignatureSigningStageTest extends BaseDOMTest {
     public void mda224defaultingPublicKeyFromCertificate() throws Exception {
         final var signingKey = KeyPairUtil.readPrivateKey(XMLSignatureSigningStageTest.class
                 .getResourceAsStream(classRelativeResource("signingKey.pem")));
+        assert signingKey != null;
         final var md = getInput("input.xml");
         final var stage = new XMLSignatureSigningStage();
         
         final var signingCert = CertUtil.readCertificate(XMLSignatureSigningStageTest.class
                 .getResourceAsStream(classRelativeResource("signingCert.pem")));
-        final var certs = List.of(signingCert);
+        assert signingCert != null;
+        final var certs = CollectionSupport.listOf(signingCert);
 
         stage.setId("test");
         stage.setIncludeKeyValue(true);
@@ -273,7 +280,7 @@ public class XMLSignatureSigningStageTest extends BaseDOMTest {
         
         final var entitiesDescriptor = md.get(0).unwrap(); // document element
         final var keyInfo = extractKeyInfo(entitiesDescriptor);
-        Assert.assertNotNull(keyInfo);
+        assert keyInfo != null;
 
         // If we had a certificate, expect to see that as an X509Data, and expect to see
         // its public key as well as a KeyValue
@@ -285,6 +292,7 @@ public class XMLSignatureSigningStageTest extends BaseDOMTest {
     public void mda224defaultingPublicKeyFromAbsentCertificate() throws Exception {
         final var signingKey = KeyPairUtil.readPrivateKey(XMLSignatureSigningStageTest.class
                 .getResourceAsStream(classRelativeResource("signingKey.pem")));
+        assert signingKey != null;
         final var md = getInput("input.xml");
         final var stage = new XMLSignatureSigningStage();
         
diff --git a/mda-framework/src/test/java/net/shibboleth/metadata/dom/XMLSignatureValidationStageTest.java b/mda-framework/src/test/java/net/shibboleth/metadata/dom/XMLSignatureValidationStageTest.java
index 353a516..fec818c 100644
--- a/mda-framework/src/test/java/net/shibboleth/metadata/dom/XMLSignatureValidationStageTest.java
+++ b/mda-framework/src/test/java/net/shibboleth/metadata/dom/XMLSignatureValidationStageTest.java
@@ -24,6 +24,8 @@ import java.util.HashSet;
 import java.util.List;
 import java.util.Set;
 
+import javax.annotation.Nonnull;
+
 import net.shibboleth.metadata.ErrorStatus;
 import net.shibboleth.metadata.Item;
 import net.shibboleth.metadata.WarningStatus;
@@ -37,15 +39,17 @@ import org.w3c.dom.Element;
 /** Unit test for {@link XMLSchemaValidationStage}. */
 public class XMLSignatureValidationStageTest extends BaseDOMTest {
     
-    private final Certificate signingCert;
+    private final @Nonnull Certificate signingCert;
     
     public XMLSignatureValidationStageTest() throws IOException {
         super(XMLSignatureValidationStage.class);
-        signingCert = CertUtil.readCertificate(XMLSignatureSigningStageTest.class
+        var cert = CertUtil.readCertificate(XMLSignatureSigningStageTest.class
                 .getResourceAsStream(classRelativeResource("signingCert.pem")));
+        assert cert != null;
+        signingCert = cert;
     }
     
-    private DOMElementItem makeItem(final String name) throws XMLParserException {
+    private DOMElementItem makeItem(final @Nonnull String name) throws XMLParserException {
         final Element input = readXMLData(name);
         return new DOMElementItem(input);
     }
@@ -126,8 +130,6 @@ public class XMLSignatureValidationStageTest extends BaseDOMTest {
         stage.destroy();
         Assert.assertEquals(mdCol.size(), 1);
 
-        final Item<Element> result = mdCol.iterator().next();
-
         final DOMElementItem item2 = makeItem("entities2.xml");
         
         mdCol.clear();
diff --git a/mda-framework/src/test/java/net/shibboleth/metadata/dom/XSLTtransformationStageTest.java b/mda-framework/src/test/java/net/shibboleth/metadata/dom/XSLTtransformationStageTest.java
index ff05dd7..f401870 100644
--- a/mda-framework/src/test/java/net/shibboleth/metadata/dom/XSLTtransformationStageTest.java
+++ b/mda-framework/src/test/java/net/shibboleth/metadata/dom/XSLTtransformationStageTest.java
@@ -42,6 +42,7 @@ import net.shibboleth.shared.xml.XMLParserException;
 import org.springframework.core.io.Resource;
 import org.testng.Assert;
 import org.testng.annotations.Test;
+import org.w3c.dom.Document;
 import org.w3c.dom.Element;
 import org.w3c.dom.Node;
 
@@ -234,10 +235,14 @@ public class XSLTtransformationStageTest extends BaseDOMTest {
 
         final Element expected = readXMLData("transform1.xml");
         // Compare *documents* here so that we include the prolog
-        assertXMLIdentical(expected.getOwnerDocument(), result.unwrap().getOwnerDocument());
+        final var ownerDocument = expected.getOwnerDocument();
+        assert ownerDocument != null;
+        Document ownerDocument2 = result.unwrap().getOwnerDocument();
+        assert ownerDocument2 != null;
+        assertXMLIdentical(ownerDocument, ownerDocument2);
 
