Package: codechecker
CodeCheckerCodeCheckeris a static analysis infrastructure built on theLLVM/Clang
Static Analyzertoolchain, replacingscan-buildin a Linux or
macOS (OS X) development environment.:bulb: Check out ourDEMOshowing some analysis results of open-source projects!Main featuresCommand line C/C++ AnalysisExecutesClang-Tidy,Clang Static Analyzerwith Cross-Translation Unit analysis, Statistical Analysis (when checkers are available),Cppcheck, and theGCC Static Analyzer.Creates the JSON compilation database by wiretapping any build process (e.g.,CodeChecker log -b "make").Automatically analyzes GCC cross-compiled projects: detecting GCC or Clang compiler configuration and forming the corresponding clang analyzer invocations.Incremental analysis: Only the changed files and its dependencies need to be reanalyzed.False positive suppression with a possibility to add review comments.Result visualization in command line or in static HTML.Web-based report storageYou can store & visualize thousands of analysis reportsof many analyzers like
Clang Static Analyzer (C/C++), Clang Tidy (C/C++), Facebook Infer (C/C++, Java), Clang Sanitizers (C/C++), Spotbugs (Java), Pylint (Python), Eslint (Javascript) ...For a complete list seeSupported AnalyzersWeb applicationfor viewing discovered code defects with a streamlined,
easy experience (with PostgreSQL, or SQLite backend).Gerrit and GitLab integrationShows analysis results asGitLaborGerritreviews.Filterable(defect checker name, severity, source paths, ...) andcomparable(calculates difference between two analyses of the project,
showing which bugs have been fixed and which are newly introduced) result
viewing.Diff mode:This shows the list of bugs that have been introduced since your last analyzer
execution.Results can be shared with fellow developers, thecommentsandreviewsystem helps communication of code defects.Easily implementableThrift-based
server-client communication used for storing and querying of discovered
defects.Support for multiple bug visualization frontends, such as the web
application, acommand-line tooland anEclipse plugin.Command line featuresCodeCheckercommand has many subcommands which can be used for example to
log and analyze your projects, print the results or start a web server. For
full list see the following table or check the help message of this command
(CodeChecker --help):CodeCheckersubcommandDescriptionanalyzeExecute the supported code analyzers for the files recorded in a JSON Compilation Database.analyzer-versionPrint the version of CodeChecker analyzer package that is being used.analyzersList supported and available analyzers.checkPerform analysis on a project and print results to standard output.checkersList the checkers available for code analysis.cmdView analysis results on a running server from the command line.fixitApply automatic fixes based on the suggestions of the analyzers.logRun a build command, collect the executed compilation commands and store them in a JSON file.parsePrint analysis summary and results in a human-readable format.serverStart and manage the CodeChecker Web server.storeSave analysis results to a database.versionPrint the version of CodeChecker package that is being used.web-versionPrint the version of CodeChecker server package that is being used.CodeChecker cmdsubcommand also has many other subcommands which can be used
to get data (products, runs, results, statistics) from a running CodeChecker
server. For full list see the following table or check the help message of this
subcommand (CodeChecker cmd --help):CodeChecker cmdsubcommandDescriptionrunsList the available analysis runs.historyShow run history of multiple runs.resultsList analysis result (finding) summary for a given run.diffCompare two analysis runs and show the difference.sumShow statistics of checkers.tokenAccess subcommands related to configuring personal access tokens managed by a CodeChecker server.delDelete analysis runs.updateUpdate an analysis run.suppressManage and import suppressions of reports on a CodeChecker server.productsAccess subcommands related to configuring the products managed by a CodeChecker server.componentsAccess subcommands related to configuring the source components managed by a CodeChecker server.loginAuthenticate into CodeChecker servers that require privileges.exportExport comments and review statuses from CodeChecker.importImport comments and review statuses into CodeChecker.Usage flowStep 1:CodeChecker logruns the given build command and records the
executed compilation steps. These steps are written to an output file
(Compilation Database) in a JSON format.Step 2:CodeChecker analyzeuses the previously created JSON Compilation
Database to perform an analysis on the project, outputting analysis results in
a machine-readable (plist) format.Step 3: In this step, you can do multiple things:Parse and pretty-print the summary and results from analysis result files
(CodeChecker parse).Store the results to a running CodeChecker server (CodeChecker store).Compare two analysis results/runs to show the results that differ between
