codechecker VS infer

python3 new.py docker-php-extension-installer: https://github.com/mlocati/docker-php-extension-installer codechecker: https://github.com/Ericsson/codechecker SingleFileZ: https://github.com/gildas-lormeau/SingleFileZ china-dictatorship: https://github.com/cirosantilli/china-dictatorship vscode-docker: https://github.com/microsoft/vscode-docker flask-bones: https://github.com/cburmeister/flask-bones ProjectFib: https://github.com/anantdgoel/ProjectFib S3Mock: https://github.com/adobe/S3Mock home: https://github.com/gege-circle/home docker-php: https://github.com/chialab/docker-php dockbix-xxl: https://github.com/monitoringartist/dockbix-xxl wind-layer: https://github.com/sakitam-fdd/wind-layer powerstrip: https://github.com/ClusterHQ/powerstrip selenium-jupiter: https://github.com/bonigarcia/selenium-jupiter gnome-shell-extension-docker: https://github.com/gpouilloux/gnome-shell-extension-docker hacktoberfest-2022: https://github.com/docker/hacktoberfest-2022 azure-docker-extension: https://github.com/Azure/azure-docker-extension pgrocks-fdw: https://github.com/vidardb/pgrocks-fdw docker-php-yii2: https://github.com/dmstr/docker-php-yii2 docker-community-extensions: https://github.com/collabnix/docker-community-extensions alpine-php-fpm: https://github.com/joseluisq/alpine-php-fpm autoview-tradingview-chrome-docker-bot: https://github.com/IAMtheIAM/autoview-tradingview-chrome-docker-bot .config: https://github.com/zszszszsz/.config docker-phpfpm: https://github.com/adhocore/docker-phpfpm coc-docker: https://github.com/josa42/coc-docker china-dictatorhsip-6: https://github.com/cirosantilli/china-dictatorhsip-6 testcontainers-spock: https://github.com/testcontainers/testcontainers-spock Dockery: https://github.com/oslabs-beta/Dockery docker-extension: https://github.com/tailscale/docker-extension volumes-backup-extension: https://github.com/docker/volumes-backup-extension ajeetraina@Docker-Ajeet-Singh-Rainas-MacBook-Pro chatgpt % vi new.py ajeetraina@Docker-Ajeet-Singh-Rainas-MacBook-Pro chatgpt % python3 new.py .config: https://github.com/zszszszsz/.config Dockery: https://github.com/oslabs-beta/Dockery docker-extension: https://github.com/tailscale/docker-extension ransomware: https://github.com/abhir98/ransomware jfrog-docker-desktop-extension: https://github.com/jfrog/jfrog-docker-desktop-extension dd-extension-lgtm: https://github.com/cedricziel/dd-extension-lgtm openshift-dd-ext: https://github.com/redhat-developer/openshift-dd-ext k9s-dd-extension: https://github.com/spurin/k9s-dd-extension pgadmin4-docker-extension: https://github.com/marcelo-ochoa/pgadmin4-docker-extension trivy-docker-extension: https://github.com/aquasecurity/trivy-docker-extension drone-ci-docker-extension: https://github.com/harness/drone-ci-docker-extension docker-extension: https://github.com/loopDelicious/docker-extension swagger-editor-docker-extension: https://github.com/n-murphy/swagger-editor-docker-extension wasm-docker-extension: https://github.com/cmrigney/wasm-docker-extension microcks-docker-desktop-extension: https://github.com/microcks/microcks-docker-desktop-extension docker-extension-golang-playground: https://github.com/rumpl/docker-extension-golang-playground diveintoansible-extension: https://github.com/spurin/diveintoansible-extension docker-desktop-extension: https://github.com/okteto/docker-desktop-extension docker-extension-rabbitmq: https://github.com/Yogendra0Sharma/docker-extension-rabbitmq docker-storj-extension: https://github.com/elek/docker-storj-extension github-registry-docker-desktop-extension: https://github.com/peacecwz/github-registry-docker-desktop-extension docker-desktop-extension-issues: https://github.com/mutagen-io/docker-desktop-extension-issues sdw-docker-extension: https://github.com/marcelo-ochoa/sdw-docker-extension vcluster-dd-extension: https://github.com/loft-sh/vcluster-dd-extension extension-docker-desktop: https://github.com/epinio/extension-docker-desktop asyncapi-studio-docker-extension: https://github.com/thiyagu06/asyncapi-studio-docker-extension gefyra-docker-desktop-extension: https://github.com/gefyrahq/gefyra-docker-desktop-extension oraclexe-docker-extension: https://github.com/marcelo-ochoa/oraclexe-docker-extension docker-extensions-101: https://github.com/collabnix/docker-extensions-101 step-ca-docker-extension: https://github.com/hslatman/step-ca-docker-extension

