[java-shib-metadata] branch main updated: IDP-2083 - Treat NonnullElements as the default for collections

Scott Cantor cantor.2 at osu.edu
Mon May 1 19:02:42 UTC 2023


This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch main
in repository java-shib-metadata.

View the commit online:
http://git.shibboleth.net/view/?p=java-shib-metadata.git;a=commit;h=e99a02e8ca73c98d1ddbde5a7d479a41e5b890a7

The following commit(s) were added to refs/heads/main by this push:
     new e99a02e8 IDP-2083 - Treat NonnullElements as the default for collections
e99a02e8 is described below

commit e99a02e8ca73c98d1ddbde5a7d479a41e5b890a7
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Mon May 1 15:02:39 2023 -0400

    IDP-2083 - Treat NonnullElements as the default for collections
    
    https://shibboleth.atlassian.net/browse/IDP-2083
    
    Review and annotate packages in java-shib-metadata.
---
 .../shibboleth/idp/saml/metadata/ACSUIInfo.java    | 11 +++--
 .../shibboleth/idp/saml/metadata/IdPUIInfo.java    | 22 ++++-----
 .../idp/saml/metadata/OrganizationUIInfo.java      | 21 ++++----
 .../idp/saml/metadata/ScopesContainer.java         |  3 +-
 .../shibboleth/idp/saml/metadata/package-info.java |  5 +-
 .../idp/saml/security/KeyAuthoritySupport.java     | 21 ++++----
 .../shibboleth/idp/saml/security/package-info.java |  5 +-
 .../net/shibboleth/idp/saml/xml/SAMLConstants.java |  5 +-
 .../net/shibboleth/idp/saml/xml/package-info.java  |  4 +-
 .../idp/saml/xmlobject/ExtensionsConstants.java    | 14 ++++--
 .../idp/saml/xmlobject/KeyAuthority.java           | 16 +++---
 .../net/shibboleth/idp/saml/xmlobject/Scope.java   | 15 +++---
 .../shibboleth/idp/saml/xmlobject/ScopedValue.java | 26 +++++-----
 .../idp/saml/xmlobject/package-info.java           |  6 ++-
 .../impl/ByReferenceMetadataFilterBridge.java      |  2 +-
 .../metadata/impl/MetadataProviderContainer.java   |  5 +-
 .../impl/MetadataResolverServiceGaugeSet.java      | 13 ++---
 .../metadata/impl/ReloadableMetadataResolver.java  | 14 +++---
 .../saml/metadata/impl/ScopesNodeProcessor.java    |  5 +-
 .../saml/metadata/impl/UIInfoNodeProcessor.java    |  2 +-
 .../idp/saml/metadata/impl/package-info.java       |  4 +-
 .../security/impl/KeyAuthorityNodeProcessor.java   | 25 +++++-----
 .../MetadataPKIXValidationInformationResolver.java | 57 ++++++++++------------
 .../idp/saml/security/impl/package-info.java       |  5 +-
 .../xmlobject/impl/KeyAuthorityMarshaller.java     |  9 ++--
 .../xmlobject/impl/KeyAuthorityUnmarshaller.java   |  2 +-
 .../idp/saml/xmlobject/impl/ScopeImpl.java         | 14 +++---
 .../idp/saml/xmlobject/impl/ScopeMarshaller.java   |  7 ++-
 .../idp/saml/xmlobject/impl/ScopeUnmarshaller.java |  4 +-
 .../idp/saml/xmlobject/impl/ScopedValueImpl.java   | 17 ++++---
 .../idp/saml/xmlobject/impl/package-info.java      |  4 +-
 ...adataPKIXValidationInformationResolverTest.java |  1 +
 .../idp/saml/xmlobject/impl/ScopeTest.java         | 15 +++---
 .../spring/http/HTTPResourceFactoryBean.java       | 15 +++---
 .../net/shibboleth/spring/http/package-info.java   |  4 +-
 .../AbstractDynamicHTTPMetadataProviderParser.java |  4 +-
 .../metadata/AbstractMetadataProviderParser.java   |  2 +-
 .../ByReferenceFilterBeanPostProcessor.java        |  6 ++-
 .../metadata/ChainingMetadataProviderParser.java   |  2 +-
 .../DynamicHTTPMetadataProviderParser.java         |  4 +-
 .../FileBackedHTTPMetadataProviderParser.java      |  5 +-
 .../metadata/FilesystemMetadataProviderParser.java |  2 +-
 .../HTTPMetadataProvidersParserSupport.java        |  2 +-
 .../metadata/InlineMetadataProviderParser.java     |  2 +-
 .../LocalDynamicMetadataProviderParser.java        |  9 ++--
 .../NodeProcessingAttachingBeanPostProcessor.java  | 15 +++---
 .../ResourceBackedMetadataProviderParser.java      |  3 +-
 .../spring/metadata/filter/ByReferenceParser.java  |  1 +
 .../metadata/filter/EntityRoleFilterParser.java    |  1 +
 .../spring/metadata/filter/package-info.java       |  4 +-
 .../shibboleth/spring/metadata/package-info.java   |  5 +-
 .../java/net/shibboleth/spring/package-info.java   |  4 +-
 .../spring/security/CredentialHolder.java          |  7 ++-
 .../spring/security/SecurityNamespaceHandler.java  |  1 +
 .../credential/BasicInlineCredentialParser.java    |  3 +-
 .../credential/BasicResourceCredentialParser.java  |  2 +-
 .../credential/X509InlineCredentialParser.java     |  2 +-
 .../credential/X509ResourceCredentialParser.java   |  2 +-
 .../shibboleth/spring/security/package-info.java   |  4 +-
 .../spring/security/trust/package-info.java        |  4 +-
 .../http/HTTPResourceConfigurationTests.java       | 20 ++++----
 .../metadata/AbstractMetadataParserTest.java       | 17 ++++---
 .../DynamicHTTPMetadataProviderParserTest.java     |  9 ++--
 .../spring/metadata/EmptyChainService.java         |  1 +
 .../spring/metadata/InlineMetadataParserTest.java  |  3 +-
 .../LocalDynamicMetadataProviderParserTest.java    |  4 +-
 .../spring/metadata/MetadataFailFastTest.java      | 25 +++++-----
 .../filter/EntityRoleFilterParserTest.java         |  1 +
 .../security/AbstractSecurityParserTest.java       | 18 ++++---
 .../security/trust/ChainingTrustEngineTest.java    |  2 +
 .../spring/testing/AbstractFailFastTest.java       | 41 +++++++++-------
 .../shibboleth/spring/testing/package-info.java    |  4 +-
 72 files changed, 362 insertions(+), 277 deletions(-)

diff --git a/shib-metadata-api/src/main/java/net/shibboleth/idp/saml/metadata/ACSUIInfo.java b/shib-metadata-api/src/main/java/net/shibboleth/idp/saml/metadata/ACSUIInfo.java
index beda3312..001e4a09 100644
--- a/shib-metadata-api/src/main/java/net/shibboleth/idp/saml/metadata/ACSUIInfo.java
+++ b/shib-metadata-api/src/main/java/net/shibboleth/idp/saml/metadata/ACSUIInfo.java
@@ -28,6 +28,7 @@ import org.opensaml.saml.saml2.metadata.AttributeConsumingService;
 import org.opensaml.saml.saml2.metadata.LocalizedName;
 import org.slf4j.Logger;
 
+import net.shibboleth.shared.annotation.constraint.NotLive;
 import net.shibboleth.shared.annotation.constraint.Unmodifiable;
 import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.primitive.LoggerFactory;
@@ -40,13 +41,13 @@ public class ACSUIInfo {
     @Nonnull private static final Logger LOG = LoggerFactory.getLogger(ACSUIInfo.class);
     
     /** The Service Names as a map from locale to actual value.*/ 
-    @Nonnull @Unmodifiable private final Map<Locale, String> serviceNames;
+    @Nonnull @Unmodifiable @NotLive private final Map<Locale, String> serviceNames;
     
     /** The Service Descriptions as a map from locale to actual value.*/ 
-    @Nonnull @Unmodifiable private final Map<Locale, String> serviceDescriptions;
+    @Nonnull @Unmodifiable @NotLive private final Map<Locale, String> serviceDescriptions;
        
     /** Warning check against a non localized String. */
-    private final Predicate<LocalizedName> nullLanguageString = new Predicate<>() {
+    @Nonnull private final Predicate<LocalizedName> nullLanguageString = new Predicate<>() {
         public boolean test(final LocalizedName u) {
             if (u.getXMLLang() == null) {
                 LOG.warn("<{}> with value {} in <AttributeConsumingService>" +
@@ -94,7 +95,7 @@ public class ACSUIInfo {
      * 
      * @return the display names
      */
-    @Nonnull @Unmodifiable public Map<Locale, String> getServiceNames() {
+    @Nonnull @Unmodifiable @NotLive public Map<Locale, String> getServiceNames() {
         return serviceNames; 
     }
     
@@ -103,7 +104,7 @@ public class ACSUIInfo {
      *
      * @return the descriptions names (if any)
      */
-    @Nonnull @Unmodifiable public Map<Locale, String> getServiceDescriptions() {
+    @Nonnull @Unmodifiable @NotLive public Map<Locale, String> getServiceDescriptions() {
         return serviceDescriptions;
     }
     
diff --git a/shib-metadata-api/src/main/java/net/shibboleth/idp/saml/metadata/IdPUIInfo.java b/shib-metadata-api/src/main/java/net/shibboleth/idp/saml/metadata/IdPUIInfo.java
index d49c952b..01bfa0ef 100644
--- a/shib-metadata-api/src/main/java/net/shibboleth/idp/saml/metadata/IdPUIInfo.java
+++ b/shib-metadata-api/src/main/java/net/shibboleth/idp/saml/metadata/IdPUIInfo.java
@@ -45,31 +45,31 @@ import net.shibboleth.shared.primitive.LoggerFactory;
 public class IdPUIInfo {
     
     /** logger. */
-    private static final Logger LOG = LoggerFactory.getLogger(IdPUIInfo.class);
+    @Nonnull private static final Logger LOG = LoggerFactory.getLogger(IdPUIInfo.class);
     
     /** The Display Names as a map from locale to actual value.*/ 
-    @Nonnull @Unmodifiable private final Map<Locale, String> displayNames;
+    @Nonnull @Unmodifiable @NotLive private final Map<Locale, String> displayNames;
     
     /** The Keywords as a map from locale to lists of actual values.*/ 
-    @Nonnull @Unmodifiable private final Map<Locale, List<String>> keywordList;
+    @Nonnull @Unmodifiable @NotLive private final Map<Locale, List<String>> keywordList;
     
     /** The Descriptions as a map from locale to actual value.*/ 
-    @Nonnull @Unmodifiable private final Map<Locale, String> descriptions;
+    @Nonnull @Unmodifiable @NotLive private final Map<Locale, String> descriptions;
     
     /** The Logos as a map from locale to actual value.*/ 
-    @Nonnull @Unmodifiable private final Map<Locale, List<Logo>> localeLogos;
+    @Nonnull @Unmodifiable @NotLive private final Map<Locale, List<Logo>> localeLogos;
 
     /** The non Locale bearing Logos .*/ 
-    @Nonnull @Unmodifiable private final List<Logo> nonLocaleLogos;
+    @Nonnull @Unmodifiable @NotLive private final List<Logo> nonLocaleLogos;
 
     /** The Information URLs as a map from locale to actual value.*/ 
-    @Nonnull @Unmodifiable private final Map<Locale, String> informationURLs;
+    @Nonnull @Unmodifiable @NotLive private final Map<Locale, String> informationURLs;
     
     /** The Privacy Statement URLs as a map from locale to actual value.*/ 
-    @Nonnull @Unmodifiable private final Map<Locale, String> privacyStatementURLs; 
+    @Nonnull @Unmodifiable @NotLive private final Map<Locale, String> privacyStatementURLs; 
  
     /** Warning check against a non localized keyword. */
-    private final Predicate<Keywords> nullLanguageKeyword = new Predicate<>() {
+    @Nonnull private final Predicate<Keywords> nullLanguageKeyword = new Predicate<>() {
         public boolean test(@Nullable final Keywords u) {
             if (u != null && u.getXMLLang() == null) {
                 LOG.warn("Keyword with value {} in <UIInfo/> has no language associated, ignoring", u.getKeywords());
@@ -181,7 +181,7 @@ public class IdPUIInfo {
      * @param inside further contextual info for logging
      * @return true if the string inside the name is empty.
      */
-    private final Predicate<LocalizedURI> nullLanguageURL(@Nonnull final String inside) {
+    @Nonnull private final Predicate<LocalizedURI> nullLanguageURL(@Nonnull final String inside) {
         return new Predicate<>() {
             public boolean test(final LocalizedURI u) {
                 if (u.getXMLLang() == null) {
@@ -263,4 +263,4 @@ public class IdPUIInfo {
         return privacyStatementURLs;
     }
     
-}
+}
\ No newline at end of file
diff --git a/shib-metadata-api/src/main/java/net/shibboleth/idp/saml/metadata/OrganizationUIInfo.java b/shib-metadata-api/src/main/java/net/shibboleth/idp/saml/metadata/OrganizationUIInfo.java
index b660a8cd..82ce29e4 100644
--- a/shib-metadata-api/src/main/java/net/shibboleth/idp/saml/metadata/OrganizationUIInfo.java
+++ b/shib-metadata-api/src/main/java/net/shibboleth/idp/saml/metadata/OrganizationUIInfo.java
@@ -29,6 +29,7 @@ import org.opensaml.saml.saml2.metadata.LocalizedURI;
 import org.opensaml.saml.saml2.metadata.Organization;
 import org.slf4j.Logger;
 
+import net.shibboleth.shared.annotation.constraint.NotLive;
 import net.shibboleth.shared.annotation.constraint.Unmodifiable;
 import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.primitive.LoggerFactory;
@@ -38,19 +39,19 @@ import net.shibboleth.shared.primitive.LoggerFactory;
 public class OrganizationUIInfo {
     
     /** logger. */
-    private static final Logger LOG = LoggerFactory.getLogger(OrganizationUIInfo.class);
+    @Nonnull private static final Logger LOG = LoggerFactory.getLogger(OrganizationUIInfo.class);
     
     /** The Organization Names as a map from locale to actual value.*/ 
-    @Nonnull @Unmodifiable private final Map<Locale, String> organizationNames;
+    @Nonnull @Unmodifiable @NotLive private final Map<Locale, String> organizationNames;
     
     /** The Organization Display Names as a map from locale to actual value.*/ 
-    @Nonnull @Unmodifiable private final Map<Locale, String> displayNames;
+    @Nonnull @Unmodifiable @NotLive private final Map<Locale, String> displayNames;
        
     /** The Organization URLs as a map from locale to actual value.*/ 
-    @Nonnull @Unmodifiable private final Map<Locale, String> urls;
+    @Nonnull @Unmodifiable @NotLive private final Map<Locale, String> urls;
     
     /** Warning check against a non localized String. */
-    private final Predicate<LocalizedName> nullLanguageString = new Predicate<>() {
+    @Nonnull private final Predicate<LocalizedName> nullLanguageString = new Predicate<>() {
         public boolean test(final LocalizedName u) {
             if (u.getXMLLang() == null) {
                 LOG.warn("String with value {} in <{}> has no language associated, ignoring", u.getValue(),
@@ -66,7 +67,7 @@ public class OrganizationUIInfo {
     };
     
     /** Warning check against a non localized URL. */
-    private final Predicate<LocalizedURI> nullLanguageURL = new Predicate<>() {
+    @Nonnull private final Predicate<LocalizedURI> nullLanguageURL = new Predicate<>() {
         public boolean test(final LocalizedURI u) {
             if (u.getXMLLang() == null) {
                 LOG.warn("URL with value {} in <{}> has no language associated, ignoring", u.getURI(),
@@ -124,7 +125,7 @@ public class OrganizationUIInfo {
      * 
      * @return the display names
      */
-    @Nonnull @Unmodifiable public Map<Locale, String> getOrganizationNames() {
+    @Nonnull @Unmodifiable @NotLive public Map<Locale, String> getOrganizationNames() {
         return organizationNames; 
     }
     
@@ -133,7 +134,7 @@ public class OrganizationUIInfo {
      *
      * @return the descriptions names (if any)
      */
-    @Nonnull @Unmodifiable public Map<Locale, String> getOrganizationDisplayNames() {
+    @Nonnull @Unmodifiable @NotLive public Map<Locale, String> getOrganizationDisplayNames() {
         return displayNames;
     }
 
@@ -142,8 +143,8 @@ public class OrganizationUIInfo {
      *
      * @return the descriptions names (if any)
      */
-    @Nonnull @Unmodifiable public Map<Locale, String> getOrganizationUrls() {
+    @Nonnull @Unmodifiable @NotLive public Map<Locale, String> getOrganizationUrls() {
         return urls;
     }
 
