diff --git a/.gitignore b/.gitignore
index ecaf1f2df9..cf5943b0df 100644
--- a/.gitignore
+++ b/.gitignore
@@ -8,6 +8,7 @@
 *.sdf
 *.suo
 *.vcxproj.user
+.dev-tools/
 .hugo_build.lock
 .idea
 .classpath
diff --git a/dev-support/checks/_lib.sh b/dev-support/checks/_lib.sh
new file mode 100644
index 0000000000..fd30f756fb
--- /dev/null
+++ b/dev-support/checks/_lib.sh
@@ -0,0 +1,88 @@
+#!/usr/bin/env bash
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements.  See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License.  You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+check_name="$(basename "${BASH_SOURCE[1]}")"
+check_name="${check_name%.sh}"
+
+: ${TOOLS_DIR:=$(pwd)/.dev-tools} # directory for tools
+: ${RATIS_PREFER_LOCAL_TOOL:=true} # skip install if tools are already available (eg. via package manager)
+
+## @description  Install a dependency.  Only first argument is mandatory.
+## @param name of the tool
+## @param the directory for binaries, relative to the tool directory; added to PATH.
+## @param the directory for the tool, relative to TOOLS_DIR
+## @param name of the executable, for testing if it is already installed
+## @param name of the function that performs actual installation steps
+_install_tool() {
+  local tool bindir dir bin func
+
+  tool="$1"
+  bindir="${2:-}"
+  dir="${TOOLS_DIR}"/"${3:-"${tool}"}"
+  bin="${4:-"${tool}"}"
+  func="${5:-"_install_${tool}"}"
+
+  if [[ "${RATIS_PREFER_LOCAL_TOOL}" == "true" ]] && which "${bin}" >& /dev/null; then
+    echo "Skip installing $bin, as it's already available on PATH."
+    return
+  fi
+
+  if [[ ! -d "${dir}" ]]; then
+    mkdir -pv "${dir}"
+    _do_install "${tool}" "${dir}" "${func}"
+  fi
+
+  if [[ -n "${bindir}" ]]; then
+    _add_to_path "${dir}"/"${bindir}"
+
+    if ! which "${bin}" >& /dev/null; then
+      _do_install "${tool}" "${dir}" "${func}"
+      _add_to_path "${dir}"/"${bindir}"
+    fi
+  fi
+}
+
+_do_install() {
+  local tool="$1"
+  local dir="$2"
+  local func="$3"
+
+  pushd "${dir}"
+  if eval "${func}"; then
+    echo "Installed ${tool} in ${dir}"
+    popd
+  else
+    popd
+    msg="Failed to install ${tool}"
+    echo "${msg}" >&2
+    if [[ -n "${REPORT_FILE}" ]]; then
+      echo "${msg}" >> "${REPORT_FILE}"
+    fi
+    exit 1
+  fi
+}
+
+_add_to_path() {
+  local bindir="$1"
+
+  if [[ -d "${bindir}" ]]; then
+    if [[ "${RATIS_PREFER_LOCAL_TOOL}" == "true" ]]; then
+      export PATH="${PATH}:${bindir}"
+    else
+      export PATH="${bindir}:${PATH}"
+    fi
+  fi
+}
diff --git a/dev-support/checks/findbugs.sh b/dev-support/checks/findbugs.sh
index 3a063b3fa1..93d3ef936f 100755
--- a/dev-support/checks/findbugs.sh
+++ b/dev-support/checks/findbugs.sh
@@ -13,6 +13,9 @@
 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 # See the License for the specific language governing permissions and
 # limitations under the License.
+
+set -u -o pipefail
+
 DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
 cd "$DIR/../.." || exit 1
 
@@ -20,28 +23,27 @@ source "${DIR}/../find_maven.sh"
 
 : ${WITH_COVERAGE:="false"}
 
-MAVEN_OPTIONS='-B -fae'
+REPORT_DIR=${OUTPUT_DIR:-"$DIR/../../target/findbugs"}
+mkdir -p "$REPORT_DIR"
+REPORT_FILE="$REPORT_DIR/summary.txt"
 
