...
Languages supported: C/C++, C#, Java, Javascript, Python, Ruby (Question: what about Groove)
Current Activity: In conversations with Coverity to understand the definition of “project” – does it refer to ONAP or the projects under an ONAP release to ensure that the limitation on free scans does not lead to bottlenecks in submissions and commits. (Coverity response included below)
...
- If the ONAP project can be built from source in a single command, then Coverity can to create component maps.
- If the separate components are built individually, then each component can be submitted as a separate project.
- Coverity recommends storing the projects in a hierarchical structure in Github with the ONAP parent project referring to the project (i.e. ONAP/component_name). There are a few projects already in Scan which follow this structure. (is ONAP stored this way?) Each ONAP project has it's own hierarchy in Gerrit (its own Git tree). Can they do an arbitrary Git Pull, Git Clone on a repository?
Restrictions on builds: (from https://scan.coverity.com/)
...
Coverity requires a code contributor to submit a project because of their responsible disclosure process for issues the tool may identify within the code.
Next Steps:
- Meet with Coverity (schedule call, include Tony Hansen , someone from Linux Foundation)
- Will Scan integrate with Gerrit? (Coverity Scan tool indicates that it does integrate with Gerrit.)
- Can it integrate with Jenkins (use resources from Linux Foundation to assist)?
- How long does it take to run a scan and get results?
- Lead time with Coverity to use Scan?
- Mass registration of all ONAP subcomponents (approximately 30 projects, 210 subprojects)?
- Identify an open source project actively using Coverity Scan to get their feedback on the integration of Scan with their code development lifecycle
- Determine whether or not the restrictions on scan frequency will cause a problem for any of the ONAP projects
- Identify an ONAP project willing to test Scan (possibly CLAMP since they are also going through CII badging)
- Integrate Scan with ONAP code development (if Scan is determined to be a viable product)
...