-}
+}
\ No newline at end of file
diff --git a/shib-metadata-api/src/main/java/net/shibboleth/idp/saml/metadata/ScopesContainer.java b/shib-metadata-api/src/main/java/net/shibboleth/idp/saml/metadata/ScopesContainer.java
index 2c230e27..58288334 100644
--- a/shib-metadata-api/src/main/java/net/shibboleth/idp/saml/metadata/ScopesContainer.java
+++ b/shib-metadata-api/src/main/java/net/shibboleth/idp/saml/metadata/ScopesContainer.java
@@ -103,4 +103,5 @@ public class ScopesContainer {
         }
         return false;
     }
-}
+
+}
\ No newline at end of file
diff --git a/shib-metadata-api/src/main/java/net/shibboleth/idp/saml/metadata/package-info.java b/shib-metadata-api/src/main/java/net/shibboleth/idp/saml/metadata/package-info.java
index 67640fc9..5b2e4b15 100644
--- a/shib-metadata-api/src/main/java/net/shibboleth/idp/saml/metadata/package-info.java
+++ b/shib-metadata-api/src/main/java/net/shibboleth/idp/saml/metadata/package-info.java
@@ -18,7 +18,8 @@
 /**
  * This package contains such  public class definitions as are needed to 
  * bridge between the relying-party.xml schema and OpenSAML.
-
  */
+ at NonnullElements
+package net.shibboleth.idp.saml.metadata;
 
-package net.shibboleth.idp.saml.metadata;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/shib-metadata-api/src/main/java/net/shibboleth/idp/saml/security/KeyAuthoritySupport.java b/shib-metadata-api/src/main/java/net/shibboleth/idp/saml/security/KeyAuthoritySupport.java
index 2e4b880b..03138285 100644
--- a/shib-metadata-api/src/main/java/net/shibboleth/idp/saml/security/KeyAuthoritySupport.java
+++ b/shib-metadata-api/src/main/java/net/shibboleth/idp/saml/security/KeyAuthoritySupport.java
@@ -35,7 +35,9 @@ import org.opensaml.xmlsec.keyinfo.KeyInfoSupport;
 import org.opensaml.xmlsec.signature.KeyInfo;
 
 import net.shibboleth.idp.saml.xmlobject.KeyAuthority;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
+import net.shibboleth.shared.annotation.constraint.Live;
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
 import net.shibboleth.shared.logic.Constraint;
 
 
@@ -98,7 +100,7 @@ public final class KeyAuthoritySupport {
      * @return a collection of X509 certificates, possibly empty
      * @throws SecurityException thrown if the certificate information is represented in an unsupported format
      */
-    @Nonnull private static Collection<X509Certificate> getX509Certificates(@Nullable final KeyInfo keyInfo)
+    @Nonnull @Live private static Collection<X509Certificate> getX509Certificates(@Nullable final KeyInfo keyInfo)
             throws SecurityException {
         try {
             return KeyInfoSupport.getCertificates(keyInfo);
@@ -115,7 +117,7 @@ public final class KeyAuthoritySupport {
      * @return a collection of X509 CRL's, possibly empty
      * @throws SecurityException thrown if the CRL information is represented in an unsupported format
      */
-    @Nonnull private static Collection<X509CRL> getX509CRLs(@Nullable final KeyInfo keyInfo) throws SecurityException {
+    @Nonnull @Live private static Collection<X509CRL> getX509CRLs(@Nullable final KeyInfo keyInfo) throws SecurityException {
         try {
             return KeyInfoSupport.getCRLs(keyInfo);
         } catch (final CRLException e) {
@@ -130,10 +132,10 @@ public final class KeyAuthoritySupport {
     public static class KeyAuthorityPKIXValidationInformation implements PKIXValidationInformation {
 
         /** Certs used as the trust anchors. */
-        @Nullable @NonnullElements private final Collection<X509Certificate> trustAnchors;
+        @Nullable private final Collection<X509Certificate> trustAnchors;
 
         /** CRLs used during validation. */
-        @Nullable @NonnullElements private final Collection<X509CRL> trustedCRLs;
+        @Nullable private final Collection<X509CRL> trustedCRLs;
 
         /** Max verification depth during PKIX validation. */
         @Nonnull private final Integer verificationDepth;
@@ -151,30 +153,31 @@ public final class KeyAuthoritySupport {
             verificationDepth = Constraint.isNotNull(depth, "Verification depth cannot be null");
             
             if (anchors != null) {
-                trustAnchors = anchors.stream().filter(e -> e != null).collect(Collectors.toList());
+                trustAnchors = anchors.stream().filter(e -> e != null).collect(Collectors.toUnmodifiableList());
             } else {
                 trustAnchors = null;
             }
             
             if (crls != null) {
-                trustedCRLs = crls.stream().filter(e -> e != null).collect(Collectors.toList());
+                trustedCRLs = crls.stream().filter(e -> e != null).collect(Collectors.toUnmodifiableList());
             } else {
                 trustedCRLs = null;
             }
         }
 
         /** {@inheritDoc} */
-        @Nullable public Collection<X509CRL> getCRLs() {
+        @Nullable @Unmodifiable @NotLive public Collection<X509CRL> getCRLs() {
             return trustedCRLs;
         }
 
         /** {@inheritDoc} */
-        @Nullable public Collection<X509Certificate> getCertificates() {
+        @Nullable @Unmodifiable @NotLive  public Collection<X509Certificate> getCertificates() {
             return trustAnchors;
         }
 
         /** {@inheritDoc} */
         @Nonnull public Integer getVerificationDepth() {
+            // This is normally nullable but the schema for this element specifies the default to be 1.
             return verificationDepth;
         }
     }
diff --git a/shib-metadata-api/src/main/java/net/shibboleth/idp/saml/security/package-info.java b/shib-metadata-api/src/main/java/net/shibboleth/idp/saml/security/package-info.java
index b4062fd4..6954b272 100644
--- a/shib-metadata-api/src/main/java/net/shibboleth/idp/saml/security/package-info.java
+++ b/shib-metadata-api/src/main/java/net/shibboleth/idp/saml/security/package-info.java
@@ -18,4 +18,7 @@
 /**
  * Classes related to SAML security extensions.
  */
-package net.shibboleth.idp.saml.security;
\ No newline at end of file
+ at NonnullElements
+package net.shibboleth.idp.saml.security;
+
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/shib-metadata-api/src/main/java/net/shibboleth/idp/saml/xml/SAMLConstants.java b/shib-metadata-api/src/main/java/net/shibboleth/idp/saml/xml/SAMLConstants.java
index 28fad4d3..b03f65bb 100644
--- a/shib-metadata-api/src/main/java/net/shibboleth/idp/saml/xml/SAMLConstants.java
+++ b/shib-metadata-api/src/main/java/net/shibboleth/idp/saml/xml/SAMLConstants.java
@@ -33,7 +33,6 @@ public final class SAMLConstants {
     public static final String SAML1_ATTR_NAMESPACE_URI = "urn:mace:shibboleth:1.0:attributeNamespace:uri";
     
     /** Constructor. */
-    private SAMLConstants() {
-
-    }
+    private SAMLConstants() {}
+    
 }
\ No newline at end of file
diff --git a/shib-metadata-api/src/main/java/net/shibboleth/idp/saml/xml/package-info.java b/shib-metadata-api/src/main/java/net/shibboleth/idp/saml/xml/package-info.java
index 4d62771a..b8a35ef2 100644
--- a/shib-metadata-api/src/main/java/net/shibboleth/idp/saml/xml/package-info.java
+++ b/shib-metadata-api/src/main/java/net/shibboleth/idp/saml/xml/package-info.java
@@ -18,5 +18,7 @@
 /**
  * Shibboleth-specfic classes used with SAML messages.
  */
+ at NonnullElements
+package net.shibboleth.idp.saml.xml;
 
-package net.shibboleth.idp.saml.xml;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/shib-metadata-api/src/main/java/net/shibboleth/idp/saml/xmlobject/ExtensionsConstants.java b/shib-metadata-api/src/main/java/net/shibboleth/idp/saml/xmlobject/ExtensionsConstants.java
index d89928f9..f9ae6808 100644
--- a/shib-metadata-api/src/main/java/net/shibboleth/idp/saml/xmlobject/ExtensionsConstants.java
+++ b/shib-metadata-api/src/main/java/net/shibboleth/idp/saml/xmlobject/ExtensionsConstants.java
@@ -17,19 +17,23 @@
 
 package net.shibboleth.idp.saml.xmlobject;
 
+import javax.annotation.Nonnull;
+
+import net.shibboleth.shared.annotation.constraint.NotEmpty;
+
 /** Constants used in XMLObject extensions. */
 public final class ExtensionsConstants {
 
     /** Relative resource path for XML schema for Shibboleth extensions to SAML metadata. */
-    public static final String SHIB_MDEXT10_SCHEMA_LOCATION = "/schema/shibboleth-metadata-1.0.xsd";
+    @Nonnull @NotEmpty public static final String SHIB_MDEXT10_SCHEMA_LOCATION = "/schema/shibboleth-metadata-1.0.xsd";
     
     /** URI for XML schema namespace for Shibboleth extensions to SAML metadata. */
-    public static final String SHIB_MDEXT10_NS = "urn:mace:shibboleth:metadata:1.0";
+    @Nonnull @NotEmpty public static final String SHIB_MDEXT10_NS = "urn:mace:shibboleth:metadata:1.0";
 
     /** Namespace QName prefix for Shibboleth extensions to SAML metadata. */
-    public static final String SHIB_MDEXT10_PREFIX = "shibmd";
+    @Nonnull @NotEmpty public static final String SHIB_MDEXT10_PREFIX = "shibmd";
 
     /** Constructor. */
-    private ExtensionsConstants() {
-    }
+    private ExtensionsConstants() {}
+    
 }
\ No newline at end of file
diff --git a/shib-metadata-api/src/main/java/net/shibboleth/idp/saml/xmlobject/KeyAuthority.java b/shib-metadata-api/src/main/java/net/shibboleth/idp/saml/xmlobject/KeyAuthority.java
index d8db7385..3564ddf4 100644
--- a/shib-metadata-api/src/main/java/net/shibboleth/idp/saml/xmlobject/KeyAuthority.java
+++ b/shib-metadata-api/src/main/java/net/shibboleth/idp/saml/xmlobject/KeyAuthority.java
@@ -20,45 +20,47 @@ package net.shibboleth.idp.saml.xmlobject;
 import java.util.List;
 
 import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
 import javax.xml.namespace.QName;
 
 import org.opensaml.core.xml.AttributeExtensibleXMLObject;
 import org.opensaml.xmlsec.signature.KeyInfo;
 
+import net.shibboleth.shared.annotation.constraint.Live;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 
 /** XMLObject for the Shibboleth KeyAuthority metadata extension. */
 public interface KeyAuthority extends AttributeExtensibleXMLObject {
 
     /** Element local name. */
-    @Nonnull @NotEmpty public static final String DEFAULT_ELEMENT_LOCAL_NAME = "KeyAuthority";
+    @Nonnull @NotEmpty static final String DEFAULT_ELEMENT_LOCAL_NAME = "KeyAuthority";
 
     /** Default element name. */
-    @Nonnull public static final QName DEFAULT_ELEMENT_NAME = new QName(ExtensionsConstants.SHIB_MDEXT10_NS,
+    @Nonnull static final QName DEFAULT_ELEMENT_NAME = new QName(ExtensionsConstants.SHIB_MDEXT10_NS,
             DEFAULT_ELEMENT_LOCAL_NAME, ExtensionsConstants.SHIB_MDEXT10_PREFIX);
 
     /** VerifyDepth attribute name. */
-    @Nonnull @NotEmpty public static final String VERIFY_DEPTH_ATTRIB_NAME = "VerifyDepth";
+    @Nonnull @NotEmpty static final String VERIFY_DEPTH_ATTRIB_NAME = "VerifyDepth";
 
     /**
      * Get the list of KeyInfo child elements.
      * 
      * @return the list of KeyInfo child elements
      */
-    public List<KeyInfo> getKeyInfos();
+    @Nonnull @Live List<KeyInfo> getKeyInfos();
 
     /**
      * Get the VerifyDepth attribute value.
      * 
      * @return the VerifyDepth attribute value
      */
-    public Integer getVerifyDepth();
+    @Nullable Integer getVerifyDepth();
 
     /**
      * Set the VerifyDepth attribute value.
      * 
      * @param newVerifyDepth the new VerifyDepth attribute value
      */
-    public void setVerifyDepth(Integer newVerifyDepth);
+    void setVerifyDepth(@Nullable final Integer newVerifyDepth);
 
-}
+}
\ No newline at end of file
diff --git a/shib-metadata-api/src/main/java/net/shibboleth/idp/saml/xmlobject/Scope.java b/shib-metadata-api/src/main/java/net/shibboleth/idp/saml/xmlobject/Scope.java
index fca59c69..1957be93 100644
--- a/shib-metadata-api/src/main/java/net/shibboleth/idp/saml/xmlobject/Scope.java
+++ b/shib-metadata-api/src/main/java/net/shibboleth/idp/saml/xmlobject/Scope.java
@@ -18,6 +18,7 @@
 package net.shibboleth.idp.saml.xmlobject;
 
 import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
 import javax.xml.namespace.QName;
 
 import org.opensaml.core.xml.schema.XSBooleanValue;
@@ -29,41 +30,41 @@ import net.shibboleth.shared.annotation.constraint.NotEmpty;
 public interface Scope extends XSString {
 
     /** Element local name. */
-    @Nonnull @NotEmpty public static final String DEFAULT_ELEMENT_LOCAL_NAME = "Scope";
+    @Nonnull @NotEmpty static final String DEFAULT_ELEMENT_LOCAL_NAME = "Scope";
 
     /** Default element name. */
-    @Nonnull public static final QName DEFAULT_ELEMENT_NAME = new QName(ExtensionsConstants.SHIB_MDEXT10_NS,
+    @Nonnull static final QName DEFAULT_ELEMENT_NAME = new QName(ExtensionsConstants.SHIB_MDEXT10_NS,
             DEFAULT_ELEMENT_LOCAL_NAME, ExtensionsConstants.SHIB_MDEXT10_PREFIX);
 
     /** regexp attribute name. */
-    @Nonnull @NotEmpty public static final String REGEXP_ATTRIB_NAME = "regexp";
+    @Nonnull @NotEmpty static final String REGEXP_ATTRIB_NAME = "regexp";
 
     /**
      * Get the regexp attribute value.
      * 
      * @return the regexp attribute value
      */
-    public Boolean getRegexp();
+    @Nullable Boolean getRegexp();
 
     /**
      * Get the regexp attribute value.
      * 
      * @return the regexp attribute value
      */
-    public XSBooleanValue getRegexpXSBoolean();
+    @Nullable XSBooleanValue getRegexpXSBoolean();
 
     /**
      * Set the regexp attribute value.
      * 
      * @param newRegexp the new regexp attribute value
      */
-    public void setRegexp(Boolean newRegexp);
+    void setRegexp(@Nullable final Boolean newRegexp);
 
     /**
      * Set the regexp attribute value.
      * 
      * @param newRegexp the new regexp attribute value
      */
-    public void setRegexp(XSBooleanValue newRegexp);
+    void setRegexp(@Nullable final XSBooleanValue newRegexp);
 
 }
\ No newline at end of file
diff --git a/shib-metadata-api/src/main/java/net/shibboleth/idp/saml/xmlobject/ScopedValue.java b/shib-metadata-api/src/main/java/net/shibboleth/idp/saml/xmlobject/ScopedValue.java
index e364efb2..b8148663 100644
--- a/shib-metadata-api/src/main/java/net/shibboleth/idp/saml/xmlobject/ScopedValue.java
+++ b/shib-metadata-api/src/main/java/net/shibboleth/idp/saml/xmlobject/ScopedValue.java
@@ -18,6 +18,7 @@
 package net.shibboleth.idp.saml.xmlobject;
 
 import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
 import javax.xml.namespace.QName;
 
 import org.opensaml.saml.common.SAMLObject;
@@ -28,11 +29,11 @@ import net.shibboleth.shared.annotation.constraint.NotEmpty;
 public interface ScopedValue extends SAMLObject {
 
     /** Local name of the XSI type. */
-    @Nonnull @NotEmpty public static final String TYPE_LOCAL_NAME = "ScopedValue";
+    @Nonnull @NotEmpty static final String TYPE_LOCAL_NAME = "ScopedValue";
 
     /** QName of the XSI type. */
     // TODO fix these with constants when available
-    @Nonnull public static final QName TYPE_NAME =
+    @Nonnull static final QName TYPE_NAME =
             new QName("urn:mace:shibboleth:2.0:attribute:encoder", TYPE_LOCAL_NAME, "encoder");
 
     /**
@@ -40,40 +41,41 @@ public interface ScopedValue extends SAMLObject {
      * 
      * @return name of the scope attribute
      */
-    public String getScopeAttributeName();
+    @Nullable String getScopeAttributeName();
 
     /**
      * Sets the name of the scope attribute.
      * 
      * @param attribute name of the scope attribute
      */
-    public void setScopeAttributeName(String attribute);
+    void setScopeAttributeName(@Nullable final String attribute);
 
     /**
      * Gets the scope value.
      * 
      * @return scope value
      */
-    public String getScope();
+    @Nullable String getScope();
 
     /**
      * Sets the scope value.
      * 
      * @param scope scope value
      */
-    public void setScope(String scope);
+    void setScope(@Nullable final String scope);
 
     /**
-     * Set the attribute value.
+     * Get the attribute value.
      * 
-     * @param newContent the new attribute value
+     * @return the attribute value.
      */
-    public void setValue(String newContent);
+    @Nullable String getValue();
 
