Coverity vs OSS tool (clang) in architecture phase criteria

Owned by Naoto YAMAGUCHI
Last updated: Jun 29, 2020
1 min read

Jan-Simon Moeller

1st step is analyzing for history of code quality using static analysis tool.  Has a serious bug been fixed with the minor version up?  When major version up is made, how many new serious bugs increase this OSS?
This analysis cannot be based on the number of bug fix.  It need to use a static analysis tool to analyze the unfixed bugs.


Focusing point:

  • Which tool is trusted in the world?
  • Which tools can accurately detect bugs? (code analysis only, excluding CVE check)
  • Which tools can accurately detect known defects (CVE)?





Example : https://scan.coverity.com/projects

→ would need FOSS ??

J.S. will present at AMM.

https://aglammsummer2020.sched.com/event/ch7d/static-analysis-tools-for-agl-using-foss-jan-simon-moller-the-linux-foundation?iframe=no&w=100%&sidebar=yes&bg=no