On uploading a FPR to a fortify 360 server, the plugin writes the following error message into the buildlog:

Error uploading to F360 Server: https://fortify.......de/ssc
java.lang.ClassNotFoundException: org.jvnet.hudson.plugins.fortify360.fortifyclient.FortifyClient
at org.apache.catalina.loader.WebappClassLoader.loadClass(WebappClassLoader.java:1484)
at org.apache.catalina.loader.WebappClassLoader.loadClass(WebappClassLoader.java:1329)
at org.jvnet.hudson.plugins.fortify360.FortifyClientClassLoader.findClass(FortifyClientClassLoader.java:196)
at java.lang.ClassLoader.loadClassHelper(ClassLoader.java:760)
at java.lang.ClassLoader.loadClass(ClassLoader.java:737)
at java.lang.ClassLoader.loadClass(ClassLoader.java:707)
at org.jvnet.hudson.plugins.fortify360.FPRPublisher.invokeFortifyClient(FPRPublisher.java:266)
at org.jvnet.hudson.plugins.fortify360.FPRPublisher.perform(FPRPublisher.java:178)
at hudson.plugins.promoted_builds.Promotion$RunnerImpl.build(Promotion.java:224)
at hudson.plugins.promoted_builds.Promotion$RunnerImpl.doRun(Promotion.java:166)
at hudson.model.AbstractBuild$AbstractBuildExecution.run(AbstractBuild.java:562)
at hudson.model.Run.execute(Run.java:1665)
at hudson.model.Run.run(Run.java:1612)
at hudson.plugins.promoted_builds.Promotion.run(Promotion.java:111)
at hudson.model.ResourceController.execute(ResourceController.java:88)
at hudson.model.Executor.run(Executor.java:246)

This is probably the same as https://github.com/hudson3-plugins/fortify360-plugin/issues/1 , though the linked report does not explain the error.

I think the error is due to this change https://github.com/jenkinsci/maven-plugin/commit/97b452ecc95a5546c471198126834f770a63a249
implemented in Jenkins-1.519 due to https://issues.jenkins-ci.org/browse/JENKINS-15120.

As a result of this change, the plugin's resources are no longer exploded into WEB-INF/classes, but kept in a classes.jar in the plugin's WEB-INF/lib directory. Thus, the FortifyClientClassloader creates a URL similar to jar:file:/var/lib/jenkins/plugins/fortify360/WEB-INF/lib/classes.jar!/fortifyclient-2.6.5.jar and adds it to it's URL list.

On loading the class, the FortifyClientClassLoader uses the methods from the default Java Classloader - which does not support nested jars.
This results in the above error message.

I think the strategy described here could resolve the issue: http://www.ibm.com/developerworks/library/j-onejar/