     /**
-     * Get the attribute value.
+     * Set the attribute value.
      * 
-     * @return the attribute value.
+     * @param newContent the new attribute value
      */
-    public String getValue();
+    void setValue(@Nullable final String newContent);
+    
 }
\ No newline at end of file
diff --git a/shib-metadata-api/src/main/java/net/shibboleth/idp/saml/xmlobject/package-info.java b/shib-metadata-api/src/main/java/net/shibboleth/idp/saml/xmlobject/package-info.java
index 1c5a6161..75565d54 100644
--- a/shib-metadata-api/src/main/java/net/shibboleth/idp/saml/xmlobject/package-info.java
+++ b/shib-metadata-api/src/main/java/net/shibboleth/idp/saml/xmlobject/package-info.java
@@ -15,6 +15,8 @@
  * limitations under the License.
  */
 
-/** OpenSAML XMLObject extensions. */
+/** Shibboleth Metadata XMLObject extensions. */
+ at NonnullElements
+package net.shibboleth.idp.saml.xmlobject;
 
-package net.shibboleth.idp.saml.xmlobject;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/shib-metadata-impl/src/main/java/net/shibboleth/idp/saml/metadata/impl/ByReferenceMetadataFilterBridge.java b/shib-metadata-impl/src/main/java/net/shibboleth/idp/saml/metadata/impl/ByReferenceMetadataFilterBridge.java
index ca844f7f..b6099229 100644
--- a/shib-metadata-impl/src/main/java/net/shibboleth/idp/saml/metadata/impl/ByReferenceMetadataFilterBridge.java
+++ b/shib-metadata-impl/src/main/java/net/shibboleth/idp/saml/metadata/impl/ByReferenceMetadataFilterBridge.java
@@ -61,7 +61,7 @@ public class ByReferenceMetadataFilterBridge implements MetadataFilter {
     }
     
     /** {@inheritDoc} */
-    public XMLObject filter(@Nullable final XMLObject metadata, @Nonnull final MetadataFilterContext context)
+    @Nullable public XMLObject filter(@Nullable final XMLObject metadata, @Nonnull final MetadataFilterContext context)
             throws FilterException {
 
         MetadataFilterChain chain = null;
diff --git a/shib-metadata-impl/src/main/java/net/shibboleth/idp/saml/metadata/impl/MetadataProviderContainer.java b/shib-metadata-impl/src/main/java/net/shibboleth/idp/saml/metadata/impl/MetadataProviderContainer.java
index 63b94cae..722a9010 100644
--- a/shib-metadata-impl/src/main/java/net/shibboleth/idp/saml/metadata/impl/MetadataProviderContainer.java
+++ b/shib-metadata-impl/src/main/java/net/shibboleth/idp/saml/metadata/impl/MetadataProviderContainer.java
@@ -103,7 +103,7 @@ public class MetadataProviderContainer extends AbstractServiceableComponent<Meta
     }
     
     /** {@inheritDoc} */
-    @Override public int compareTo(final MetadataProviderContainer other) {
+    public int compareTo(final MetadataProviderContainer other) {
         checkComponentActive();
         
         final int result = sortKey.compareTo(other.sortKey);
@@ -145,4 +145,5 @@ public class MetadataProviderContainer extends AbstractServiceableComponent<Meta
         assert result != null;
         return result;
     }
-}
+
+}
\ No newline at end of file
diff --git a/shib-metadata-impl/src/main/java/net/shibboleth/idp/saml/metadata/impl/MetadataResolverServiceGaugeSet.java b/shib-metadata-impl/src/main/java/net/shibboleth/idp/saml/metadata/impl/MetadataResolverServiceGaugeSet.java
index a477dafd..87db5194 100644
--- a/shib-metadata-impl/src/main/java/net/shibboleth/idp/saml/metadata/impl/MetadataResolverServiceGaugeSet.java
+++ b/shib-metadata-impl/src/main/java/net/shibboleth/idp/saml/metadata/impl/MetadataResolverServiceGaugeSet.java
@@ -38,8 +38,9 @@ import com.google.common.collect.ImmutableMap;
 import com.google.common.collect.ImmutableMap.Builder;
 
 import net.shibboleth.shared.annotation.ParameterName;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
 import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.component.ComponentInitializationException;
 import net.shibboleth.shared.primitive.LoggerFactory;
@@ -164,7 +165,7 @@ public class MetadataResolverServiceGaugeSet extends ReloadableServiceGaugeSet<M
      *
      * @return the error message string to report out
      */
-    private String extractErrorMessage(final Throwable t) {
+    @Nonnull private String extractErrorMessage(final Throwable t) {
         Throwable source = null;
 
         // These are often wrapping the real error, so use the cause as the source if available
@@ -200,7 +201,7 @@ public class MetadataResolverServiceGaugeSet extends ReloadableServiceGaugeSet<M
      * @param consume the thing which does checking and adding the building
      * @return an appropriate map
      */
-    private <T> Map<String,T> valueGetter(final BiConsumer<Builder<String,T>, MetadataResolver> consume) {
+    @Nonnull private <T> Map<String,T> valueGetter(@Nonnull final BiConsumer<Builder<String,T>, MetadataResolver> consume) {
         final Builder<String,T> mapBuilder = ImmutableMap.builder();
         try (final ServiceableComponent<?> component = getService().getServiceableComponent()) {
             // Check type - just in case
@@ -242,7 +243,7 @@ public class MetadataResolverServiceGaugeSet extends ReloadableServiceGaugeSet<M
      * @param parent - root of the chaining resolver tree.
      * @return - the list.
      */
-    @Nonnull private List<MetadataResolver> getAllChildren(final ChainingMetadataResolver parent) {
+    @Nonnull @Unmodifiable @NotLive private List<MetadataResolver> getAllChildren(final ChainingMetadataResolver parent) {
         final ArrayList<MetadataResolver> result = new ArrayList<>(1+ parent.getResolvers().size());
         // Add ourselves
         result.add(parent);
@@ -253,7 +254,7 @@ public class MetadataResolverServiceGaugeSet extends ReloadableServiceGaugeSet<M
                 result.add(child);
             }
         }
-        return result;
+        return CollectionSupport.copyToList(result);
     }
 
     /**
@@ -263,7 +264,7 @@ public class MetadataResolverServiceGaugeSet extends ReloadableServiceGaugeSet<M
      * 
      * @return resolvers to report on
      */
-    @Nonnull @NonnullElements private Iterable<MetadataResolver> getMetadataResolvers(
+    @Nonnull @Unmodifiable @NotLive private Iterable<MetadataResolver> getMetadataResolvers(
             @Nonnull final MetadataResolver rootResolver) {
         
         if (rootResolver instanceof ChainingMetadataResolver) {
diff --git a/shib-metadata-impl/src/main/java/net/shibboleth/idp/saml/metadata/impl/ReloadableMetadataResolver.java b/shib-metadata-impl/src/main/java/net/shibboleth/idp/saml/metadata/impl/ReloadableMetadataResolver.java
index e8309f0e..cd5cd99d 100644
--- a/shib-metadata-impl/src/main/java/net/shibboleth/idp/saml/metadata/impl/ReloadableMetadataResolver.java
+++ b/shib-metadata-impl/src/main/java/net/shibboleth/idp/saml/metadata/impl/ReloadableMetadataResolver.java
@@ -47,7 +47,7 @@ public class ReloadableMetadataResolver extends AbstractIdentifiableInitializabl
     @Nonnull private final Logger log = LoggerFactory.getLogger(ReloadableMetadataResolver.class);
 
     /** The service which managed the reloading. */
-    private final ReloadableService<MetadataResolver> service;
+    @Nonnull private final ReloadableService<MetadataResolver> service;
 
     /**
      * Constructor.
@@ -60,7 +60,7 @@ public class ReloadableMetadataResolver extends AbstractIdentifiableInitializabl
     }
 
     /** {@inheritDoc} */
-    @Override @Nonnull public Iterable<EntityDescriptor> resolve(@Nullable final CriteriaSet criteria) throws ResolverException {
+    @Nonnull public Iterable<EntityDescriptor> resolve(@Nullable final CriteriaSet criteria) throws ResolverException {
         checkComponentActive();
         try (final ServiceableComponent<MetadataResolver> component = service.getServiceableComponent()) {
             return component.getComponent().resolve(criteria);
@@ -75,7 +75,7 @@ public class ReloadableMetadataResolver extends AbstractIdentifiableInitializabl
     }
 
     /** {@inheritDoc} */
-    @Override @Nullable public EntityDescriptor resolveSingle(@Nullable final CriteriaSet criteria) throws ResolverException {
+    @Nullable public EntityDescriptor resolveSingle(@Nullable final CriteriaSet criteria) throws ResolverException {
         checkComponentActive();
         try (final ServiceableComponent<MetadataResolver> component = service.getServiceableComponent()) {
             return component.getComponent().resolveSingle(criteria);
@@ -89,7 +89,7 @@ public class ReloadableMetadataResolver extends AbstractIdentifiableInitializabl
     }
 
     /** {@inheritDoc} */
-    @Override public boolean isRequireValidMetadata() {
+    public boolean isRequireValidMetadata() {
         checkComponentActive();
         try (final ServiceableComponent<MetadataResolver> component = service.getServiceableComponent()) {
             return component.getComponent().isRequireValidMetadata();
@@ -101,12 +101,12 @@ public class ReloadableMetadataResolver extends AbstractIdentifiableInitializabl
     }
 
     /** {@inheritDoc} */
-    @Override public void setRequireValidMetadata(final boolean requireValidMetadata) {
+    public void setRequireValidMetadata(final boolean requireValidMetadata) {
         throw new IllegalAccessError("Cannot set RequireValidMetadata");
     }
 
     /** {@inheritDoc} */
-    @Override public MetadataFilter getMetadataFilter() {
+    @Nullable public MetadataFilter getMetadataFilter() {
         checkComponentActive();
         try (final ServiceableComponent<MetadataResolver> component = service.getServiceableComponent()) {
             return component.getComponent().getMetadataFilter();
@@ -118,7 +118,7 @@ public class ReloadableMetadataResolver extends AbstractIdentifiableInitializabl
     }
 
     /** {@inheritDoc} */
-    @Override public void setMetadataFilter(@Nullable final MetadataFilter newFilter) {
+    public void setMetadataFilter(@Nullable final MetadataFilter newFilter) {
         throw new UnsupportedOperationException("Cannot set Metadata filter");
     }
     
diff --git a/shib-metadata-impl/src/main/java/net/shibboleth/idp/saml/metadata/impl/ScopesNodeProcessor.java b/shib-metadata-impl/src/main/java/net/shibboleth/idp/saml/metadata/impl/ScopesNodeProcessor.java
index 0ab4336f..fdf15528 100644
--- a/shib-metadata-impl/src/main/java/net/shibboleth/idp/saml/metadata/impl/ScopesNodeProcessor.java
+++ b/shib-metadata-impl/src/main/java/net/shibboleth/idp/saml/metadata/impl/ScopesNodeProcessor.java
@@ -43,7 +43,7 @@ import net.shibboleth.idp.saml.xmlobject.Scope;
 public class ScopesNodeProcessor implements MetadataNodeProcessor {
   
     /** {@inheritDoc} */
-    @Override public void process(final @Nonnull XMLObject metadataNode) throws FilterException {
+    public void process(@Nonnull final XMLObject metadataNode) throws FilterException {
         
         final Extensions extensions;
         if (metadataNode instanceof EntityDescriptor) {
@@ -67,7 +67,8 @@ public class ScopesNodeProcessor implements MetadataNodeProcessor {
         final HashSet<String> regexScopes = new HashSet<>(scopes.size());
         for (final XMLObject object: scopes) {
             final Scope scope = (Scope) object;
-            if (scope.getRegexp() != null && scope.getRegexp().booleanValue()) {
+            final Boolean flag = scope.getRegexp();
+            if (flag != null && flag.booleanValue()) {
                 regexScopes.add(scope.getValue());
             } else {
                 nonRegexScopes.add(scope.getValue());
diff --git a/shib-metadata-impl/src/main/java/net/shibboleth/idp/saml/metadata/impl/UIInfoNodeProcessor.java b/shib-metadata-impl/src/main/java/net/shibboleth/idp/saml/metadata/impl/UIInfoNodeProcessor.java
index 1884edb0..a40c8be5 100644
--- a/shib-metadata-impl/src/main/java/net/shibboleth/idp/saml/metadata/impl/UIInfoNodeProcessor.java
+++ b/shib-metadata-impl/src/main/java/net/shibboleth/idp/saml/metadata/impl/UIInfoNodeProcessor.java
@@ -40,7 +40,7 @@ import net.shibboleth.idp.saml.metadata.OrganizationUIInfo;
 public class UIInfoNodeProcessor implements MetadataNodeProcessor {
   
     /** {@inheritDoc} */
-    @Override public void process(final @Nonnull XMLObject metadataNode) throws FilterException {
+    public void process(@Nonnull final XMLObject metadataNode) throws FilterException {
 
         if (metadataNode instanceof UIInfo) {
             metadataNode.getObjectMetadata().put(new IdPUIInfo((UIInfo) metadataNode));
diff --git a/shib-metadata-impl/src/main/java/net/shibboleth/idp/saml/metadata/impl/package-info.java b/shib-metadata-impl/src/main/java/net/shibboleth/idp/saml/metadata/impl/package-info.java
index 4f1edab3..84124fea 100644
--- a/shib-metadata-impl/src/main/java/net/shibboleth/idp/saml/metadata/impl/package-info.java
+++ b/shib-metadata-impl/src/main/java/net/shibboleth/idp/saml/metadata/impl/package-info.java
@@ -19,5 +19,7 @@
  * This package contains such class definitions as are needed to 
  * bridge between the relying-party.xml schema and OpenSAML.
  */
+ at NonnullElements
+package net.shibboleth.idp.saml.metadata.impl;
 
-package net.shibboleth.idp.saml.metadata.impl;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/shib-metadata-impl/src/main/java/net/shibboleth/idp/saml/security/impl/KeyAuthorityNodeProcessor.java b/shib-metadata-impl/src/main/java/net/shibboleth/idp/saml/security/impl/KeyAuthorityNodeProcessor.java
index d02f6649..8bbadedc 100644
--- a/shib-metadata-impl/src/main/java/net/shibboleth/idp/saml/security/impl/KeyAuthorityNodeProcessor.java
+++ b/shib-metadata-impl/src/main/java/net/shibboleth/idp/saml/security/impl/KeyAuthorityNodeProcessor.java
@@ -33,6 +33,8 @@ import org.slf4j.Logger;
 
 import net.shibboleth.idp.saml.security.KeyAuthoritySupport;
 import net.shibboleth.idp.saml.xmlobject.KeyAuthority;
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
 import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.primitive.LoggerFactory;
 
@@ -43,15 +45,14 @@ import net.shibboleth.shared.primitive.LoggerFactory;
 public class KeyAuthorityNodeProcessor implements MetadataNodeProcessor {
     
     /** Logger. */
-    private Logger log = LoggerFactory.getLogger(KeyAuthority.class);
+    @Nonnull private Logger log = LoggerFactory.getLogger(KeyAuthority.class);
 
     /** {@inheritDoc} */
-    @Override
-    public void process(final @Nonnull XMLObject metadataNode) throws FilterException {
-        if (metadataNode instanceof EntitiesDescriptor) {
-            handleEntitiesDescriptor((EntitiesDescriptor) metadataNode);
-        } else if (metadataNode instanceof EntityDescriptor) {
-            handleEntityDescriptor((EntityDescriptor) metadataNode);
+    public void process(@Nonnull final XMLObject metadataNode) throws FilterException {
+        if (metadataNode instanceof EntitiesDescriptor ed) {
+            handleEntitiesDescriptor(ed);
+        } else if (metadataNode instanceof EntityDescriptor ed) {
+            handleEntityDescriptor(ed);
         }
     }
 
@@ -62,7 +63,8 @@ public class KeyAuthorityNodeProcessor implements MetadataNodeProcessor {
      * 
      * @throws FilterException if there is a fatal error during processing
      */
-    protected void handleEntitiesDescriptor(final EntitiesDescriptor entitiesDescriptor) throws FilterException {
+    protected void handleEntitiesDescriptor(@Nonnull final EntitiesDescriptor entitiesDescriptor)
+            throws FilterException {
         log.debug("Processing EntitiesDescriptor with id '{}', name '{}'", 
                 entitiesDescriptor.getID(), entitiesDescriptor.getName());
         
@@ -96,7 +98,7 @@ public class KeyAuthorityNodeProcessor implements MetadataNodeProcessor {
      * 
      * @throws FilterException if there is a fatal error during processing
      */
-    protected void handleEntityDescriptor(final EntityDescriptor entityDescriptor) throws FilterException {
+    protected void handleEntityDescriptor(@Nonnull final EntityDescriptor entityDescriptor) throws FilterException {
         XMLObject currentParent = entityDescriptor.getParent();
         while (currentParent != null) {
             if (currentParent instanceof EntitiesDescriptor) {
@@ -115,13 +117,14 @@ public class KeyAuthorityNodeProcessor implements MetadataNodeProcessor {
      * @param entitiesDescriptor the entities descriptor to process.
      * @return list of XMLObjects
      */
-    @Nonnull protected List<XMLObject> getKeyAuthorities(@Nonnull final EntitiesDescriptor entitiesDescriptor) {
+    @Nonnull @Unmodifiable @NotLive protected List<XMLObject> getKeyAuthorities(
+            @Nonnull final EntitiesDescriptor entitiesDescriptor) {
         final Extensions extensions = entitiesDescriptor.getExtensions();
         if (extensions == null) {
             return CollectionSupport.emptyList();
         }
         