Regarding problems on clang-tidy - have you looked into Codechecker? It is based on clang tidy but also supports cppcheck and marking issues as false positives/will not fix etc... https://github.com/Ericsson/codechecker

I've been down the llvm / clang / mlir rabbit hole recently and drank this : https://codechecker.readthedocs.io ...

Seconding `rr` as suggested by @tux3, it's great for debugging.

Also, the sanitizers for GCC and Clang (https://github.com/google/sanitizers), and the Clang static analyzer (and tidy too) through CodeChecker (https://codechecker.readthedocs.io/).

For the Clang static analyzer, make sure your LLVM toolchain has the Z3 support enabled (OK in Debian stable for example), and enable cross translation units (CTU) analysis too for better results.

If you have the bandwidth, I'd also recommend using something like https://github.com/Ericsson/codechecker which allows you to add results of analysis/tests to a database. This would in turn allow you to set your "stable" branch pipelines to fail if the diff of problems between runs shows you've introduced more issues that haven't been marked as addressed.

Another open source alternative is CodeChecker [1] with the Clang static analyzer [2]. Make sure the Clang toolchain has been compiled with Z3 [3] support for better results (it's the case in Debian stable), particularly for code doing bit operations. It supports cross files analysis ("cross translation units" or CTU), which last time I checked was not the case for IKOS and helps improve diagnostics.

It's not completely turn key if you use it for a cross compiled code base, but once set-up I prefer it to another professional tool: much less false alarms. Although it's good to have both, each one found issues not seen by the other.

  [1] https://github.com/Ericsson/codechecker

I think most development occurs on problems that can't be formally modeled anyway. Most developers work on things like, "can you add this feature to the e-commerce site? And can the pop-up be blue?" which isn't really model-able.

But that's not to say that formal methods are useless! We can still prove some interesting aspects of programs -- for example, that every lock that gets acquired later gets released. I think tools like Infer[0] could become common in the coming years.

[0]: https://fbinfer.com/

Using infer, someone else exploited null-dereference checks to introduce simple affine types in C++. Cppcheck also checks for null-dereferences. Unfortunately, that approach means that borrow-counting references have a larger sizeof than non-borrow counting references, so optimizing the count away potentially changes the semantics of a program which introduces a whole new way of writing subtly wrong code.

Meta/Facebook are long time OCaml users, their logo is on the OCaml website. Their static analysis tool and its predecessor are both written in OCaml.

Then this idea that the US government will tell tech companies how to write secure software. Let's get this straight, the private sector, especially big tech is miles ahead of US government in this regard. Microsoft literally invented threat modelling and modern exploit mitigations. Facebook has the best appsec processes pretty much in the whole world, including their own cutting edge code analyzer. AWS uses formal verification everywhere. Meanwhile the US government itself runs mission-critical systems that's almost literally held together by bubble gum and toothpicks. Maybe they could dial down the arrogance a tad, get their own shit together, learn how this cyber stuff is actually done and only then try lecturing everyone else.

Efforts: Dependabot, CodeQL, Coverity, facebook's Infer tool, etc

I notice there isn't fbinfer. It's pretty cool, and is used for this library.

"Move fast, break stuff" is a great approach when you aren't pushing the broken bits to production. Fuck, even Facebook, the big "move fast, break stuff" company, uses tools to detect errors in its continuous integration toolchain. https://fbinfer.com/

TBH, there's a non-zero amount of non-"ivory tower" tools you may have used that are written in functional languages. Say, Pandoc or Shellcheck are written in Haskell; Infer and Flow are written in OCaml. RabbitMQ and Whatsapp are implemented in Erlang (FB Messenger was too, originally; they switched to the C++ servers later). Twitter backend is (or was, at least) written in Scala.