https://scan.coverity.com/ has been down for more than a few days now.

[hughsie@mastodon.social]

https://scan.coverity.com/ has been down for more than a few days now. At first it was "planned maintenance" and now it's "some upgrades" -- does anyone have any idea what's going on with Coverity these days?

Since the Black Duck acquisition a few years ago the Coverity experience has got worse and worse -- it doesn't *feel* like it has a long term future. Apart from PVS-Studio (which I also use) is there anything else people use for C-code static analysis?

[zeenix@toot.cat]

@hughsie

[hughsie@mastodon.social]

@zeenix is this is just a rewrite-it-in-rust comment please don't bother.

[bluca@fosstodon.org]

@hughsie we use codeql in the systemd repo, here's the GHA yaml: https://github.com/systemd/systemd/blob/main/.github/workflows/codeql.yml

[nielsdg@mastodon.social]

@hughsie probably doesn't come even close but what about gcc's -fanalyzer or clang's scan-build as a stopgap? Definitely going to watch the replies to this post though to see what's out there

[pwithnall@mastodon.social]

@nielsdg @hughsie Personally I’ve found scan-build to be at least as useful as Coverity (and it can be run locally!). As Richard says, Coverity’s usefulness has only declined since they were bought out.

[zeenix@toot.cat]

@hughsie i didn't. 😂

[cryptomilk@mastodon.social]

@hughsie In libssh we use csbuild in addition. This is from https://github.com/csutils/csmock/ and runs clang cppcheck etc. It offers plugins even to things like synk.

Setup is here:
https://gitlab.com/libssh/libssh-mirror/-/blob/master/.gitlab-ci.yml?ref_type=heads#L429