-        return extensions.getUnknownXMLObjects(KeyAuthority.DEFAULT_ELEMENT_NAME);
+        return CollectionSupport.copyToList(extensions.getUnknownXMLObjects(KeyAuthority.DEFAULT_ELEMENT_NAME));
     }
     
 }
\ No newline at end of file
diff --git a/shib-metadata-impl/src/main/java/net/shibboleth/idp/saml/security/impl/MetadataPKIXValidationInformationResolver.java b/shib-metadata-impl/src/main/java/net/shibboleth/idp/saml/security/impl/MetadataPKIXValidationInformationResolver.java
index ba4c4533..2601030a 100644
--- a/shib-metadata-impl/src/main/java/net/shibboleth/idp/saml/security/impl/MetadataPKIXValidationInformationResolver.java
+++ b/shib-metadata-impl/src/main/java/net/shibboleth/idp/saml/security/impl/MetadataPKIXValidationInformationResolver.java
@@ -50,6 +50,7 @@ import org.slf4j.Logger;
 import net.shibboleth.idp.saml.security.KeyAuthoritySupport;
 import net.shibboleth.idp.saml.xmlobject.KeyAuthority;
 import net.shibboleth.shared.annotation.ParameterName;
+import net.shibboleth.shared.annotation.constraint.Live;
 import net.shibboleth.shared.collection.LockableClassToInstanceMultiMap;
 import net.shibboleth.shared.component.AbstractInitializableComponent;
 import net.shibboleth.shared.logic.Constraint;
@@ -100,7 +101,8 @@ public class MetadataPKIXValidationInformationResolver extends AbstractInitializ
     }
 
     /** {@inheritDoc} */
-    @Override public PKIXValidationInformation resolveSingle(@Nullable final CriteriaSet criteriaSet) throws ResolverException {
+    @Nullable public PKIXValidationInformation resolveSingle(@Nullable final CriteriaSet criteriaSet)
+            throws ResolverException {
         final Iterator<PKIXValidationInformation> pkixInfoIter = resolve(criteriaSet).iterator();
         if (pkixInfoIter.hasNext()) {
             return pkixInfoIter.next();
@@ -109,7 +111,6 @@ public class MetadataPKIXValidationInformationResolver extends AbstractInitializ
     }
 
     /** {@inheritDoc} */
-    @Override
     @Nonnull public Iterable<PKIXValidationInformation> resolve(@Nullable final CriteriaSet criteriaSet)
             throws ResolverException {
         checkComponentActive();
@@ -121,11 +122,11 @@ public class MetadataPKIXValidationInformationResolver extends AbstractInitializ
         checkCriteriaRequirements(criteriaSet);
         
         final EntityIdCriterion entityIdCriterion = criteriaSet.get(EntityIdCriterion.class);
-        assert(entityIdCriterion != null);
+        assert entityIdCriterion != null;
         final String entityID = entityIdCriterion.getEntityId();
 
         final EntityRoleCriterion roleCriteria = criteriaSet.get(EntityRoleCriterion.class);
-        assert(roleCriteria != null);
+        assert roleCriteria != null;
         final QName role = roleCriteria.getRole();
 
         String protocol = null;
@@ -149,11 +150,11 @@ public class MetadataPKIXValidationInformationResolver extends AbstractInitializ
         checkCriteriaRequirements(criteriaSet);
 
         final EntityIdCriterion entityIdCriterion = criteriaSet.get(EntityIdCriterion.class);
-        assert(entityIdCriterion != null);
+        assert entityIdCriterion != null;
         final String entityID = entityIdCriterion.getEntityId();
 
         final EntityRoleCriterion roleCriteria = criteriaSet.get(EntityRoleCriterion.class);
-        assert(roleCriteria != null);
+        assert roleCriteria != null;
         final QName role = roleCriteria.getRole();
 
         String protocol = null;
@@ -215,19 +216,18 @@ public class MetadataPKIXValidationInformationResolver extends AbstractInitializ
      * @throws ResolverException thrown if the key, certificate, or CRL information is represented in an unsupported
      *             format
      */
-    @Nonnull protected Collection<PKIXValidationInformation> retrievePKIXInfoFromMetadata(final CriteriaSet criteriaSet,
-            final String entityID, final QName role, final String protocol) throws ResolverException {
+    @Nonnull protected Collection<PKIXValidationInformation> retrievePKIXInfoFromMetadata(
+            @Nullable final CriteriaSet criteriaSet, @Nonnull final String entityID, @Nonnull final QName role,
+            @Nullable final String protocol) throws ResolverException {
 
         log.debug("Attempting to retrieve PKIX validation info from resolver for entity: {}", entityID);
         // Use LinkedHashSet so we don't worry about duplicates, but keep predictable ordering (insertion order).
         final Collection<PKIXValidationInformation> accumulator = new LinkedHashSet<>();
 
         final Iterable<RoleDescriptor> roleDescriptors = getRoleDescriptors(criteriaSet, entityID, role, protocol);
-        if (roleDescriptors == null) {
-            return accumulator;
-        }
 
         for (final RoleDescriptor roleDescriptor : roleDescriptors) {
+            assert roleDescriptor != null;
             resolvePKIXInfo(accumulator, roleDescriptor);
         }
 
@@ -244,7 +244,7 @@ public class MetadataPKIXValidationInformationResolver extends AbstractInitializ
      * 
      */
     protected void resolvePKIXInfo(@Nonnull final Collection<PKIXValidationInformation> accumulator, 
-            final RoleDescriptor roleDescriptor) throws ResolverException {
+            @Nonnull final RoleDescriptor roleDescriptor) throws ResolverException {
 
         final XMLObject parent = roleDescriptor.getParent();
         if (parent instanceof EntityDescriptor) {
@@ -267,7 +267,6 @@ public class MetadataPKIXValidationInformationResolver extends AbstractInitializ
 
     }
 
-//CheckStyle: ReturnCount OFF
     /**
      * Retrieves validation information from the resolver extension element.
      * 
@@ -277,8 +276,7 @@ public class MetadataPKIXValidationInformationResolver extends AbstractInitializ
      *             format
      */
     protected void resolvePKIXInfo(@Nonnull final Collection<PKIXValidationInformation> accumulator,
-            @Nullable final Extensions extensions)
-            throws ResolverException {
+            @Nullable final Extensions extensions) throws ResolverException {
         
         if (extensions == null) {
             return;
@@ -294,9 +292,7 @@ public class MetadataPKIXValidationInformationResolver extends AbstractInitializ
             extractPKIXInfo(accumulator, (KeyAuthority) xmlObj);
         }
     }
-//CheckStyle: ReturnCount ON
 
-//CheckStyle: ReturnCount OFF
     /**
      * Retrieves validation information from the Shibboleth KeyAuthority resolver extension element.
      * 
@@ -355,9 +351,7 @@ public class MetadataPKIXValidationInformationResolver extends AbstractInitializ
         }
 
     }
-//CheckStyle: ReturnCount ON
 
-//CheckStyle: ReturnCount OFF
     /**
      * Retrieves trusted name information from the provided resolver.
      * 
@@ -372,16 +366,14 @@ public class MetadataPKIXValidationInformationResolver extends AbstractInitializ
      * @throws SecurityException thrown if there is an error extracting trusted name information
      * @throws ResolverException if we have an error getting the role descriptors
      */
-    protected Set<String> retrieveTrustedNamesFromMetadata(final CriteriaSet criteriaSet, final String entityID,
-            final QName role, final String protocol, final UsageType usage) throws ResolverException {
+    @Nonnull @Live protected Set<String> retrieveTrustedNamesFromMetadata(@Nullable final CriteriaSet criteriaSet,
+            @Nonnull final String entityID, @Nonnull final QName role, @Nullable final String protocol,
+            @Nonnull final UsageType usage) throws ResolverException {
 
         log.debug("Attempting to retrieve trusted names for PKIX validation from resolver for entity: {}", entityID);
         final Set<String> trustedNames = new HashSet<>();
 
         final Iterable<RoleDescriptor> roleDescriptors = getRoleDescriptors(criteriaSet, entityID, role, protocol);
-        if (roleDescriptors == null) {
-            return trustedNames;
-        }
 
         for (final RoleDescriptor roleDescriptor : roleDescriptors) {
             final List<KeyDescriptor> keyDescriptors = roleDescriptor.getKeyDescriptors();
@@ -391,8 +383,9 @@ public class MetadataPKIXValidationInformationResolver extends AbstractInitializ
                     mdUsage = UsageType.UNSPECIFIED;
                 }
                 if (matchUsage(mdUsage, usage)) {
-                    if (keyDescriptor.getKeyInfo() != null) {
-                        getTrustedNames(trustedNames, keyDescriptor.getKeyInfo());
+                    final KeyInfo keyInfo = keyDescriptor.getKeyInfo(); 
+                    if (keyInfo != null) {
+                        getTrustedNames(trustedNames, keyInfo);
                     }
                 }
             }
@@ -401,7 +394,6 @@ public class MetadataPKIXValidationInformationResolver extends AbstractInitializ
 
         return trustedNames;
     }
-//CheckStyle: ReturnCount ON
 
     /**
      * Extract trusted names from a KeyInfo element.
@@ -409,7 +401,7 @@ public class MetadataPKIXValidationInformationResolver extends AbstractInitializ
      * @param keyInfo the KeyInfo instance from which to extract trusted names
      * @param accumulator set of trusted names to return
      */
-    protected void getTrustedNames(final Set<String> accumulator, final KeyInfo keyInfo) {
+    protected void getTrustedNames(@Nonnull final Set<String> accumulator, @Nonnull final KeyInfo keyInfo) {
         // TODO return anything if there are things other than names in the KeyInfo ?
         accumulator.addAll(KeyInfoSupport.getKeyNames(keyInfo));
     }
@@ -421,7 +413,7 @@ public class MetadataPKIXValidationInformationResolver extends AbstractInitializ
      * @param criteriaUsage the value from specified criteria
      * @return true if the two usage specifiers match for purposes of resolving validation information, false otherwise
      */
-    protected boolean matchUsage(final UsageType metadataUsage, final UsageType criteriaUsage) {
+    protected boolean matchUsage(@Nonnull final UsageType metadataUsage, @Nonnull final UsageType criteriaUsage) {
         if (metadataUsage == UsageType.UNSPECIFIED || criteriaUsage == UsageType.UNSPECIFIED) {
             return true;
         }
@@ -438,8 +430,9 @@ public class MetadataPKIXValidationInformationResolver extends AbstractInitializ
      * @return a list of role descriptors matching the given parameters, or null
      * @throws ResolverException thrown if there is an error retrieving role descriptors from the resolver provider
      */
-    protected Iterable<RoleDescriptor> getRoleDescriptors(final CriteriaSet criteriaSet,
-            final String entityID, final QName role, final String protocol) throws ResolverException {
+    @Nonnull protected Iterable<RoleDescriptor> getRoleDescriptors(@Nullable final CriteriaSet criteriaSet,
+            @Nonnull final String entityID, @Nonnull final QName role, @Nullable final String protocol)
+                    throws ResolverException {
         try {
             if (log.isDebugEnabled()) {
                 log.debug("Retrieving role descriptor metadata for entity '{}' in role '{}' for protocol '{}'",
@@ -455,4 +448,4 @@ public class MetadataPKIXValidationInformationResolver extends AbstractInitializ
 
     }
 
-}
+}
\ No newline at end of file
diff --git a/shib-metadata-impl/src/main/java/net/shibboleth/idp/saml/security/impl/package-info.java b/shib-metadata-impl/src/main/java/net/shibboleth/idp/saml/security/impl/package-info.java
index a9e51065..b594b759 100644
--- a/shib-metadata-impl/src/main/java/net/shibboleth/idp/saml/security/impl/package-info.java
+++ b/shib-metadata-impl/src/main/java/net/shibboleth/idp/saml/security/impl/package-info.java
@@ -18,4 +18,7 @@
 /**
  * Implementation classes for SAML-specific security functionality.
  */
-package net.shibboleth.idp.saml.security.impl;
\ No newline at end of file
+ at NonnullElements
+package net.shibboleth.idp.saml.security.impl;
+
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/shib-metadata-impl/src/main/java/net/shibboleth/idp/saml/xmlobject/impl/KeyAuthorityMarshaller.java b/shib-metadata-impl/src/main/java/net/shibboleth/idp/saml/xmlobject/impl/KeyAuthorityMarshaller.java
index 042d0307..f7ac92f3 100644
--- a/shib-metadata-impl/src/main/java/net/shibboleth/idp/saml/xmlobject/impl/KeyAuthorityMarshaller.java
+++ b/shib-metadata-impl/src/main/java/net/shibboleth/idp/saml/xmlobject/impl/KeyAuthorityMarshaller.java
@@ -33,12 +33,13 @@ import net.shibboleth.idp.saml.xmlobject.KeyAuthority;
 public class KeyAuthorityMarshaller extends AbstractXMLObjectMarshaller {
 
     /** {@inheritDoc} */
-    protected void marshallAttributes(@Nonnull final XMLObject xmlObject, @Nonnull final Element domElement) throws MarshallingException {
+    protected void marshallAttributes(@Nonnull final XMLObject xmlObject, @Nonnull final Element domElement)
+            throws MarshallingException {
         final KeyAuthority keyAuthority = (KeyAuthority) xmlObject;
 
-        if (keyAuthority.getVerifyDepth() != null) {
-            domElement.setAttributeNS(null, KeyAuthority.VERIFY_DEPTH_ATTRIB_NAME, keyAuthority.getVerifyDepth()
-                    .toString());
+        final Integer i = keyAuthority.getVerifyDepth();
+        if (i != null) {
+            domElement.setAttributeNS(null, KeyAuthority.VERIFY_DEPTH_ATTRIB_NAME, i.toString());
         }
 
         XMLObjectSupport.marshallAttributeMap(keyAuthority.getUnknownAttributes(), domElement);
diff --git a/shib-metadata-impl/src/main/java/net/shibboleth/idp/saml/xmlobject/impl/KeyAuthorityUnmarshaller.java b/shib-metadata-impl/src/main/java/net/shibboleth/idp/saml/xmlobject/impl/KeyAuthorityUnmarshaller.java
index 1b9c195c..a8153933 100644
--- a/shib-metadata-impl/src/main/java/net/shibboleth/idp/saml/xmlobject/impl/KeyAuthorityUnmarshaller.java
+++ b/shib-metadata-impl/src/main/java/net/shibboleth/idp/saml/xmlobject/impl/KeyAuthorityUnmarshaller.java
@@ -37,7 +37,7 @@ import net.shibboleth.shared.xml.QNameSupport;
 public class KeyAuthorityUnmarshaller extends AbstractXMLObjectUnmarshaller {
 
     /** Logger. */
-    private final Logger log = LoggerFactory.getLogger(KeyAuthorityUnmarshaller.class);
+    @Nonnull private final Logger log = LoggerFactory.getLogger(KeyAuthorityUnmarshaller.class);
 
     /** {@inheritDoc} */
     protected void processAttribute(@Nonnull final XMLObject xmlObject, @Nonnull final Attr attribute)
diff --git a/shib-metadata-impl/src/main/java/net/shibboleth/idp/saml/xmlobject/impl/ScopeImpl.java b/shib-metadata-impl/src/main/java/net/shibboleth/idp/saml/xmlobject/impl/ScopeImpl.java
index 8817e646..da2b6489 100644
--- a/shib-metadata-impl/src/main/java/net/shibboleth/idp/saml/xmlobject/impl/ScopeImpl.java
+++ b/shib-metadata-impl/src/main/java/net/shibboleth/idp/saml/xmlobject/impl/ScopeImpl.java
@@ -28,6 +28,8 @@ import org.opensaml.core.xml.XMLObject;
 import org.opensaml.core.xml.schema.XSBooleanValue;
 
 import net.shibboleth.idp.saml.xmlobject.Scope;
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
 
 /** Implementation of {@link Scope}. */
 @NotThreadSafe
@@ -52,7 +54,6 @@ public class ScopeImpl extends AbstractXMLObject implements Scope {
     }
 
     /** {@inheritDoc} */
-    @Override
     @Nullable public Boolean getRegexp() {
         if (regexp != null) {
             return regexp.getValue();
@@ -62,7 +63,7 @@ public class ScopeImpl extends AbstractXMLObject implements Scope {
     }
 
     /** {@inheritDoc} */
-    @Override public void setRegexp(final Boolean newRegexp) {
+    public void setRegexp(@Nullable final Boolean newRegexp) {
         if (newRegexp != null) {
             regexp = prepareForAssignment(regexp, new XSBooleanValue(newRegexp, false));
         } else {
@@ -71,29 +72,28 @@ public class ScopeImpl extends AbstractXMLObject implements Scope {
     }
 
     /** {@inheritDoc} */
-    @Override
     @Nullable public XSBooleanValue getRegexpXSBoolean() {
         return regexp;
     }
 
     /** {@inheritDoc} */
-    @Override public void setRegexp(@Nullable final XSBooleanValue newRegexp) {
+    public void setRegexp(@Nullable final XSBooleanValue newRegexp) {
         regexp = prepareForAssignment(regexp, newRegexp);
     }
 
     /** {@inheritDoc} */
-    @Override
     @Nullable public String getValue() {
         return scopeValue;
     }
 
