Re: Static Analysis: results of FUDcon Lawrence hackfest

2013-01-25 Thread Kevin Fenzi
On Thu, 24 Jan 2013 17:41:29 -0600 Josh Bressers wrote: > On Thu, Jan 24, 2013 at 10:44 AM, David Malcolm > wrote: > > > > > Anyone interested in helping with this? There's plenty of scope > > for getting involved: > > * building the web UI for dealing with the results (any Python web > > dev

Re: Static Analysis: results of FUDcon Lawrence hackfest

2013-01-25 Thread Kamil Dudka
On Friday, January 25, 2013 18:17:09 Richard W.M. Jones wrote: > On Fri, Jan 25, 2013 at 10:35:29AM -0500, David Malcolm wrote: > > As Kamil points out elsewhere in this thread, what we need are automated > > tools that can run on code and emit warnings, without needing human > > intervention. > >

Re: Static Analysis: results of FUDcon Lawrence hackfest

2013-01-25 Thread Richard W.M. Jones
On Fri, Jan 25, 2013 at 10:35:29AM -0500, David Malcolm wrote: > As Kamil points out elsewhere in this thread, what we need are automated > tools that can run on code and emit warnings, without needing human > intervention. My point was that there are two sorts of analysis. The kind which is comm

Re: Static Analysis: results of FUDcon Lawrence hackfest

2013-01-25 Thread David Malcolm
On Fri, 2013-01-25 at 08:01 -0700, Jerry James wrote: > On Fri, Jan 25, 2013 at 5:16 AM, Kamil Dudka wrote: > > On Thursday, January 24, 2013 14:11:11 Jerry James wrote: > >> It is not, but see http://jjames.fedorapeople.org/blast/ for an > >> experimental RPM. If we could get the Vampyre develop

Re: Static Analysis: results of FUDcon Lawrence hackfest

2013-01-25 Thread Kamil Dudka
On Friday 25 January 2013 16:01:15 Jerry James wrote: > On Fri, Jan 25, 2013 at 5:16 AM, Kamil Dudka wrote: > > On Thursday, January 24, 2013 14:11:11 Jerry James wrote: > >> It is not, but see http://jjames.fedorapeople.org/blast/ for an > >> experimental RPM. If we could get the Vampyre develop

Re: Static Analysis: results of FUDcon Lawrence hackfest

2013-01-25 Thread Daniel P. Berrange
On Fri, Jan 25, 2013 at 10:35:29AM -0500, David Malcolm wrote: > On Fri, 2013-01-25 at 13:03 +, Daniel P. Berrange wrote: > > On Fri, Jan 25, 2013 at 12:51:13PM +, Richard W.M. Jones wrote: > > > On Fri, Jan 25, 2013 at 01:18:43PM +0100, Kamil Dudka wrote: > > > > On Friday, January 25, 201

Re: Static Analysis: results of FUDcon Lawrence hackfest

2013-01-25 Thread David Malcolm
On Fri, 2013-01-25 at 13:03 +, Daniel P. Berrange wrote: > On Fri, Jan 25, 2013 at 12:51:13PM +, Richard W.M. Jones wrote: > > On Fri, Jan 25, 2013 at 01:18:43PM +0100, Kamil Dudka wrote: > > > On Friday, January 25, 2013 09:07:22 Richard W.M. Jones wrote: > > > > On Thu, Jan 24, 2013 at 02

Re: Static Analysis: results of FUDcon Lawrence hackfest

2013-01-25 Thread Jerry James
On Fri, Jan 25, 2013 at 5:16 AM, Kamil Dudka wrote: > On Thursday, January 24, 2013 14:11:11 Jerry James wrote: >> It is not, but see http://jjames.fedorapeople.org/blast/ for an >> experimental RPM. If we could get the Vampyre developers to remove >> "for research purposes only" from their licen

Re: Static Analysis: results of FUDcon Lawrence hackfest

2013-01-25 Thread Daniel P. Berrange
On Fri, Jan 25, 2013 at 12:51:13PM +, Richard W.M. Jones wrote: > On Fri, Jan 25, 2013 at 01:18:43PM +0100, Kamil Dudka wrote: > > On Friday, January 25, 2013 09:07:22 Richard W.M. Jones wrote: > > > On Thu, Jan 24, 2013 at 02:11:11PM -0700, Jerry James wrote: > > > > Note that we also have why

