Skip to main content

static code analyzer wrapper for Clang.

Project description

https://img.shields.io/pypi/v/scan-build.svg https://img.shields.io/pypi/l/scan-build.svg https://img.shields.io/pypi/dm/scan-build.svg https://img.shields.io/pypi/pyversions/scan-build.svg https://badges.gitter.im/rizsotto/scan-build.svg

scan-build

A package designed to wrap a build so that all calls to gcc/clang are intercepted and logged into a compilation database and/or piped to the clang static analyzer. Includes intercept-build tool, which logs the build, as well as scan-build tool, which logs the build and runs the clang static analyzer on it.

How to get

It’s available from the Python Package Index

$ pip install scan-build

Portability

Should be working on UNIX operating systems.

  • It has been tested on FreeBSD, GNU/Linux, OS X and Windows.

Prerequisites

  1. clang compiler, to compile the sources and have the static analyzer.

  2. python interpreter (version 3.6, 3.7, 3.8, 3.9).

How to use

To run the Clang static analyzer against a project goes like this:

$ scan-build <your build command>

To generate a compilation database file goes like this:

$ intercept-build <your build command>

To run the Clang static analyzer against a project with compilation database goes like this:

$ analyze-build

Use --help to know more about the commands.

Limitations

Generally speaking, the intercept-build and analyze-build tools together does the same job as scan-build does. So, you can expect the same output from this line as simple scan-build would do:

$ intercept-build <your build command> && analyze-build

The major difference is how and when the analyzer is run. The scan-build tool has three distinct model to run the analyzer:

  1. Use compiler wrappers to make actions. The compiler wrappers does run the real compiler and the analyzer. This is the default behaviour, can be enforced with --override-compiler flag.

  2. Use special library to intercept compiler calls during the build process. The analyzer run against each modules after the build finished. Use --intercept-first flag to get this model.

  3. Use compiler wrappers to intercept compiler calls during the build process. The analyzer run against each modules after the build finished. Use --intercept-first and --override-compiler flags together to get this model.

The 1. and 3. are using compiler wrappers, which works only if the build process respects the CC and CXX environment variables. (Some build process can override these variable as command line parameter only. This case you need to pass the compiler wrappers manually. eg.: intercept-build --override-compiler make CC=intercept-cc CXX=intercept-c++ all where the original build command would have been make all only.)

The 1. runs the analyzer right after the real compilation. So, if the build process removes removes intermediate modules (generated sources) the analyzer output still kept.

The 2. and 3. generate the compilation database first, and filters out those modules which are not exists. So, it’s suitable for incremental analysis during the development.

The 2. mode is available only on FreeBSD, Linux and OSX. Where library preload is available from the dynamic loader. Security extension/modes on different operating systems might disable library preload. This case the build behaves normally, but the result compilation database will be empty. (Notable examples for enabled security modes are: SIP on OS X Captain and SELinux on Fedora, RHEL and CentOS.) The program checks the security modes for SIP, and falls back to 3. mode.

intercept-build command uses only the 2. and 3. mode to generate the compilation database. analyze-build does only run the analyzer against the captured compiler calls.

Known problems

Because it uses LD_PRELOAD or DYLD_INSERT_LIBRARIES environment variables, it does not append to it, but overrides it. So builds which are using these variables might not work. (I don’t know any build tool which does that, but please let me know if you do.)

Problem reports

If you find a bug in this documentation or elsewhere in the program or would like to propose an improvement, please use the project’s issue tracker. Please describing the bug and where you found it. If you have a suggestion how to fix it, include that as well. Patches are also welcome.

License

The project is licensed under University of Illinois/NCSA Open Source License. See LICENSE.TXT for details.

Project details


Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

scan-build-2.0.20.tar.gz (46.4 kB view details)

Uploaded Source

Built Distribution

scan_build-2.0.20-py3-none-any.whl (49.4 kB view details)

Uploaded Python 3

File details

Details for the file scan-build-2.0.20.tar.gz.

File metadata

  • Download URL: scan-build-2.0.20.tar.gz
  • Upload date:
  • Size: 46.4 kB
  • Tags: Source
  • Uploaded using Trusted Publishing? No
  • Uploaded via: twine/3.4.1 importlib_metadata/4.0.1 pkginfo/1.7.0 requests/2.25.1 requests-toolbelt/0.9.1 tqdm/4.60.0 CPython/3.9.5

File hashes

Hashes for scan-build-2.0.20.tar.gz
Algorithm Hash digest
SHA256 f1f9f1dc3daf906ef106077dbac4d872f5740843173dc74070ef3b39da3d0f07
MD5 bc71d350745804e173fad55ff6694ce9
BLAKE2b-256 f9666a89d51839650913699e5d3dc89ac724db57848ad93723be1c203ab47d05

See more details on using hashes here.

File details

Details for the file scan_build-2.0.20-py3-none-any.whl.

File metadata

  • Download URL: scan_build-2.0.20-py3-none-any.whl
  • Upload date:
  • Size: 49.4 kB
  • Tags: Python 3
  • Uploaded using Trusted Publishing? No
  • Uploaded via: twine/3.4.1 importlib_metadata/4.0.1 pkginfo/1.7.0 requests/2.25.1 requests-toolbelt/0.9.1 tqdm/4.60.0 CPython/3.9.5

File hashes

Hashes for scan_build-2.0.20-py3-none-any.whl
Algorithm Hash digest
SHA256 f61cd6e05269819c8c5fb6d61eabb5cbc3c271ca99b89c096e45f82c454f63ef
MD5 8d62622df94a16783a5b0d17c5c7d3b3
BLAKE2b-256 3f3026ceed307db681195ed16c0b854f07c052f2ae4bd2e04d361357df0f0208

See more details on using hashes here.

Supported by

AWS Cloud computing and Security Sponsor Datadog Monitoring Fastly CDN Google Download Analytics Pingdom Monitoring Sentry Error logging StatusPage Status page