     /** {@inheritDoc} */
-    @Override public void setValue(@Nullable final String newScopeValue) {
+    public void setValue(@Nullable final String newScopeValue) {
         scopeValue = prepareForAssignment(scopeValue, newScopeValue);
     }
     
     /** {@inheritDoc} */
-    @Override public List<XMLObject> getOrderedChildren() {
+    @Override @Nullable @Unmodifiable @NotLive public List<XMLObject> getOrderedChildren() {
         return null;
     }
+    
 }
\ No newline at end of file
diff --git a/shib-metadata-impl/src/main/java/net/shibboleth/idp/saml/xmlobject/impl/ScopeMarshaller.java b/shib-metadata-impl/src/main/java/net/shibboleth/idp/saml/xmlobject/impl/ScopeMarshaller.java
index 5c0fcace..0303ec5f 100644
--- a/shib-metadata-impl/src/main/java/net/shibboleth/idp/saml/xmlobject/impl/ScopeMarshaller.java
+++ b/shib-metadata-impl/src/main/java/net/shibboleth/idp/saml/xmlobject/impl/ScopeMarshaller.java
@@ -26,6 +26,7 @@ import net.shibboleth.shared.xml.ElementSupport;
 import org.opensaml.core.xml.XMLObject;
 import org.opensaml.core.xml.io.AbstractXMLObjectMarshaller;
 import org.opensaml.core.xml.io.MarshallingException;
+import org.opensaml.core.xml.schema.XSBooleanValue;
 import org.w3c.dom.Element;
 
 /** Marshaller for {@link Scope}. */
@@ -37,8 +38,9 @@ public class ScopeMarshaller extends AbstractXMLObjectMarshaller {
             throws MarshallingException {
         final Scope scope = (Scope) xmlObject;
 
-        if (scope.getRegexpXSBoolean() != null) {
-            domElement.setAttributeNS(null, Scope.REGEXP_ATTRIB_NAME, scope.getRegexpXSBoolean().toString());
+        final XSBooleanValue flag = scope.getRegexpXSBoolean();
+        if (flag != null) {
+            domElement.setAttributeNS(null, Scope.REGEXP_ATTRIB_NAME, flag.toString());
         }
 
     }
@@ -50,4 +52,5 @@ public class ScopeMarshaller extends AbstractXMLObjectMarshaller {
 
         ElementSupport.appendTextContent(domElement, shibMDScope.getValue());
     }
+
 }
\ No newline at end of file
diff --git a/shib-metadata-impl/src/main/java/net/shibboleth/idp/saml/xmlobject/impl/ScopeUnmarshaller.java b/shib-metadata-impl/src/main/java/net/shibboleth/idp/saml/xmlobject/impl/ScopeUnmarshaller.java
index c481b04f..c232338f 100644
--- a/shib-metadata-impl/src/main/java/net/shibboleth/idp/saml/xmlobject/impl/ScopeUnmarshaller.java
+++ b/shib-metadata-impl/src/main/java/net/shibboleth/idp/saml/xmlobject/impl/ScopeUnmarshaller.java
@@ -37,7 +37,8 @@ public class ScopeUnmarshaller extends AbstractXMLObjectUnmarshaller {
     private final Logger log = LoggerFactory.getLogger(ScopeUnmarshaller.class);
 
     /** {@inheritDoc} */
-    protected void processAttribute(final @Nonnull XMLObject xmlObject, final @Nonnull Attr attribute) throws UnmarshallingException {
+    protected void processAttribute(final @Nonnull XMLObject xmlObject, final @Nonnull Attr attribute)
+            throws UnmarshallingException {
         final Scope scope = (Scope) xmlObject;
 
         if (attribute.getLocalName().equals(Scope.REGEXP_ATTRIB_NAME)) {
@@ -53,4 +54,5 @@ public class ScopeUnmarshaller extends AbstractXMLObjectUnmarshaller {
         final Scope scope = (Scope) xmlObject;
         scope.setValue(elementContent);
     }
+
 }
\ No newline at end of file
diff --git a/shib-metadata-impl/src/main/java/net/shibboleth/idp/saml/xmlobject/impl/ScopedValueImpl.java b/shib-metadata-impl/src/main/java/net/shibboleth/idp/saml/xmlobject/impl/ScopedValueImpl.java
index 38f93c04..dc9dc1f4 100644
--- a/shib-metadata-impl/src/main/java/net/shibboleth/idp/saml/xmlobject/impl/ScopedValueImpl.java
+++ b/shib-metadata-impl/src/main/java/net/shibboleth/idp/saml/xmlobject/impl/ScopedValueImpl.java
@@ -31,10 +31,10 @@ import org.opensaml.core.xml.schema.impl.XSAnyImpl;
 public class ScopedValueImpl extends XSAnyImpl implements ScopedValue {
 
     /** Scope of this string element. */
-    private String scope;
+    @Nullable private String scope;
 
     /** Scope attribute name for this element. */
-    private String scopeAttributeName;
+    @Nullable private String scopeAttributeName;
 
     /**
      * Constructor.
@@ -49,17 +49,17 @@ public class ScopedValueImpl extends XSAnyImpl implements ScopedValue {
     }
 
     /** {@inheritDoc} */
-    public String getScope() {
+    @Nullable public String getScope() {
         return scope;
     }
 
     /** {@inheritDoc} */
-    public String getScopeAttributeName() {
+    @Nullable public String getScopeAttributeName() {
         return scopeAttributeName;
     }
 
     /** {@inheritDoc} */
-    public void setScope(final String newScope) {
+    public void setScope(@Nullable final String newScope) {
         scope = prepareForAssignment(scope, newScope);
         if (scope != null && scopeAttributeName != null) {
             getUnknownAttributes().put(new QName(scopeAttributeName), scope);
@@ -67,7 +67,7 @@ public class ScopedValueImpl extends XSAnyImpl implements ScopedValue {
     }
 
     /** {@inheritDoc} */
-    public void setScopeAttributeName(final String newScopeAttributeName) {
+    public void setScopeAttributeName(@Nullable final String newScopeAttributeName) {
         if (scopeAttributeName != null) {
             final QName oldName = new QName(scopeAttributeName);
             if (getUnknownAttributes().containsKey(oldName)) {
@@ -83,12 +83,13 @@ public class ScopedValueImpl extends XSAnyImpl implements ScopedValue {
     }
 
     /** {@inheritDoc} */
-    public String getValue() {
+    @Nullable public String getValue() {
         return getTextContent();
     }
 
     /** {@inheritDoc} */
-    public void setValue(final String newValue) {
+    public void setValue(@Nullable final String newValue) {
         setTextContent(newValue);
     }
+
 }
\ No newline at end of file
diff --git a/shib-metadata-impl/src/main/java/net/shibboleth/idp/saml/xmlobject/impl/package-info.java b/shib-metadata-impl/src/main/java/net/shibboleth/idp/saml/xmlobject/impl/package-info.java
index eb87d4c5..1e3e0abc 100644
--- a/shib-metadata-impl/src/main/java/net/shibboleth/idp/saml/xmlobject/impl/package-info.java
+++ b/shib-metadata-impl/src/main/java/net/shibboleth/idp/saml/xmlobject/impl/package-info.java
@@ -16,5 +16,7 @@
  */
 
 /** Implementations of the SAML XMLObject extensions. */
+ at NonnullElements
+package net.shibboleth.idp.saml.xmlobject.impl;
 
-package net.shibboleth.idp.saml.xmlobject.impl;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/shib-metadata-impl/src/test/java/net/shibboleth/idp/saml/security/impl/MetadataPKIXValidationInformationResolverTest.java b/shib-metadata-impl/src/test/java/net/shibboleth/idp/saml/security/impl/MetadataPKIXValidationInformationResolverTest.java
index de168587..e4c2b026 100644
--- a/shib-metadata-impl/src/test/java/net/shibboleth/idp/saml/security/impl/MetadataPKIXValidationInformationResolverTest.java
+++ b/shib-metadata-impl/src/test/java/net/shibboleth/idp/saml/security/impl/MetadataPKIXValidationInformationResolverTest.java
@@ -59,6 +59,7 @@ import net.shibboleth.shared.xml.XMLParserException;
 /**
  * Testing the Shibboleth metadata PKIX validation information resolver.
  */
+ at SuppressWarnings("javadoc")
 public class MetadataPKIXValidationInformationResolverTest extends XMLObjectBaseTestCase {
     
     @Nonnull @NotEmpty private String protocolBlue = "PROTOCOL_BLUE";
diff --git a/shib-metadata-impl/src/test/java/net/shibboleth/idp/saml/xmlobject/impl/ScopeTest.java b/shib-metadata-impl/src/test/java/net/shibboleth/idp/saml/xmlobject/impl/ScopeTest.java
index d307368c..42b961a0 100644
--- a/shib-metadata-impl/src/test/java/net/shibboleth/idp/saml/xmlobject/impl/ScopeTest.java
+++ b/shib-metadata-impl/src/test/java/net/shibboleth/idp/saml/xmlobject/impl/ScopeTest.java
@@ -101,18 +101,19 @@ public class ScopeTest extends XMLObjectProviderBaseTestCase {
         // regexp attribute
         scope.setRegexp(Boolean.TRUE);
         Assert.assertEquals(scope.getRegexp(), Boolean.TRUE, "Unexpected value for boolean attribute found");
-        Assert.assertNotNull(scope.getRegexpXSBoolean(), "XSBooleanValue was null");
-        Assert.assertEquals(scope.getRegexpXSBoolean(), new XSBooleanValue(Boolean.TRUE, false), 
+        XSBooleanValue flag = scope.getRegexpXSBoolean();
+        assert flag != null;
+        Assert.assertEquals(flag, new XSBooleanValue(Boolean.TRUE, false), 
                 "XSBooleanValue was unexpected value");
-        Assert.assertEquals(scope.getRegexpXSBoolean().toString(), "true", "XSBooleanValue string was unexpected value");
+        Assert.assertEquals(flag.toString(), "true", "XSBooleanValue string was unexpected value");
 
         scope.setRegexp(Boolean.FALSE);
+        flag = scope.getRegexpXSBoolean();
         Assert.assertEquals(scope.getRegexp(), Boolean.FALSE, "Unexpected value for boolean attribute found");
-        Assert.assertNotNull(scope.getRegexpXSBoolean(), "XSBooleanValue was null");
-        Assert.assertEquals(scope.getRegexpXSBoolean(), new XSBooleanValue(Boolean.FALSE, false), 
+        assert flag != null;
+        Assert.assertEquals(flag, new XSBooleanValue(Boolean.FALSE, false), 
                 "XSBooleanValue was unexpected value");
-        Assert.assertEquals(scope.getRegexpXSBoolean().toString(), "false",
-                "XSBooleanValue string was unexpected value");
+        Assert.assertEquals(flag.toString(), "false", "XSBooleanValue string was unexpected value");
 
         scope.setRegexp((Boolean) null);
         Assert.assertEquals(scope.getRegexp(), Boolean.FALSE, "Unexpected default value for boolean attribute found");
diff --git a/shib-metadata-spring/src/main/java/net/shibboleth/spring/http/HTTPResourceFactoryBean.java b/shib-metadata-spring/src/main/java/net/shibboleth/spring/http/HTTPResourceFactoryBean.java
index 18c3771e..44c6226d 100644
--- a/shib-metadata-spring/src/main/java/net/shibboleth/spring/http/HTTPResourceFactoryBean.java
+++ b/shib-metadata-spring/src/main/java/net/shibboleth/spring/http/HTTPResourceFactoryBean.java
@@ -51,8 +51,9 @@ import org.springframework.beans.factory.BeanCreationException;
 import org.springframework.beans.factory.config.AbstractFactoryBean;
 import org.springframework.core.io.Resource;
 
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
 import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.httpclient.HttpClientContextHandler;
 import net.shibboleth.shared.primitive.LoggerFactory;
@@ -83,10 +84,10 @@ public class HTTPResourceFactoryBean extends AbstractFactoryBean<HTTPResource> {
     @Nullable private HttpClientContextHandler httpClientContextHandler;
     
     /** The resources to be turned into keys. */
-    @Nonnull @NonnullElements private List<Resource> keyResources;
+    @Nonnull private List<Resource> keyResources;
 
     /** The resources to be turned into certificates. */
-    @Nonnull @NonnullElements private List<Resource> certificateResources;
+    @Nonnull private List<Resource> certificateResources;
     
     /** Use a PKIX trust engine. */
     private boolean usePKIX;
@@ -178,7 +179,7 @@ public class HTTPResourceFactoryBean extends AbstractFactoryBean<HTTPResource> {
      * 
      * @return the certificates null
      */
-    @Nonnull @NonnullElements protected List<Credential> getCredentials() {
+    @Nonnull @Unmodifiable @NotLive protected List<Credential> getCredentials() {
         
         final List<Credential> credentials = new ArrayList<>(keyResources.size() + certificateResources.size());
 
@@ -207,7 +208,7 @@ public class HTTPResourceFactoryBean extends AbstractFactoryBean<HTTPResource> {
             }
         }
 
-        return credentials;
+        return CollectionSupport.copyToList(credentials);
     }
     
     /**
@@ -215,7 +216,7 @@ public class HTTPResourceFactoryBean extends AbstractFactoryBean<HTTPResource> {
      * 
      * @return the certificates
      */
-    @Nullable @NonnullElements protected List<X509Certificate> getCertificates() {
+    @Nonnull @Unmodifiable @NotLive protected List<X509Certificate> getCertificates() {
         
         final List<X509Certificate> certificates = new ArrayList<>(certificateResources.size());
         for (final Resource f : certificateResources) {
@@ -226,7 +227,7 @@ public class HTTPResourceFactoryBean extends AbstractFactoryBean<HTTPResource> {
                 throw new FatalBeanException("Could not decode provided CertificateFile " + f.getDescription(), e);
             }
         }
-        return certificates;
+        return CollectionSupport.copyToList(certificates);
     }
 
     /** {@inheritDoc} */
diff --git a/shib-metadata-spring/src/main/java/net/shibboleth/spring/http/package-info.java b/shib-metadata-spring/src/main/java/net/shibboleth/spring/http/package-info.java
index ce0a93a6..5ada69cd 100644
--- a/shib-metadata-spring/src/main/java/net/shibboleth/spring/http/package-info.java
+++ b/shib-metadata-spring/src/main/java/net/shibboleth/spring/http/package-info.java
@@ -18,5 +18,7 @@
 /**
  * HTTP client Spring support.
  */
+ at NonnullElements
+package net.shibboleth.spring.http;
 
-package net.shibboleth.spring.http;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/AbstractDynamicHTTPMetadataProviderParser.java b/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/AbstractDynamicHTTPMetadataProviderParser.java
index 81d78a08..520d6b51 100644
--- a/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/AbstractDynamicHTTPMetadataProviderParser.java
+++ b/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/AbstractDynamicHTTPMetadataProviderParser.java
@@ -124,8 +124,8 @@ public abstract class AbstractDynamicHTTPMetadataProviderParser extends Abstract
      * 
      * Either httpClientSecurityParametersRef or httpClientSecurityParameters can be present, not both.
      */
-    private BeanDefinition buildHttpClient(@Nonnull final Element element, @Nonnull final ParserContext parserContext,
-            @Nullable final String httpClientSecurityParametersRef,
+    @Nonnull private BeanDefinition buildHttpClient(@Nonnull final Element element,
+            @Nonnull final ParserContext parserContext, @Nullable final String httpClientSecurityParametersRef,
             @Nullable final BeanDefinition httpClientSecurityParameters) {
 
         final BeanDefinitionBuilder clientBuilder = 
diff --git a/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/AbstractMetadataProviderParser.java b/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/AbstractMetadataProviderParser.java
index 35bfeccb..a4d83e53 100644
--- a/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/AbstractMetadataProviderParser.java
+++ b/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/AbstractMetadataProviderParser.java
@@ -126,7 +126,7 @@ public abstract class AbstractMetadataProviderParser extends AbstractCustomBeanD
      *         {@code null} if none
      * @see #getBeanClassName
      */
-    @Nonnull protected abstract Class<? extends MetadataResolver> getNativeBeanClass(Element element);
+    @Nonnull protected abstract Class<? extends MetadataResolver> getNativeBeanClass(@Nonnull final Element element);
 
     /** {@inheritDoc} */
     @Override protected final Class<?> getBeanClass(@Nonnull final Element element) {
diff --git a/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/ByReferenceFilterBeanPostProcessor.java b/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/ByReferenceFilterBeanPostProcessor.java
index 1e6c15f0..663e5077 100644
--- a/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/ByReferenceFilterBeanPostProcessor.java
+++ b/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/ByReferenceFilterBeanPostProcessor.java
@@ -72,7 +72,8 @@ public class ByReferenceFilterBeanPostProcessor implements BeanPostProcessor, Ap
     }
 
     /** {@inheritDoc} */
-    @Override public Object postProcessBeforeInitialization(final @Nonnull Object bean, final @Nonnull String beanName) {
+    @Override
+    @Nonnull public Object postProcessBeforeInitialization(@Nonnull final Object bean, @Nonnull final String beanName) {
         
         // Do not attach to beans which just include other ones.
         if (!enabled || !(bean instanceof MetadataResolver) || bean instanceof ChainingMetadataResolver) {
@@ -110,7 +111,8 @@ public class ByReferenceFilterBeanPostProcessor implements BeanPostProcessor, Ap
     }
 