the two (CodeChecker cmd diff).etc.For more information how to use CodeChecker see ouruser guide.User documentationGetting started (How-To with examples)C/C++ AnalysisAnalyzer User guideAvoiding or suppressing false positivesChecker and Static Analyzer configurationGCC incompatibilitiesSuppressing false positivesWeb based report managementWebserver User GuideWEB GUI User GuideCommand line and WEB UI Feature overviewSecurity configurationConfiguring AuthenticationConfiguring AuthorizationDeploymentDeploy server using dockerServer ConfigurationConfiguring Server LoggingSetting up multiple CodeChecker repositories in one serverContinuous Integration (CI)CodeChecker as a GitHub ActionSetting up CI gating with Gerrit and JenkinsDatabase ConfigurationPostgreSQL database backend setup guideCodeChecker server and database schema upgrade guideStorage of reports from analyzer toolsCodeChecker can be used as a generic tool for visualizing analyzer results.The following tools are supported:LanguageAnalyzerC/C++Clang Static AnalyzerClang TidyClang SanitizersCppcheckFacebook InferCoccinelleSmatchKernel-DocSparsecpplintC#Roslynator.DotNet.CliJavaSpotBugsFacebook InferPythonPylintPyflakesJavaScriptESLintTypeScriptTSLintGoGolintMarkdownMarkdownlintSphinxFor details seesupported code analyzersdocumentation and theReport Converter Tool.Common ToolsUseful tools that can also be used outside CodeChecker.Build Logger (to generate JSON Compilation Database from your builds)Plist/Sarif to HTML converter (to generate HTML files from the given plist or sarif files)Report Converter Tool (to convert analysis results from other analyzers to the codechecker report directory format))Translation Unit Collector (to collect source files of a translation unit or to get source files which depend on the given header files)Report Hash generator (to generate unique hash identifiers for reports)Helper ScriptsHelper Scripts for daily analysisInstall guideInstall CodeChecker viapipCodeChecker is available on thepypiand can be installed with the following command:pip3installcodecheckerNote:this package can be installed onLinux,OSXandWindowssystems wherepip3command is available. OnOSX,intercept-buildmust be
installed for logging (CodeChecker log). OnWindows, logging is not
available.Installing CodeChecker via thesnappackage managerCodeChecker is available on theSnap Storeand can be installed with the following command:sudosnapinstallcodechecker--classicNote:Unfortunately, the snap package supports only lower-case command names.
For this reason, you need to usecodecheckercommand instead ofCodeCheckereverywhere. For a full list of available commands in thecodecheckersnap
package, runsnap info codechecker.LinuxFor a detailed dependency list, and for instructions on how to install newer
Clang and Clang-Tidy versions, please seeRequirements.
The following commands are used to bootstrap CodeChecker on Ubuntu 20.04 LTS:# Install mandatory dependencies for a development and analysis environment.# NOTE: clang or clang-tidy can be any sufficiently fresh version, and need not#       come from package manager!#       In case of Cppcheck, the minimal supported version is 1.80.#       In case of gcc, the minimal supported version is 13.0.0.sudoapt-getinstallclangclang-tidycppcheckg++build-essentialcurlgcc-multilibgitpython3-devpython3-venvpython3-setuptools# Install nodejs dependency for web. In case of Debian/Ubuntu you can use the# following commands. For more information see the official docs:# https://nodejs.org/en/download/package-manager/curl-sLhttps://deb.nodesource.com/setup_16.x|sudo-Ebash-
sudoapt-getinstall-ynodejs# Check out CodeChecker source code.gitclonehttps://github.com/Ericsson/CodeChecker.git--depth1~/codecheckercd~/codechecker# Create a Python virtualenv and set it as your environment.# NOTE: if you want to develop CodeChecker, use the `venv_dev` target instead# of `venv`.makevenvsource$PWD/venv/bin/activate# [Optional] If you want to use external authentication methods (LDAP / PAM)# follow the instructions in# docs/web/authentication.md#external-authentication-methods# Build and install a CodeChecker package.makepackage# For ease of access, add the build directory to PATH.exportPATH="$PWD/build/CodeChecker/bin:$PATH"cd..Notes:By default,make packagewill build ldlogger shared objects for32bitand64bittoo. If you would like to build and package64 bit onlyshared objects and ldlogger binary you can setBUILD_LOGGER_64_BIT_ONLYenvironment variable toYESbefore the package build:BUILD_LOGGER_64_BIT_ONLY=YES make package.By default, themake packagewill build the UI code if it's not built yet
or the UI code is changed. If you wouldn't like to build the UI code you can
set theBUILD_UI_DISTenvironment variable toNObefore the package build:BUILD_UI_DIST=NO make package.Usemake standalone_packageinstead ofmake packageto avoid
having to manually activate the environment before running CodeChecker.Upgrading environment after system or Python upgradeIf you have upgraded your system's Python to a newer version (e.g., from2.7.6to2.7.12– this is the case when upgrading Ubuntu from
14.04.2 LTS to 16.04.1 LTS), the installed environment will not work
out-of-the-box. To fix this issue, run the following command to upgrade yourchecker_envtoo:cd~/codechecker/venv
python3-mvenv.Mac OS XFor installation instructions for Mac OS X seeMac OS X Installation Guidedocumentation.DockerTo run the CodeChecker server in Docker see theDockerdocumentation.
