3 ms·
If you work at a company that can afford Coverity (static analyzer), it is great. Super simple to integrate into a standard gcc build.
by apaprocki 11y ago
If you work at a company that can afford Coverity (static analyzer), it is great. Super simple to integrate into a standard gcc build.
- TwoBit 11y agoI'd love to see a comparison of Coverity vs. Clang sanitizers. I wish we could buy just a couple Coverity licenses, but they want to license the entire organization for something like $200,000.
- jschwartzi 11y agoJust out of curiosity, how big is your org? I've been tempted to suggest Coverity a few times but I always balk at buying tools where the price is listed as $CallSalesAndNegotiate.
- slacka 11y agoWhen Daniel Hax ran Coverity and Clang against the curl source code, he found that the each "tool detected several issues the other didn’t spot." Coverity – very accurate reports and few false positives clang-analyzer – awesome reports, missed slightly too many issues and reported slightly too many false positives [1] You'll find similar results in PVS Studio vs clang[2] and PVS Studio vs Coverity.[3] If code quality is important to your organization, than one tool is probably not enough. If it's vital, you may want to consider another language such as Haskell or OCaml. [1] http://daniel.haxx.se/blog/2012/07/12/three-static-code-analyzers-compared/ http://daniel.haxx.se/blog/2012/07/12/three-static-code-anal... [2] http://www.viva64.com/en/b/0272/ http://www.viva64.com/en/b/0272/ [3] http://www.viva64.com/en/a/0076/ http://www.viva64.com/en/a/0076/
- exDM69 11y agoI have not tried this yet, but Coverity provides a free online tool for open source projects. It will be a nice complement to travis/coveralls and other CI tools available for free to open source projects. I'll definitely try it out once I get some time to work on infrastructure things on my own open source projects. https://scan.coverity.com/ https://scan.coverity.com/