     /** {@inheritDoc} */
-    @Override public Object postProcessAfterInitialization(final @Nonnull Object bean, final @Nonnull String beanName) {
+    @Override
+    @Nonnull public Object postProcessAfterInitialization(@Nonnull final Object bean, @Nonnull final String beanName) {
         return bean;
     }
 
diff --git a/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/ChainingMetadataProviderParser.java b/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/ChainingMetadataProviderParser.java
index dcbe8de6..6d33cc91 100644
--- a/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/ChainingMetadataProviderParser.java
+++ b/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/ChainingMetadataProviderParser.java
@@ -37,7 +37,7 @@ public class ChainingMetadataProviderParser extends AbstractMetadataProviderPars
 
     /** {@inheritDoc} */
     @Override
-    @Nonnull protected Class<ChainingMetadataResolver> getNativeBeanClass(final Element element) {
+    @Nonnull protected Class<ChainingMetadataResolver> getNativeBeanClass(@Nonnull final Element element) {
         return ChainingMetadataResolver.class;
     }
 
diff --git a/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/DynamicHTTPMetadataProviderParser.java b/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/DynamicHTTPMetadataProviderParser.java
index df237ee7..abfbcba3 100644
--- a/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/DynamicHTTPMetadataProviderParser.java
+++ b/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/DynamicHTTPMetadataProviderParser.java
@@ -61,7 +61,7 @@ public class DynamicHTTPMetadataProviderParser extends AbstractDynamicHTTPMetada
 
     /** {@inheritDoc} */
     @Override
-    @Nonnull protected Class<? extends MetadataResolver> getNativeBeanClass(final Element element) {
+    @Nonnull protected Class<? extends MetadataResolver> getNativeBeanClass(@Nonnull final Element element) {
         return FunctionDrivenDynamicHTTPMetadataResolver.class;
     }
 
@@ -163,7 +163,7 @@ public class DynamicHTTPMetadataProviderParser extends AbstractDynamicHTTPMetada
      * 
      * @return the encoding style as a string
      */
-    private String parseTemplateEncodingStyle(@Nonnull final Element template) {
+    @Nonnull private String parseTemplateEncodingStyle(@Nonnull final Element template) {
         String encodingStyle = null;
         if (template.hasAttributeNS(null, "encodingStyle")) {
             encodingStyle = StringSupport.trimOrNull(template.getAttributeNS(null, "encodingStyle"));
diff --git a/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/FileBackedHTTPMetadataProviderParser.java b/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/FileBackedHTTPMetadataProviderParser.java
index a1aee64a..d24b967d 100644
--- a/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/FileBackedHTTPMetadataProviderParser.java
+++ b/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/FileBackedHTTPMetadataProviderParser.java
@@ -39,7 +39,7 @@ public class FileBackedHTTPMetadataProviderParser extends HTTPMetadataProviderPa
 
     /** {@inheritDoc} */
     @Override
-    @Nonnull protected Class<FileBackedHTTPMetadataResolver> getNativeBeanClass(final Element element) {
+    @Nonnull protected Class<FileBackedHTTPMetadataResolver> getNativeBeanClass(@Nonnull final Element element) {
         return FileBackedHTTPMetadataResolver.class;
     }
 
@@ -60,4 +60,5 @@ public class FileBackedHTTPMetadataProviderParser extends HTTPMetadataProviderPa
                     StringSupport.trimOrNull(element.getAttributeNS(null, "backupFileInitNextRefreshDelay")));
         }
     }
-}
+
+}
\ No newline at end of file
diff --git a/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/FilesystemMetadataProviderParser.java b/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/FilesystemMetadataProviderParser.java
index 20df9afa..7c285f5a 100644
--- a/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/FilesystemMetadataProviderParser.java
+++ b/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/FilesystemMetadataProviderParser.java
@@ -38,7 +38,7 @@ public class FilesystemMetadataProviderParser extends AbstractReloadingMetadataP
 
     /** {@inheritDoc} */
     @Override
-    @Nonnull protected Class<FilesystemMetadataResolver> getNativeBeanClass(final Element element) {
+    @Nonnull protected Class<FilesystemMetadataResolver> getNativeBeanClass(@Nonnull final Element element) {
         return FilesystemMetadataResolver.class;
     }
 
diff --git a/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/HTTPMetadataProvidersParserSupport.java b/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/HTTPMetadataProvidersParserSupport.java
index 48ccdce0..74c8fe2d 100644
--- a/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/HTTPMetadataProvidersParserSupport.java
+++ b/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/HTTPMetadataProvidersParserSupport.java
@@ -67,7 +67,7 @@ public final class HTTPMetadataProvidersParserSupport {
      * 
      * Either httpClientSecurityParametersRef or httpClientSecurityParameters can be present, not both.
      */
-    protected static BeanDefinition buildTLSSocketFactory(
+    @Nonnull protected static BeanDefinition buildTLSSocketFactory(
             @Nonnull final Element element, @Nonnull final ParserContext parserContext,
             @Nullable final String httpClientSecurityParametersRef,
             @Nullable final BeanDefinition httpClientSecurityParameters) {
diff --git a/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/InlineMetadataProviderParser.java b/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/InlineMetadataProviderParser.java
index c0be63ac..de099cde 100644
--- a/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/InlineMetadataProviderParser.java
+++ b/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/InlineMetadataProviderParser.java
@@ -41,7 +41,7 @@ public class InlineMetadataProviderParser extends AbstractMetadataProviderParser
 
     /** {@inheritDoc} */
     @Override
-    @Nonnull protected Class<DOMMetadataResolver> getNativeBeanClass(final Element element) {
+    @Nonnull protected Class<DOMMetadataResolver> getNativeBeanClass(@Nonnull final Element element) {
         return DOMMetadataResolver.class;
     }
 
diff --git a/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/LocalDynamicMetadataProviderParser.java b/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/LocalDynamicMetadataProviderParser.java
index 7b65628e..b2af212f 100644
--- a/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/LocalDynamicMetadataProviderParser.java
+++ b/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/LocalDynamicMetadataProviderParser.java
@@ -18,6 +18,7 @@
 package net.shibboleth.spring.metadata;
 
 import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
 import javax.xml.namespace.QName;
 
 import org.opensaml.core.xml.persist.FilesystemLoadSaveManager;
@@ -53,7 +54,7 @@ public class LocalDynamicMetadataProviderParser extends AbstractDynamicMetadataP
     
     /** {@inheritDoc} */
     @Override
-    @Nonnull protected Class<? extends MetadataResolver> getNativeBeanClass(final Element element) {
+    @Nonnull protected Class<? extends MetadataResolver> getNativeBeanClass(@Nonnull final Element element) {
         return LocalDynamicMetadataResolver.class;
     }
     
@@ -131,7 +132,7 @@ public class LocalDynamicMetadataProviderParser extends AbstractDynamicMetadataP
      *
      * @return the bean definition for the filesystem source manager
      */
-    private BeanDefinition buildFilesystemManagerDefinition(@Nonnull final Element element,
+    @Nonnull private BeanDefinition buildFilesystemManagerDefinition(@Nonnull final Element element,
             @Nonnull final ParserContext parserContext, final boolean isDefaultSourceKeyGenerator) {
 
         final BeanDefinitionBuilder sourceManagerBuilder =
@@ -190,8 +191,8 @@ public class LocalDynamicMetadataProviderParser extends AbstractDynamicMetadataP
      * @param parserContext the current parser context
      * @return the strategy bean definition, or null if not configured
      */
-    private BeanDefinition checkAndBuildPassthroughIntermediateDirectoryStrategy(@Nonnull final Element element,
-            @Nonnull final ParserContext parserContext) {
+    @Nullable private BeanDefinition checkAndBuildPassthroughIntermediateDirectoryStrategy(
+            @Nonnull final Element element, @Nonnull final ParserContext parserContext) {
 
         if (!element.hasAttributeNS(null, "sourceDirectoryIntermediateSegmentNumber")
                 && !element.hasAttributeNS(null, "sourceDirectoryIntermediateSegmentLength") ) {
diff --git a/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/NodeProcessingAttachingBeanPostProcessor.java b/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/NodeProcessingAttachingBeanPostProcessor.java
index 335ece48..98edd0cb 100644
--- a/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/NodeProcessingAttachingBeanPostProcessor.java
+++ b/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/NodeProcessingAttachingBeanPostProcessor.java
@@ -34,7 +34,6 @@ import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.beans.factory.config.BeanPostProcessor;
 import org.springframework.core.Ordered;
 
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.component.ComponentInitializationException;
 
@@ -52,7 +51,7 @@ import net.shibboleth.shared.component.ComponentInitializationException;
 public class NodeProcessingAttachingBeanPostProcessor implements BeanPostProcessor, Ordered {
 
     /** The processors to install. */
-    @Nonnull @NonnullElements private List<MetadataNodeProcessor> nodeProcessors;
+    @Nonnull private List<MetadataNodeProcessor> nodeProcessors;
 
     /**
      * Constructor.
@@ -60,8 +59,7 @@ public class NodeProcessingAttachingBeanPostProcessor implements BeanPostProcess
      * @param processors auto-wired processors to install
      */
     @Autowired
-    public NodeProcessingAttachingBeanPostProcessor(
-            @Nullable @NonnullElements final Collection<MetadataNodeProcessor> processors) {
+    public NodeProcessingAttachingBeanPostProcessor(@Nullable final Collection<MetadataNodeProcessor> processors) {
         if (processors != null) {
             nodeProcessors = CollectionSupport.copyToList(processors);
         } else {
@@ -76,7 +74,7 @@ public class NodeProcessingAttachingBeanPostProcessor implements BeanPostProcess
      * 
      * @since 4.1.0
      */
-    public void setNodeProcessors(@Nullable @NonnullElements final Collection<MetadataNodeProcessor> processors) {
+    public void setNodeProcessors(@Nullable final Collection<MetadataNodeProcessor> processors) {
         if (processors != null) {
             // Replace auto-wired set.
             nodeProcessors = CollectionSupport.copyToList(processors);
@@ -89,7 +87,9 @@ public class NodeProcessingAttachingBeanPostProcessor implements BeanPostProcess
     }
     
     /** {@inheritDoc} */
-    @Override public Object postProcessBeforeInitialization(@Nonnull final Object bean, @Nonnull final String beanName) {
+    @Override
+    @Nonnull public Object postProcessBeforeInitialization(@Nonnull final Object bean,
+            @Nonnull final String beanName) {
         
         if (nodeProcessors.isEmpty()) {
             return bean;
@@ -125,7 +125,8 @@ public class NodeProcessingAttachingBeanPostProcessor implements BeanPostProcess
     }
 
     /** {@inheritDoc} */
-    @Override public Object postProcessAfterInitialization(final @Nonnull Object bean, final @Nonnull String beanName) {
+    @Override
+    @Nonnull public Object postProcessAfterInitialization(@Nonnull final Object bean, @Nonnull final String beanName) {
         return bean;
     }
 
diff --git a/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/ResourceBackedMetadataProviderParser.java b/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/ResourceBackedMetadataProviderParser.java
index dd8d3df5..2685b7a6 100644
--- a/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/ResourceBackedMetadataProviderParser.java
+++ b/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/ResourceBackedMetadataProviderParser.java
@@ -61,7 +61,8 @@ public class ResourceBackedMetadataProviderParser extends AbstractReloadingMetad
 
     /** {@inheritDoc} */
     @Override
-    @Nonnull protected Class<? extends AbstractBatchMetadataResolver> getNativeBeanClass(final Element element) {
+    @Nonnull protected Class<? extends AbstractBatchMetadataResolver> getNativeBeanClass(
+            @Nonnull final Element element) {
 
         if (AttributeSupport.hasAttribute(element, RESOURCE_REF)) {
             return ResourceBackedMetadataResolver.class;
diff --git a/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/filter/ByReferenceParser.java b/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/filter/ByReferenceParser.java
index 23731b42..e6ab9564 100644
--- a/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/filter/ByReferenceParser.java
+++ b/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/filter/ByReferenceParser.java
@@ -65,6 +65,7 @@ public class ByReferenceParser extends AbstractCustomBeanDefinitionParser {
             final ManagedMap<Object,BeanDefinition> mappings = new ManagedMap<>();
             
             for (final Element child : children) {
+                assert child != null;
                 final List<Element> filters = ElementSupport.getChildElements(child,
                         new QName(AbstractMetadataProviderParser.METADATA_NAMESPACE, "MetadataFilter"));
                 if (filters != null && !filters.isEmpty()) {
diff --git a/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/filter/EntityRoleFilterParser.java b/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/filter/EntityRoleFilterParser.java
index 730a0761..370f4c78 100644
--- a/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/filter/EntityRoleFilterParser.java
+++ b/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/filter/EntityRoleFilterParser.java
@@ -58,6 +58,7 @@ public class EntityRoleFilterParser extends AbstractCustomBeanDefinitionParser {
                         "RetainedRole");
         if (retainedRoleElems != null) {
             for (final Element retainedRoleElem : retainedRoleElems) {
+                assert retainedRoleElem != null;
                 retainedRoles.add(ElementSupport.getElementContentAsQName(retainedRoleElem));
             }
         }
diff --git a/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/filter/package-info.java b/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/filter/package-info.java
index dfabb917..5ddc4b1b 100644
--- a/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/filter/package-info.java
+++ b/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/filter/package-info.java
@@ -18,5 +18,7 @@
 /**
  * Implementations of MetadataProvider Filter Parsers.
  */
+ at NonnullElements
+package net.shibboleth.spring.metadata.filter;
 
-package net.shibboleth.spring.metadata.filter;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/package-info.java b/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/package-info.java
index 442bb792..56a267bd 100644
--- a/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/package-info.java
+++ b/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/package-info.java
@@ -19,6 +19,7 @@
  * Parsers for the urn:mace:shibboleth:2.0:metadata schema. Mostly 
  * to do with <MetadataProvider> and its children
  */
+ at NonnullElements
+package net.shibboleth.spring.metadata;
 
-
-package net.shibboleth.spring.metadata;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/shib-metadata-spring/src/main/java/net/shibboleth/spring/package-info.java b/shib-metadata-spring/src/main/java/net/shibboleth/spring/package-info.java
index cf6fe337..7d2f5e5e 100644
--- a/shib-metadata-spring/src/main/java/net/shibboleth/spring/package-info.java
+++ b/shib-metadata-spring/src/main/java/net/shibboleth/spring/package-info.java
@@ -18,5 +18,7 @@
 /**
  * Otherwise un-homed Spring supporting code.
  */
+ at NonnullElements
+package net.shibboleth.spring;
 
-package net.shibboleth.spring;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/shib-metadata-spring/src/main/java/net/shibboleth/spring/security/CredentialHolder.java b/shib-metadata-spring/src/main/java/net/shibboleth/spring/security/CredentialHolder.java
index c4e2c38e..2ef218c7 100644
--- a/shib-metadata-spring/src/main/java/net/shibboleth/spring/security/CredentialHolder.java
+++ b/shib-metadata-spring/src/main/java/net/shibboleth/spring/security/CredentialHolder.java
@@ -24,7 +24,6 @@ import javax.annotation.Nullable;
 
 import org.opensaml.security.credential.Credential;
 
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotLive;
 import net.shibboleth.shared.annotation.constraint.Unmodifiable;
 import net.shibboleth.shared.collection.CollectionSupport;
@@ -39,14 +38,14 @@ import net.shibboleth.shared.collection.CollectionSupport;
 public class CredentialHolder {
 
     /** Credentials to expose. */
-    @Nonnull @NonnullElements private final Collection<Credential> credentials;
+    @Nonnull private final Collection<Credential> credentials;
     
     /**
      * Constructor.
      *
      * @param creds credentials to expose to other components
      */
-    public CredentialHolder(@Nullable @NonnullElements final Collection<Credential> creds) {
+    public CredentialHolder(@Nullable final Collection<Credential> creds) {
         if (creds != null) {
             credentials = CollectionSupport.copyToList(creds);
         } else {
@@ -59,7 +58,7 @@ public class CredentialHolder {
      * 
      * @return credentials to expose
      */
-    @Nonnull @NonnullElements @Unmodifiable @NotLive public Collection<Credential> getCredentials() {
+    @Nonnull @Unmodifiable @NotLive public Collection<Credential> getCredentials() {
         return credentials;
     }
     
diff --git a/shib-metadata-spring/src/main/java/net/shibboleth/spring/security/SecurityNamespaceHandler.java b/shib-metadata-spring/src/main/java/net/shibboleth/spring/security/SecurityNamespaceHandler.java
index 4d8435f6..e4e80186 100644
--- a/shib-metadata-spring/src/main/java/net/shibboleth/spring/security/SecurityNamespaceHandler.java
+++ b/shib-metadata-spring/src/main/java/net/shibboleth/spring/security/SecurityNamespaceHandler.java
@@ -85,4 +85,5 @@ public class SecurityNamespaceHandler extends BaseSpringNamespaceHandler {
         registerBeanDefinitionParser(StaticPKIXX509CredentialParser.TYPE_NAME, new StaticPKIXX509CredentialParser());
 