         // peek at the first node in the document; should be a comment
-        final Node firstNode = result.unwrap().getOwnerDocument().getFirstChild();
+        final Node firstNode = ownerDocument2.getFirstChild();
         Assert.assertEquals(firstNode.getNodeType(), Node.COMMENT_NODE);
         Assert.assertEquals(firstNode.getNodeValue(), "this is a comment");
     }
diff --git a/mda-framework/src/test/java/net/shibboleth/metadata/dom/saml/PullUpCacheDurationStageTest.java b/mda-framework/src/test/java/net/shibboleth/metadata/dom/saml/PullUpCacheDurationStageTest.java
index b2db84f..0dbb1aa 100644
--- a/mda-framework/src/test/java/net/shibboleth/metadata/dom/saml/PullUpCacheDurationStageTest.java
+++ b/mda-framework/src/test/java/net/shibboleth/metadata/dom/saml/PullUpCacheDurationStageTest.java
@@ -85,9 +85,12 @@ public class PullUpCacheDurationStageTest extends BaseDOMTest {
         final ArrayList<Item<Element>> metadataCollection = new ArrayList<>();
         metadataCollection.add(new DOMElementItem(readXMLData("in.xml")));
 
+        final var twoHours = Duration.ofHours(2);
+        assert twoHours != null;
+
         PullUpCacheDurationStage stage = new PullUpCacheDurationStage();
         stage.setId("test");
-        stage.setMinimumCacheDuration(Duration.ofHours(2));
+        stage.setMinimumCacheDuration(twoHours);
         stage.initialize();
         
         stage.execute(metadataCollection);
diff --git a/mda-framework/src/test/java/net/shibboleth/metadata/dom/saml/PullUpValidUntilStageTest.java b/mda-framework/src/test/java/net/shibboleth/metadata/dom/saml/PullUpValidUntilStageTest.java
index 0a064cc..2b010b3 100644
--- a/mda-framework/src/test/java/net/shibboleth/metadata/dom/saml/PullUpValidUntilStageTest.java
+++ b/mda-framework/src/test/java/net/shibboleth/metadata/dom/saml/PullUpValidUntilStageTest.java
@@ -71,6 +71,7 @@ public class PullUpValidUntilStageTest extends BaseDOMTest {
         Assert.assertEquals(entityDescriptors.size(), 3);
 
         for (Element entityDescriptor : entityDescriptors) {
+            assert entityDescriptor != null;
             Assert.assertFalse(AttributeSupport.hasAttribute(entityDescriptor,
                     SAMLMetadataSupport.VALID_UNTIL_ATTRIB_NAME));
         }
@@ -87,6 +88,7 @@ public class PullUpValidUntilStageTest extends BaseDOMTest {
         metadataCollection.add(new DOMElementItem(readXMLData("in.xml")));
 
         final var hundredYears = Duration.ofDays(365 * 100);
+        assert hundredYears != null;
         
         PullUpValidUntilStage stage = new PullUpValidUntilStage();
         stage.setId("test");
@@ -116,6 +118,7 @@ public class PullUpValidUntilStageTest extends BaseDOMTest {
         metadataCollection.add(new DOMElementItem(readXMLData("in.xml")));
 
         final var twoYears = Duration.ofDays(365 * 2);
+        assert twoYears != null;
         final var twoYearsFromNow = Instant.now().plus(twoYears);
         
         PullUpValidUntilStage stage = new PullUpValidUntilStage();
diff --git a/mda-framework/src/test/java/net/shibboleth/metadata/validate/x509/X509RSAExponentValidatorTest.java b/mda-framework/src/test/java/net/shibboleth/metadata/validate/x509/X509RSAExponentValidatorTest.java
index c70d48b..78889b6 100644
--- a/mda-framework/src/test/java/net/shibboleth/metadata/validate/x509/X509RSAExponentValidatorTest.java
+++ b/mda-framework/src/test/java/net/shibboleth/metadata/validate/x509/X509RSAExponentValidatorTest.java
@@ -21,6 +21,8 @@ package net.shibboleth.metadata.validate.x509;
 import java.math.BigInteger;
 import java.security.cert.X509Certificate;
 
+import javax.annotation.Nonnull;
+
 import org.testng.Assert;
 import org.testng.annotations.Test;
 
@@ -29,6 +31,9 @@ import net.shibboleth.shared.logic.ConstraintViolationException;
 
 public class X509RSAExponentValidatorTest extends BaseX509ValidatorTest {
     
+    private static final @Nonnull BigInteger ZERO = new BigInteger("0");
+    private static final @Nonnull BigInteger MINUS_ONE = new BigInteger("-1");
+
     public X509RSAExponentValidatorTest() throws Exception {
         super(X509RSAExponentValidator.class);
     }
@@ -110,25 +115,25 @@ public class X509RSAExponentValidatorTest extends BaseX509ValidatorTest {
 
     public void testErrorBoundaryBigZero() throws Exception {
         final var stage = new X509RSAExponentValidator();
-        stage.setErrorBoundary(BigInteger.ZERO);
+        stage.setErrorBoundary(ZERO);
     }
 
     @Test(expectedExceptions = ConstraintViolationException.class)
     public void testErrorBoundaryBigNegative() throws Exception {
         final var stage = new X509RSAExponentValidator();
-        stage.setErrorBoundary(BigInteger.valueOf(-1));
+        stage.setErrorBoundary(MINUS_ONE);
     }
 
     @Test
     public void testWarningBoundaryBigZero() throws Exception {
         final var stage = new X509RSAExponentValidator();
-        stage.setWarningBoundary(BigInteger.ZERO);
+        stage.setWarningBoundary(ZERO);
     }
 
     @Test(expectedExceptions = ConstraintViolationException.class)
     public void testWarningBoundaryBigNegative() throws Exception {
         final var stage = new X509RSAExponentValidator();
-        stage.setWarningBoundary(BigInteger.valueOf(-1));
+        stage.setWarningBoundary(MINUS_ONE);
     }
 
     @Test

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.


More information about the commits mailing list