Re: Coverity, was Re: What's cooking in git.git (Oct 2021, #02; Wed, 6)
- From
Jeff King <peff@peff.net>
- Date
- Aug 17, 2022, 00:57 UTC
- Message-ID
- <Yvw87DJOOu+/jG6o@coredump.intra.peff.net>
- In-Reply-To
- <2n33pn8n-7529-443q-rq7n-q12nrqrn8p27@tzk.qr>
On Tue, Aug 16, 2022 at 11:05:48AM +0200, Johannes Schindelin wrote:
Show 14 quoted lines
> > It sounds like Taylor is volunteering to set up the Coverity side for > > git.git, and I can help him with getting those COVERITY_* variables into > > the GitHub environment. > > Given the challenges with Coverity (false positives, lack of support on > Synopsys' side, severely limited access to the reports), and given the > renewed efforts by OSTIF that focus not on Coverity but on CodeQL, I am > in favor of abandoning the idea to integrate Coverity in our GitHub > workflow. > > Regarding CodeQL, I am still uncertain what level of integration we will > end up with, and the contacts I am working with are currently all on > vacation, but I am confident that we will have an easier time going > forward with static analysis using CodeQL instead of Coverity.
OK. I haven't been that impressed with CodeQL for C so far, but it may be getting better. I certainly would be happier with a system that made it easier to display and share reports.
Coverity does have a lot of false positives, but I've at least been able to pick useful fixes out of them (especially because it is good about saying "here are 5 new things to look at"). I've been continuing to build my private branch with it, so we'll see if it turns up anything useful. I do agree that inflicting it on ordinary users may be counter-productive (I often have to stare really hard to understand why its false positives are false, and that is not something I would wish on, say, a GGG user).
-Peff