Current status of Coverity static scans - Dev

8 Aug 2019

Hello all,

For the last couple of weeks I've been doing Coverity scans and
posting them with the results from the other static analysis I do each
week [1] I wanted to bring everyone up to speed on the current status
and why I'm doing it this way.

Quite some time ago now I took over the task of running the Coverity
scans but in January last year they stopped working with the version
that Coverity shipped and they have not worked since then with any
publicly available version. this coincided with our move to C++11 and
my investigation led me to believe that the version of Coverity
current at teh time lacked support for c++1*. My company does have a
subscription however and that gives us access to several versions
which are not publicly available. I tested with various versions and
found one that works and that is what I'm using to do the scans
currently. Unfortunately Coverity's website (dashboard) does not
support the uploading of results gathered with any version other than
what they ship publicly so we are stuck with the HTML results I
generate and host. I will be creating bug reports for the errors seen
during scanning with the publicly available version (which is a
*later* version than the working version) but how much priority they
will be given I have no idea. Previous attempts to contact support
have fallen on deaf ears so I'm not overly optimistic but we shall
see. It has taken considerable time and effort to get to this point
but various individuals have stated the importance of having these
results available so it has been, and remains, a priority for me as do
the other weekly scans I perform.

[1] http://people.redhat.com/bhubbard/

-- 
Cheers,
Brad