     }
+
 }
\ No newline at end of file
diff --git a/shib-metadata-spring/src/main/java/net/shibboleth/spring/security/credential/BasicInlineCredentialParser.java b/shib-metadata-spring/src/main/java/net/shibboleth/spring/security/credential/BasicInlineCredentialParser.java
index 5d3ba5b2..d374a7d7 100644
--- a/shib-metadata-spring/src/main/java/net/shibboleth/spring/security/credential/BasicInlineCredentialParser.java
+++ b/shib-metadata-spring/src/main/java/net/shibboleth/spring/security/credential/BasicInlineCredentialParser.java
@@ -31,7 +31,8 @@ import org.w3c.dom.Element;
 public class BasicInlineCredentialParser extends AbstractBasicCredentialParser {
 
     /** Element Name.*/
-    public static final QName TYPE_NAME = new QName(SecurityNamespaceHandler.SECURITY_NAMESPACE, "BasicInline");
+    @Nonnull public static final QName TYPE_NAME =
+            new QName(SecurityNamespaceHandler.SECURITY_NAMESPACE, "BasicInline");
 
     /** {@inheritDoc} */
     @Override
diff --git a/shib-metadata-spring/src/main/java/net/shibboleth/spring/security/credential/BasicResourceCredentialParser.java b/shib-metadata-spring/src/main/java/net/shibboleth/spring/security/credential/BasicResourceCredentialParser.java
index 693fb169..ffccd6e9 100644
--- a/shib-metadata-spring/src/main/java/net/shibboleth/spring/security/credential/BasicResourceCredentialParser.java
+++ b/shib-metadata-spring/src/main/java/net/shibboleth/spring/security/credential/BasicResourceCredentialParser.java
@@ -31,7 +31,7 @@ import org.w3c.dom.Element;
 public class BasicResourceCredentialParser extends AbstractBasicCredentialParser {
 
     /** Type for Resource. */
-    public static final QName TYPE_NAME_RESOURCE = new QName(SecurityNamespaceHandler.SECURITY_NAMESPACE,
+    @Nonnull public static final QName TYPE_NAME_RESOURCE = new QName(SecurityNamespaceHandler.SECURITY_NAMESPACE,
             "BasicResourceBacked");
 
     /** {@inheritDoc} */
diff --git a/shib-metadata-spring/src/main/java/net/shibboleth/spring/security/credential/X509InlineCredentialParser.java b/shib-metadata-spring/src/main/java/net/shibboleth/spring/security/credential/X509InlineCredentialParser.java
index 483d451a..2635b63f 100644
--- a/shib-metadata-spring/src/main/java/net/shibboleth/spring/security/credential/X509InlineCredentialParser.java
+++ b/shib-metadata-spring/src/main/java/net/shibboleth/spring/security/credential/X509InlineCredentialParser.java
@@ -31,7 +31,7 @@ import org.w3c.dom.Element;
 public class X509InlineCredentialParser extends AbstractX509CredentialParser {
 
     /** Element Name.*/
-    public static final QName TYPE_NAME = new QName(SecurityNamespaceHandler.SECURITY_NAMESPACE, "X509Inline");
+    @Nonnull public static final QName TYPE_NAME = new QName(SecurityNamespaceHandler.SECURITY_NAMESPACE, "X509Inline");
 
     @Override
     @Nonnull protected Class<?> getBeanClass(@Nonnull final Element element) {
diff --git a/shib-metadata-spring/src/main/java/net/shibboleth/spring/security/credential/X509ResourceCredentialParser.java b/shib-metadata-spring/src/main/java/net/shibboleth/spring/security/credential/X509ResourceCredentialParser.java
index 78182003..63917bea 100644
--- a/shib-metadata-spring/src/main/java/net/shibboleth/spring/security/credential/X509ResourceCredentialParser.java
+++ b/shib-metadata-spring/src/main/java/net/shibboleth/spring/security/credential/X509ResourceCredentialParser.java
@@ -31,7 +31,7 @@ import org.w3c.dom.Element;
 public class X509ResourceCredentialParser extends AbstractX509CredentialParser {
 
     /** Type for X509 credentials. */
-    public static final QName TYPE_NAME_RESOURCE = new QName(SecurityNamespaceHandler.SECURITY_NAMESPACE,
+    @Nonnull public static final QName TYPE_NAME_RESOURCE = new QName(SecurityNamespaceHandler.SECURITY_NAMESPACE,
             "X509ResourceBacked");
 
     @Override
diff --git a/shib-metadata-spring/src/main/java/net/shibboleth/spring/security/package-info.java b/shib-metadata-spring/src/main/java/net/shibboleth/spring/security/package-info.java
index fe49bf9f..eb815b9c 100644
--- a/shib-metadata-spring/src/main/java/net/shibboleth/spring/security/package-info.java
+++ b/shib-metadata-spring/src/main/java/net/shibboleth/spring/security/package-info.java
@@ -18,5 +18,7 @@
 /**
  * Security namespace Spring parsing support.
  */
+ at NonnullElements
+package net.shibboleth.spring.security;
 
-package net.shibboleth.spring.security;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/shib-metadata-spring/src/main/java/net/shibboleth/spring/security/trust/package-info.java b/shib-metadata-spring/src/main/java/net/shibboleth/spring/security/trust/package-info.java
index dffeb31b..67fa0e00 100644
--- a/shib-metadata-spring/src/main/java/net/shibboleth/spring/security/trust/package-info.java
+++ b/shib-metadata-spring/src/main/java/net/shibboleth/spring/security/trust/package-info.java
@@ -18,5 +18,7 @@
 /**
  * Parsers for TrustEngines.
  */
+ at NonnullElements
+package net.shibboleth.spring.security.trust;
 
-package net.shibboleth.spring.security.trust;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/shib-metadata-spring/src/test/java/net/shibboleth/spring/http/HTTPResourceConfigurationTests.java b/shib-metadata-spring/src/test/java/net/shibboleth/spring/http/HTTPResourceConfigurationTests.java
index 9caf4a28..489df91e 100644
--- a/shib-metadata-spring/src/test/java/net/shibboleth/spring/http/HTTPResourceConfigurationTests.java
+++ b/shib-metadata-spring/src/test/java/net/shibboleth/spring/http/HTTPResourceConfigurationTests.java
@@ -22,6 +22,8 @@ import java.io.IOException;
 import java.nio.file.Files;
 import java.nio.file.Path;
 
+import javax.annotation.Nonnull;
+
 import org.springframework.beans.factory.xml.XmlBeanDefinitionReader;
 import org.springframework.context.support.GenericApplicationContext;
 import org.springframework.core.io.ClassPathResource;
@@ -31,6 +33,7 @@ import org.testng.annotations.AfterSuite;
 import org.testng.annotations.BeforeSuite;
 import org.testng.annotations.Test;
 
+import net.shibboleth.shared.annotation.constraint.NonnullBeforeTest;
 import net.shibboleth.shared.spring.custom.SchemaTypeAwareXMLBeanDefinitionReader;
 import net.shibboleth.shared.spring.httpclient.resource.HTTPResource;
 import net.shibboleth.shared.testing.RepositorySupport;
@@ -43,15 +46,15 @@ import net.shibboleth.shared.testing.ResourceTestHelper;
 @SuppressWarnings("javadoc")
 public class HTTPResourceConfigurationTests {
     
-    private static final String PROP_RESOURCE_URL = "resourceURL";
+    @Nonnull private static final String PROP_RESOURCE_URL = "resourceURL";
     
-    private static final String REPO_IDP = "java-shib-metadata";
+    @Nonnull private static final String REPO_IDP = "java-shib-metadata";
     
-    private static final String DOC_XML = "shib-metadata-spring/src/test/resources/net/shibboleth/spring/http/document.xml";
+    @Nonnull private static final String DOC_XML = "shib-metadata-spring/src/test/resources/net/shibboleth/spring/http/document.xml";
     
-    private File theDir = null;
-    private GenericApplicationContext theContext = null;
-    private GenericApplicationContext globalContext = null;
+    @NonnullBeforeTest private File theDir = null;
+    @NonnullBeforeTest private GenericApplicationContext theContext = null;
+    @NonnullBeforeTest private GenericApplicationContext globalContext = null;
     
     @BeforeSuite public void setup() throws IOException {
         MockPropertySource propSource = new MockPropertySource("localProperties");
@@ -105,12 +108,11 @@ public class HTTPResourceConfigurationTests {
     }
 
     
-    private Resource getResource(final String beanName) {
-        
+    @Nonnull private Resource getResource(@Nonnull final String beanName) {
         return theContext.getBean(beanName, HTTPResource.class);
     }
 
-    private void testResource(final Resource r) throws IOException {
+    private void testResource(@Nonnull final Resource r) throws IOException {
         ResourceTestHelper.compare(r, new ClassPathResource("net/shibboleth/spring/http/document.xml"));
     }
     
diff --git a/shib-metadata-spring/src/test/java/net/shibboleth/spring/metadata/AbstractMetadataParserTest.java b/shib-metadata-spring/src/test/java/net/shibboleth/spring/metadata/AbstractMetadataParserTest.java
index 11228a64..6c74d4b0 100644
--- a/shib-metadata-spring/src/test/java/net/shibboleth/spring/metadata/AbstractMetadataParserTest.java
+++ b/shib-metadata-spring/src/test/java/net/shibboleth/spring/metadata/AbstractMetadataParserTest.java
@@ -39,6 +39,7 @@ import org.testng.annotations.AfterSuite;
 import org.testng.annotations.BeforeSuite;
 
 import net.shibboleth.idp.saml.metadata.impl.MetadataProviderContainer;
+import net.shibboleth.shared.annotation.constraint.NonnullBeforeTest;
 import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.resolver.CriteriaSet;
 import net.shibboleth.shared.spring.util.ApplicationContextBuilder;
@@ -50,19 +51,19 @@ import net.shibboleth.shared.spring.util.SpringSupport;
 @SuppressWarnings("javadoc")
 public class AbstractMetadataParserTest extends OpenSAMLInitBaseTestCase {
 
-    private static final String PATH = "/net/shibboleth/spring/metadata/";
+    @Nonnull private static final String PATH = "/net/shibboleth/spring/metadata/";
 
-    protected static final String SP_ID = "https://sp.example.org/sp/shibboleth";
+    @Nonnull protected static final String SP_ID = "https://sp.example.org/sp/shibboleth";
 
-    protected static final String IDP_ID = "https://idp.example.org/idp/shibboleth";
+    @Nonnull protected static final String IDP_ID = "https://idp.example.org/idp/shibboleth";
 
-    static private String workspaceDirName;
+    @NonnullBeforeTest static private String workspaceDirName;
 
-    static private File tempDir;
+    @NonnullBeforeTest static private File tempDir;
 
-    static private String tempDirName;
+    @NonnullBeforeTest static private String tempDirName;
     
-    static List<GenericApplicationContext> contexts;
+    @NonnullBeforeTest static List<GenericApplicationContext> contexts;
 
     protected Object parserPool;
 
@@ -122,7 +123,9 @@ public class AbstractMetadataParserTest extends OpenSAMLInitBaseTestCase {
         builder.setName(contextName);
         
         final MockPropertySource mockEnvVars = new MockPropertySource();
+        assert workspaceDirName != null;
         mockEnvVars.setProperty("DIR", workspaceDirName);
+        assert tempDirName != null;
         mockEnvVars.setProperty("TMPDIR", tempDirName);
 
         if (propSource != null) {
diff --git a/shib-metadata-spring/src/test/java/net/shibboleth/spring/metadata/DynamicHTTPMetadataProviderParserTest.java b/shib-metadata-spring/src/test/java/net/shibboleth/spring/metadata/DynamicHTTPMetadataProviderParserTest.java
index 7fe3ebca..865fed40 100644
--- a/shib-metadata-spring/src/test/java/net/shibboleth/spring/metadata/DynamicHTTPMetadataProviderParserTest.java
+++ b/shib-metadata-spring/src/test/java/net/shibboleth/spring/metadata/DynamicHTTPMetadataProviderParserTest.java
@@ -282,12 +282,13 @@ public class DynamicHTTPMetadataProviderParserTest extends AbstractMetadataParse
                 "dynamicMetadataQueryProtocolWithSecondaryURLBuilders.xml", "beans.xml");
         
         final String entityID = "urn:mace:incommon:osu.edu";
-        MessageDigest sha1Digester = MessageDigest.getInstance(JCAConstants.DIGEST_SHA1);
-        byte[] entityIDSourceID = sha1Digester.digest(entityID.getBytes("UTF-8"));
-        SecureRandom secureRandom = SecureRandom.getInstance("SHA1PRNG");
+        final MessageDigest sha1Digester = MessageDigest.getInstance(JCAConstants.DIGEST_SHA1);
+        final byte[] entityIDSourceID = sha1Digester.digest(entityID.getBytes("UTF-8"));
+        final SecureRandom secureRandom = SecureRandom.getInstance("SHA1PRNG");
         byte[] messageHandle = new byte[20];
         secureRandom.nextBytes(messageHandle);
-        SAMLSourceIDArtifact sourceIDArtifact = new SAML2ArtifactType0004(new byte[] {0, 0} , entityIDSourceID, messageHandle);
+        assert entityIDSourceID != null;
+        final SAMLSourceIDArtifact sourceIDArtifact = new SAML2ArtifactType0004(new byte[] {0, 0} , entityIDSourceID, messageHandle);
         
         final CriteriaSet criteriaSet = new CriteriaSet( new ArtifactCriterion(sourceIDArtifact));
         
diff --git a/shib-metadata-spring/src/test/java/net/shibboleth/spring/metadata/EmptyChainService.java b/shib-metadata-spring/src/test/java/net/shibboleth/spring/metadata/EmptyChainService.java
index 7a6f821f..8cf7a45d 100644
--- a/shib-metadata-spring/src/test/java/net/shibboleth/spring/metadata/EmptyChainService.java
+++ b/shib-metadata-spring/src/test/java/net/shibboleth/spring/metadata/EmptyChainService.java
@@ -31,6 +31,7 @@ import net.shibboleth.shared.service.ServiceableComponent;
 public class EmptyChainService extends AbstractMetadataParserTest {
 
     @Test public void setup() throws IOException {
+        @SuppressWarnings("unchecked")
         final ReloadableService<RefreshableMetadataResolver> service = getBean(ReloadableService.class, "empty-chain-svc.xml");
         try (final ServiceableComponent<RefreshableMetadataResolver> comp = service.getServiceableComponent()) {
             final ChainingMetadataResolver chain = (ChainingMetadataResolver) comp.getComponent();
diff --git a/shib-metadata-spring/src/test/java/net/shibboleth/spring/metadata/InlineMetadataParserTest.java b/shib-metadata-spring/src/test/java/net/shibboleth/spring/metadata/InlineMetadataParserTest.java
index 61cc985b..59343574 100644
--- a/shib-metadata-spring/src/test/java/net/shibboleth/spring/metadata/InlineMetadataParserTest.java
+++ b/shib-metadata-spring/src/test/java/net/shibboleth/spring/metadata/InlineMetadataParserTest.java
@@ -111,13 +111,14 @@ public class InlineMetadataParserTest extends AbstractMetadataParserTest {
         defs.add("net/shibboleth/spring/metadata/multipleResolvers.xml");
 
         builder.setServiceConfigurations(defs.stream().
-                map(s -> loader.getResource(s)).
+                map(loader::getResource).
                 collect(CollectionSupport.nonnullCollector(Collectors.toList())).get());
 
         final GenericApplicationContext context = builder.build();
         
         registerContext(context);
         
+        @SuppressWarnings("unchecked")
         final ReloadableSpringService<MetadataResolver> ms =
                 context.getBean("shibboleth.MetadataResolverService", ReloadableSpringService.class);
 
diff --git a/shib-metadata-spring/src/test/java/net/shibboleth/spring/metadata/LocalDynamicMetadataProviderParserTest.java b/shib-metadata-spring/src/test/java/net/shibboleth/spring/metadata/LocalDynamicMetadataProviderParserTest.java
index 4cd2034f..95a45376 100644
--- a/shib-metadata-spring/src/test/java/net/shibboleth/spring/metadata/LocalDynamicMetadataProviderParserTest.java
+++ b/shib-metadata-spring/src/test/java/net/shibboleth/spring/metadata/LocalDynamicMetadataProviderParserTest.java
@@ -48,9 +48,6 @@ import net.shibboleth.shared.codec.StringDigester;
 import net.shibboleth.shared.codec.StringDigester.OutputFormat;
 import net.shibboleth.shared.resolver.CriteriaSet;
 
-/**
- *
- */
 @SuppressWarnings("javadoc")
 public class LocalDynamicMetadataProviderParserTest extends AbstractMetadataParserTest {
     
@@ -115,6 +112,7 @@ public class LocalDynamicMetadataProviderParserTest extends AbstractMetadataPars
         ApplicationContext appContext = getApplicationContext("LocalDynamic", 
                 "localDynamicWithManagerAndGenerator.xml", "beans.xml");
 
+        @SuppressWarnings("unchecked")
         final XMLObjectLoadSaveManager<XMLObject> sourceManager = 
                 appContext.getBean("metadata.LocalDynamicSourceManager", XMLObjectLoadSaveManager.class);
 
diff --git a/shib-metadata-spring/src/test/java/net/shibboleth/spring/metadata/MetadataFailFastTest.java b/shib-metadata-spring/src/test/java/net/shibboleth/spring/metadata/MetadataFailFastTest.java
index bb641650..6acc6e20 100644
--- a/shib-metadata-spring/src/test/java/net/shibboleth/spring/metadata/MetadataFailFastTest.java
+++ b/shib-metadata-spring/src/test/java/net/shibboleth/spring/metadata/MetadataFailFastTest.java
@@ -22,11 +22,14 @@ import static org.testng.Assert.*;
 import java.io.IOException;
 import java.util.List;
 
