> We exclude any projects that cannot be compiled due to unresolved dependencies. That's weird -- I would think that static analysis would be enough for what I

> We exclude any projects that cannot be compiled due to unresolved dependencies. That's weird -- I would think that static analysis would be enough for what I understand to be the scope of the analysis. I wonder if it's because CogniCrypt (which isn't linked from their paper: https://github.com/eclipse-cognicrypt/CogniCrypt https://github.com/eclipse-cognicrypt/CogniCrypt ) is an Eclipse plugin, and thus has the Eclipse frame of mind that it's a "valid" project?