You can find the CodeChecker web-server container at theDocker Hub.Visual Studio Code pluginYou can install and use CodeChecker VSCode extension from theVisual Studio Marketplaceor fromOpen VSX.Main features:Run CodeChecker analysis from the editor and see the results automatically.Re-analyze the current file when saved.Commands and build tasks for running CodeChecker as part of a build system.Browse through the found reports and show the reproduction steps directly in the code.Navigate between the reproduction steps.For more information how to install and use this plugin see therepositoryof this
extension.GitHub Actions CICodeChecker can be executed via a reusable GitHub action for your project!
You need only specify the build command, as if you would run the analysis
locally.For more information, check out theCodeChecker Static Analysisaction on the GitHub Actions Marketplace.Analyze your first projectSetting up the environment in your TerminalThese steps must always be taken in a new command prompt you wish to execute
analysis in.source~/codechecker/venv/bin/activate# Path of CodeChecker package# NOTE: SKIP this line if you want to always specify CodeChecker's full path.exportPATH=~/codechecker/build/CodeChecker/bin:$PATH# Path of the built LLVM/Clang# NOTE: SKIP this line if clang is available in your PATH as an installed Linux package.exportPATH=~/<userpath>/build/bin:$PATHExecute analysisAnalyze your project with thecheckcommand:CodeChecker check -b "cd ~/your-project && make clean && make" -o ./resultscheckwill print an overview of the issues found in your project by the
analyzers. The reports will be stored in the./resultsdirectory inplistXML format.Export the reports as static HTML filesYou can visualize the results as static HTML by executingCodeChecker parse -e html ./results -o ./reports_htmlAn index page will be generated with a list of all repors in./reports_html/index.htmlOptionally store the results in Web server & view the resultsIf you have hundreds of results, you may want to store them on the web
server with a database backend.Start a CodeChecker web and storage server in another terminal or as a
background process. By default, it will listen onlocalhost:8001.The SQLite database containing the reports will be placed in your workspace
directory (~/.codecheckerby default), which can be provided via the-wflag.CodeChecker serverStore your analysis reports onto the server to be able to use the Web Viewer.CodeChecker store ./results -n my-projectOpen theCodeChecker Web Viewerin your browser, and
you should be greeted with a web application showing you the analysis results.Important environmental limitationsPython 2 and older Python 3 releasesCodeChecker has been ported completely to Python3.No Python 2 support is planned.You will need at least Python version3.8.
Old virtual environments that were created with a Python 2 interpreter need to
be removed.Upgrading environment after system or Python upgradeIf you have upgraded your system's Python to a newer version (e.g., from2.7to3.8– this is the case when upgrading Ubuntu from 14.04 LTS
to 20.04 LTS), the installed environment will not work out-of-the-box. To fix
this issue, run the following command to upgrade yourchecker_envtoo:cd~/codechecker/venv
python3-mvenv.Older Clang versionsClang3.6or earlier releases areNOTsupported due to CodeChecker
relying on features not available in those releases.If you have Clang3.7installed you might see the following warning message:Hash value wasn't found in the plist file.Use Clang>= 3.8or SVN trunkr251011/ Git commitefec163— otherwise,
CodeChecker generates a simple hash based on the filename and the line content.
This method is applied for Clang-Tidy results too, because Clang-Tidy does not
support bug identifier hash generation currently.Developer documentationsArchitecturePackage layoutDependenciesThrift interfacePackage and integration testsChecker documentation mapping fileConference papers, presentationsAn overview about the CodeChecker infrastructure was given atPLDI 2020.Márton, Gábor and Krupp, Dániel:Tool Talk: CodeCheckerA high-level overview about the infrastructure is available amongst the2015 Euro LLVM Conferencepresentations.Krupp, Dániel and Orbán, György and Horváth, Gábor and Babati, Bence:Industrial Experiences with the Clang Static Analysis Toolset