+import javax.annotation.Nonnull;
+
 import org.opensaml.saml.metadata.resolver.MetadataResolver;
 import org.springframework.mock.env.MockPropertySource;
 import org.testng.annotations.Ignore;
 import org.testng.annotations.Test;
 
+import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.service.ReloadableService;
 import net.shibboleth.shared.service.ServiceException;
 import net.shibboleth.shared.service.ServiceableComponent;
@@ -45,7 +48,7 @@ public class MetadataFailFastTest extends AbstractFailFastTest {
      * @param filePart
      * @return the URL (as a string)
      */
-    protected String makeURLPath(final String filePart) {
+    @Nonnull protected String makeURLPath(final String filePart) {
         return RepositorySupport.buildHTTPResourceURL("java-shib-metadata",
                 "shib-metadata-spring/src/test/resources" + getPath() + filePart,
                 false);
@@ -55,7 +58,7 @@ public class MetadataFailFastTest extends AbstractFailFastTest {
         
         final Object bean = getBean(propertySource("ServiceConfiguration", makePath("inLineMetadataGood.xml")), "metadataBeansDefaultFF.xml");
         final ReloadableService<MetadataResolver > service = (ReloadableService<MetadataResolver>) bean;
-        assertNotNull(service);
+        assert service != null;
         try (final ServiceableComponent<MetadataResolver> srv = service.getServiceableComponent()) {
             assert srv != null;
             final MetadataResolver resolver = srv.getComponent();
@@ -82,7 +85,7 @@ public class MetadataFailFastTest extends AbstractFailFastTest {
             assertNull(service);
             return;
         }
-        assertNotNull(service);
+        assert service != null;
         try (final ServiceableComponent<MetadataResolver> component = service.getServiceableComponent()) {
             fail("Should not have worked");
         } catch (final ServiceException e) {
@@ -103,12 +106,12 @@ public class MetadataFailFastTest extends AbstractFailFastTest {
     }
 
     @Test public void workingFile() throws IOException {
-        final List<MockProperty> prop = List.of(new MockProperty("ServiceConfiguration", makePath("fileMetadata.xml")),
+        final List<MockProperty> prop = CollectionSupport.listOf(new MockProperty("ServiceConfiguration", makePath("fileMetadata.xml")),
                 new MockProperty("File", makePath("metadataFileGood.xml")));
         
         final Object bean = getBean(propertySource(prop), "metadataBeansDefaultFF.xml");
         final ReloadableService<MetadataResolver > service = (ReloadableService<MetadataResolver>) bean;
-        assertNotNull(service);
+        assert service != null;
         try (final ServiceableComponent<MetadataResolver> srv = service.getServiceableComponent()) {
             final MetadataResolver resolver = srv.getComponent();
             assertNotNull(resolver);
@@ -116,7 +119,7 @@ public class MetadataFailFastTest extends AbstractFailFastTest {
     }
 
     private void badFile(final Boolean failFast) throws IOException {
-        final List<MockProperty> prop = List.of(new MockProperty("ServiceConfiguration", makePath("fileMetadata.xml")),
+        final List<MockProperty> prop = CollectionSupport.listOf(new MockProperty("ServiceConfiguration", makePath("fileMetadata.xml")),
                 new MockProperty("File", makePath("metadataFileBad.xml")));
         nonWorkingMetadata(failFast, propertySource(prop));
     }
@@ -134,7 +137,7 @@ public class MetadataFailFastTest extends AbstractFailFastTest {
     }
 
     private void nonExistingFile(final Boolean failFast) throws IOException {
-        final List<MockProperty> prop = List.of(new MockProperty("ServiceConfiguration", makePath("fileMetadata.xml")),
+        final List<MockProperty> prop = CollectionSupport.listOf(new MockProperty("ServiceConfiguration", makePath("fileMetadata.xml")),
                 new MockProperty("File", makePath("metadatNooneHome.xml")));
         nonWorkingMetadata(failFast, propertySource(prop));
     }
@@ -152,14 +155,14 @@ public class MetadataFailFastTest extends AbstractFailFastTest {
     }
 
     @Test public void workingHttp() throws IOException {
-        final List<MockProperty> prop = List.of(
+        final List<MockProperty> prop = CollectionSupport.listOf(
                 new MockProperty("ServiceConfiguration", makePath("httpMetadata.xml")),
                 new MockProperty("Backing", makeTempPath("workingHttpTmp" + uniquifier++ + ".xml")),
                 new MockProperty("metadataURL", makeURLPath("metadataFileGood.xml")));
 
         final Object bean = getBean(propertySource(prop), "metadataBeansDefaultFF.xml");
         final ReloadableService<MetadataResolver > service = (ReloadableService<MetadataResolver>) bean;
-        assertNotNull(service);
+        assert service != null;
         try (final ServiceableComponent<MetadataResolver> srv = service.getServiceableComponent()) {
             assert srv != null;
             final MetadataResolver resolver = srv.getComponent();
@@ -168,7 +171,7 @@ public class MetadataFailFastTest extends AbstractFailFastTest {
     }
 
     private void badHttp(final Boolean failFast) throws IOException {
-        final List<MockProperty> prop = List.of(
+        final List<MockProperty> prop = CollectionSupport.listOf(
                 new MockProperty("ServiceConfiguration", makePath("httpMetadata.xml")),
                 new MockProperty("Backing", makeTempPath("badHttpTmp" + uniquifier++ + ".xml")),
                 new MockProperty("metadataURL", makeURLPath("metadataFileBad.xml")));
@@ -188,7 +191,7 @@ public class MetadataFailFastTest extends AbstractFailFastTest {
     }
 
     private void nonExistingHttp(final Boolean failFast) throws IOException {
-        final List<MockProperty> prop = List.of(
+        final List<MockProperty> prop = CollectionSupport.listOf(
                 new MockProperty("ServiceConfiguration", makePath("httpMetadata.xml")),
                 new MockProperty("Backing", makeTempPath("badHttpTmp" + uniquifier++ + ".xml")),
                 new MockProperty("metadataURL", makeURLPath("ItsNotThere.xml")));
diff --git a/shib-metadata-spring/src/test/java/net/shibboleth/spring/metadata/filter/EntityRoleFilterParserTest.java b/shib-metadata-spring/src/test/java/net/shibboleth/spring/metadata/filter/EntityRoleFilterParserTest.java
index a36c8060..f85dfb0d 100644
--- a/shib-metadata-spring/src/test/java/net/shibboleth/spring/metadata/filter/EntityRoleFilterParserTest.java
+++ b/shib-metadata-spring/src/test/java/net/shibboleth/spring/metadata/filter/EntityRoleFilterParserTest.java
@@ -35,6 +35,7 @@ import org.testng.annotations.Test;
 /**
  * test for parser for EntityRoleWhileList filter
  */
+ at SuppressWarnings("javadoc")
 public class EntityRoleFilterParserTest extends AbstractMetadataParserTest {
 
     @Test public void validUntil() throws IOException {
diff --git a/shib-metadata-spring/src/test/java/net/shibboleth/spring/security/AbstractSecurityParserTest.java b/shib-metadata-spring/src/test/java/net/shibboleth/spring/security/AbstractSecurityParserTest.java
index 280e1307..69fa50d8 100644
--- a/shib-metadata-spring/src/test/java/net/shibboleth/spring/security/AbstractSecurityParserTest.java
+++ b/shib-metadata-spring/src/test/java/net/shibboleth/spring/security/AbstractSecurityParserTest.java
@@ -20,6 +20,9 @@ package net.shibboleth.spring.security;
 
 import java.io.IOException;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.springframework.context.support.GenericApplicationContext;
 import org.springframework.core.io.ClassPathResource;
 import org.springframework.core.io.Resource;
@@ -27,6 +30,7 @@ import org.springframework.mock.env.MockPropertySource;
 import org.testng.annotations.AfterMethod;
 import org.testng.annotations.BeforeSuite;
 
+import net.shibboleth.shared.annotation.constraint.NonnullBeforeTest;
 import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.spring.util.ApplicationContextBuilder;
 
@@ -36,12 +40,12 @@ import net.shibboleth.shared.spring.util.ApplicationContextBuilder;
 @SuppressWarnings("javadoc")
 public class AbstractSecurityParserTest {
 
-    private static final String PATH = "/net/shibboleth/spring/security/";
+    @Nonnull private static final String PATH = "/net/shibboleth/spring/security/";
     
-    protected static final String SP_ID = "https://sp.example.org/sp/shibboleth"; 
-    protected static final String IDP_ID = "https://idp.example.org/idp/shibboleth";
+    @Nonnull protected static final String SP_ID = "https://sp.example.org/sp/shibboleth"; 
+    @Nonnull protected static final String IDP_ID = "https://idp.example.org/idp/shibboleth";
     
-    static private String workspaceDirName;
+    @NonnullBeforeTest static private String workspaceDirName;
 
     private GenericApplicationContext pendingTeardownContext = null;
     
@@ -63,11 +67,12 @@ public class AbstractSecurityParserTest {
         workspaceDirName = resource.getFile().getAbsolutePath();
     }
 
-    protected <T> T getBean(final Class<T> claz, final String... files) throws IOException{
+    protected <T> T getBean(@Nonnull final Class<T> claz, @Nonnull final String... files) throws IOException{
         return getBean(null, claz, files);
     }
 
-    protected <T> T getBean(final String name, final Class<T> claz, final String... files) throws IOException{
+    @Nonnull protected <T> T getBean(@Nullable final String name, @Nonnull final Class<T> claz,
+            @Nonnull final String... files) throws IOException{
         final Resource[] resources = new Resource[files.length];
         
         for (int i = 0; i < files.length; i++) {
@@ -79,6 +84,7 @@ public class AbstractSecurityParserTest {
         builder.setName("ApplicationContext: " + claz);
         
         final MockPropertySource mockEnvVars = new MockPropertySource();
+        assert workspaceDirName != null;
         mockEnvVars.setProperty("DIR", workspaceDirName);
         builder.setPropertySources(CollectionSupport.singletonList(mockEnvVars));
         
diff --git a/shib-metadata-spring/src/test/java/net/shibboleth/spring/security/trust/ChainingTrustEngineTest.java b/shib-metadata-spring/src/test/java/net/shibboleth/spring/security/trust/ChainingTrustEngineTest.java
index 5846d7c3..805d8e80 100644
--- a/shib-metadata-spring/src/test/java/net/shibboleth/spring/security/trust/ChainingTrustEngineTest.java
+++ b/shib-metadata-spring/src/test/java/net/shibboleth/spring/security/trust/ChainingTrustEngineTest.java
@@ -35,6 +35,7 @@ public class ChainingTrustEngineTest extends AbstractSecurityParserTest {
 
     
     @Test public void one() throws IOException, SecurityException {
+        @SuppressWarnings("unchecked")
         final ChainingTrustEngine<Object> engine = (ChainingTrustEngine<Object>) lookup("chainingTrue.xml");
         
         final Object token = new Object();
@@ -44,6 +45,7 @@ public class ChainingTrustEngineTest extends AbstractSecurityParserTest {
     }
 
     @Test public void two() throws IOException, SecurityException {
+        @SuppressWarnings("unchecked")
         final ChainingTrustEngine<Object> engine = (ChainingTrustEngine<Object>) lookup("chainingTrueFalse.xml");
         
         final Object token = new Object();
diff --git a/shib-metadata-testing/src/main/java/net/shibboleth/spring/testing/AbstractFailFastTest.java b/shib-metadata-testing/src/main/java/net/shibboleth/spring/testing/AbstractFailFastTest.java
index 060adb33..3dccb629 100644
--- a/shib-metadata-testing/src/main/java/net/shibboleth/spring/testing/AbstractFailFastTest.java
+++ b/shib-metadata-testing/src/main/java/net/shibboleth/spring/testing/AbstractFailFastTest.java
@@ -24,6 +24,7 @@ import java.util.Iterator;
 import java.util.List;
 
 import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
 
 import org.opensaml.core.testing.OpenSAMLInitBaseTestCase;
 import org.springframework.context.ApplicationContext;
@@ -35,6 +36,7 @@ import org.testng.annotations.AfterSuite;
 import org.testng.annotations.BeforeClass;
 import org.testng.annotations.BeforeSuite;
 
+import net.shibboleth.shared.annotation.constraint.NonnullBeforeTest;
 import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 import net.shibboleth.shared.collection.CollectionSupport;
@@ -50,15 +52,15 @@ import net.shibboleth.shared.spring.util.SpringSupport;
 public class AbstractFailFastTest extends OpenSAMLInitBaseTestCase {
 
     /** The directory where our test files are. */
-    private String workspaceDirName;
+    @NonnullBeforeTest private String workspaceDirName;
 
     /** All the {@link GenericApplicationContext}  ever allocated for this test. They are explicitly torn down at the end. */
-    static List<GenericApplicationContext> contexts;
+    @NonnullBeforeTest static List<GenericApplicationContext> contexts;
 
     /** Make note of newly allocated {@link GenericApplicationContext}.
      * @param context what to remember.
      */
-    protected void registerContext(final GenericApplicationContext context) {
+    protected void registerContext(@Nonnull final GenericApplicationContext context) {
         synchronized(contexts) {
             contexts.add(context);
         }        
@@ -67,14 +69,14 @@ public class AbstractFailFastTest extends OpenSAMLInitBaseTestCase {
     /** Our test path.
      * @return the path
      */
-    @Nonnull protected String getPath() {
+    @Nonnull @NotEmpty protected String getPath() {
         return "/net/shibboleth/spring/failfast/";
     }
 
     /** get the directory where our tests are stored.
      * @return the directoryname
      */
-    protected String getWorkspaceDirName() {
+    @NonnullBeforeTest protected String getWorkspaceDirName() {
         return workspaceDirName;
     }
 
@@ -113,8 +115,8 @@ public class AbstractFailFastTest extends OpenSAMLInitBaseTestCase {
      * @return a {@link GenericApplicationContext}
      * @throws IOException as required.
      */
-    @Nonnull protected ApplicationContext getApplicationContext(final String contextName,
-            final MockPropertySource propSource, final String... files) throws IOException {
+    @Nonnull protected ApplicationContext getApplicationContext(@Nonnull final String contextName,
+            @Nullable final MockPropertySource propSource, @Nonnull final String... files) throws IOException {
         final Resource[] resources = new Resource[files.length];
 
         for (int i = 0; i < files.length; i++) {
@@ -148,7 +150,8 @@ public class AbstractFailFastTest extends OpenSAMLInitBaseTestCase {
      * @return a {@link GenericApplicationContext} 
      * @throws IOException as required.
      */
-    protected ApplicationContext getApplicationContext(final String contextName, final String... files) throws IOException {
+    @Nonnull protected ApplicationContext getApplicationContext(@Nonnull final String contextName,
+            @Nonnull final String... files) throws IOException {
         return getApplicationContext(contextName, null, files);
     }
 
@@ -158,7 +161,8 @@ public class AbstractFailFastTest extends OpenSAMLInitBaseTestCase {
      * @return the bean
      * @throws IOException as required.
      */
-    protected Object getBean(final MockPropertySource propSource, final String... files) throws IOException {
+    @Nullable protected Object getBean(@Nullable final MockPropertySource propSource, @Nonnull final String... files)
+            throws IOException {
         return getBean(propSource, true, files);
     }
 
@@ -169,15 +173,18 @@ public class AbstractFailFastTest extends OpenSAMLInitBaseTestCase {
      * @return the bean
      * @throws IOException as required
      */
-    protected Object getBean(final MockPropertySource propSource, Boolean failFast, final String... files) throws IOException {
+    @Nullable protected Object getBean(@Nullable final MockPropertySource propSource, @Nullable final Boolean failFast,
+            @Nonnull final String... files) throws IOException {
         @SuppressWarnings("rawtypes") final Class<ReloadableService> claz = ReloadableService.class;
         
-        if (null == failFast) {
-            propSource.setProperty("failFast", "");
-        } else if (failFast) {
-            propSource.setProperty("failFast", "true");
-        } else {
-            propSource.setProperty("failFast", "false");
+        if (propSource != null) {
+            if (null == failFast) {
+                propSource.setProperty("failFast", "");
+            } else if (failFast) {
+                propSource.setProperty("failFast", "true");
+            } else {
+                propSource.setProperty("failFast", "false");
+            }
         }
         
         try {
@@ -194,7 +201,7 @@ public class AbstractFailFastTest extends OpenSAMLInitBaseTestCase {
      * @return the bean
      * @throws IOException as required
      */
-    protected Object getBean(final String... files) throws IOException {
+    @Nullable protected Object getBean(@Nonnull final String... files) throws IOException {
         return getBean(null, files);
     }
 
diff --git a/shib-metadata-testing/src/main/java/net/shibboleth/spring/testing/package-info.java b/shib-metadata-testing/src/main/java/net/shibboleth/spring/testing/package-info.java
index e58d084f..bdbbe4e1 100644
--- a/shib-metadata-testing/src/main/java/net/shibboleth/spring/testing/package-info.java
+++ b/shib-metadata-testing/src/main/java/net/shibboleth/spring/testing/package-info.java
@@ -18,5 +18,7 @@
 /**
  * APIs for Spring tests.
  */
+ at NonnullElements
+package net.shibboleth.spring.testing;
 
-package net.shibboleth.spring.testing;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.


More information about the commits mailing list