-if ! type unionBugs >/dev/null 2>&1 || ! type convertXmlToText >/dev/null 2>&1; then
-  #shellcheck disable=SC2086
-  ${MVN} ${MAVEN_OPTIONS} test-compile spotbugs:check
-  exit $?
-fi
+source "${DIR}/_lib.sh"
+source "${DIR}/install/spotbugs.sh"
+
+MAVEN_OPTIONS='-B -fae'
 
 if [[ "${WITH_COVERAGE}" != "true" ]]; then
   MAVEN_OPTIONS="${MAVEN_OPTIONS} -Djacoco.skip"
 fi
 
 #shellcheck disable=SC2086
-${MVN} ${MAVEN_OPTIONS} test-compile spotbugs:spotbugs
+${MVN} ${MAVEN_OPTIONS} test-compile spotbugs:spotbugs "$@" | tee "${REPORT_DIR}/output.log"
 rc=$?
 
-REPORT_DIR=${OUTPUT_DIR:-"$DIR/../../target/findbugs"}
-mkdir -p "$REPORT_DIR"
-REPORT_FILE="$REPORT_DIR/summary.txt"
+touch "$REPORT_FILE"
 
 find ratis* -name spotbugsXml.xml -print0 | xargs -0 unionBugs -output "${REPORT_DIR}"/summary.xml
-convertXmlToText "${REPORT_DIR}"/summary.xml | tee "${REPORT_FILE}"
+convertXmlToText "${REPORT_DIR}"/summary.xml | tee -a "${REPORT_FILE}"
 convertXmlToText -html:fancy-hist.xsl "${REPORT_DIR}"/summary.xml "${REPORT_DIR}"/summary.html
 
 wc -l "$REPORT_FILE" | awk '{print $1}'> "$REPORT_DIR/failures"
diff --git a/dev-support/checks/install/spotbugs.sh b/dev-support/checks/install/spotbugs.sh
new file mode 100644
index 0000000000..337ba2b94d
--- /dev/null
+++ b/dev-support/checks/install/spotbugs.sh
@@ -0,0 +1,34 @@
+#!/usr/bin/env bash
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements.  See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License.  You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# This script installs SpotBugs.
+# Requires _install_tool from _lib.sh.  Use `source` for both scripts, because it modifies $PATH.
+
+_get_spotbugs_version() {
+  MAVEN_ARGS='' ${MVN} -q -DforceStdout -Dscan=false help:evaluate -Dexpression=spotbugs.version 2>/dev/null || echo '4.8.6'
+}
+
+if [[ -z "${SPOTBUGS_VERSION:-}" ]]; then
+  SPOTBUGS_VERSION="$(_get_spotbugs_version)"
+fi
+
+_install_spotbugs() {
+  echo "https://repo.maven.apache.org/maven2/com/github/spotbugs/spotbugs/${SPOTBUGS_VERSION}/spotbugs-${SPOTBUGS_VERSION}.tgz"
+  curl -LSs "https://repo.maven.apache.org/maven2/com/github/spotbugs/spotbugs/${SPOTBUGS_VERSION}/spotbugs-${SPOTBUGS_VERSION}.tgz" | tar -xz -f - || exit 1
+  find "spotbugs-${SPOTBUGS_VERSION}"/bin -type f -print0 | xargs -0 --no-run-if-empty chmod +x
+}
+
+_install_tool spotbugs "spotbugs-${SPOTBUGS_VERSION}/bin"
diff --git a/dev-support/find_maven.sh b/dev-support/find_maven.sh
index 20b6462b1e..2067ff5152 100644
--- a/dev-support/find_maven.sh
+++ b/dev-support/find_maven.sh
@@ -17,7 +17,7 @@
 # limitations under the License.
 
 function find_maven() {
-    if [ "$MAVEN" != "" ]; then
+    if [[ -n "${MAVEN:-}" ]]; then
       echo "${MAVEN}"
     else
       local DIR