Re: Static Analysis: results of FUDcon Lawrence hackfest

2013-01-25 Thread Richard W.M. Jones
On Fri, Jan 25, 2013 at 01:18:43PM +0100, Kamil Dudka wrote: > On Friday, January 25, 2013 09:07:22 Richard W.M. Jones wrote: > > On Thu, Jan 24, 2013 at 02:11:11PM -0700, Jerry James wrote: > > > Note that we also have why and why3 in Fedora, by the way. > > > > .. and ocaml-cil. > > CIL can be

Re: Static Analysis: results of FUDcon Lawrence hackfest

2013-01-25 Thread Kamil Dudka
On Friday, January 25, 2013 09:07:22 Richard W.M. Jones wrote: > On Thu, Jan 24, 2013 at 02:11:11PM -0700, Jerry James wrote: > > Note that we also have why and why3 in Fedora, by the way. > > .. and ocaml-cil. CIL can be used as a front-end for a static analysis tool or a C preprocessor for sta

Re: Static Analysis: results of FUDcon Lawrence hackfest

2013-01-25 Thread Kamil Dudka
On Thursday, January 24, 2013 14:11:11 Jerry James wrote: > It is not, but see http://jjames.fedorapeople.org/blast/ for an > experimental RPM. If we could get the Vampyre developers to remove > "for research purposes only" from their license, we could get both > Vampyre and BLAST into Fedora. >

Re: Static Analysis: results of FUDcon Lawrence hackfest

2013-01-25 Thread Alec Leamas
On 2013-01-24 23:39, Alec Leamas wrote: On 2013-01-24 22:03, David Malcolm wrote: On Thu, 2013-01-24 at 18:11 +0100, Alec Leamas wrote: On 2013-01-24 17:44, David Malcolm wrote: Michael Hrivnak and I spent some time at FUDcon Lawrence looking at static code analysis. We hacked on the proposed

Re: Static Analysis: results of FUDcon Lawrence hackfest

2013-01-25 Thread Richard W.M. Jones
On Thu, Jan 24, 2013 at 02:11:11PM -0700, Jerry James wrote: > Note that we also have why and why3 in Fedora, by the way. .. and ocaml-cil. Rich. -- Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones virt-p2v converts physical machines to virtual machines. Boot with

Re: Static Analysis: results of FUDcon Lawrence hackfest

2013-01-24 Thread Josh Bressers
On Thu, Jan 24, 2013 at 10:44 AM, David Malcolm wrote: > > Anyone interested in helping with this? There's plenty of scope for > getting involved: > * building the web UI for dealing with the results (any Python web > developers out there?) [2] > * packaging more static analyzers in Fedora (e.g

Re: Static Analysis: results of FUDcon Lawrence hackfest

2013-01-24 Thread Alec Leamas
On 2013-01-24 22:03, David Malcolm wrote: On Thu, 2013-01-24 at 18:11 +0100, Alec Leamas wrote: On 2013-01-24 17:44, David Malcolm wrote: Michael Hrivnak and I spent some time at FUDcon Lawrence looking at static code analysis. We hacked on the proposed common format for analysis tools (aka "f

Re: Static Analysis: results of FUDcon Lawrence hackfest

2013-01-24 Thread Jerry James
On Thu, Jan 24, 2013 at 1:56 PM, David Malcolm wrote: > Aha! Thanks - yes, I now see that it's packaged at "frama-c". I've > updated the StaticAnalysis wiki page accordingly. > > Anyone here familiar with it? I've done some *very* basic playing around with it, nothing advanced. I'm still trying

Re: Static Analysis: results of FUDcon Lawrence hackfest

2013-01-24 Thread David Malcolm
On Thu, 2013-01-24 at 18:11 +0100, Alec Leamas wrote: > On 2013-01-24 17:44, David Malcolm wrote: > > Michael Hrivnak and I spent some time at FUDcon Lawrence looking at > > static code analysis. > > > > We hacked on the proposed common format for analysis tools (aka > > "firehose"). > > > [cut] >

Re: Static Analysis: results of FUDcon Lawrence hackfest

2013-01-24 Thread David Malcolm
On Thu, 2013-01-24 at 10:04 -0700, Jerry James wrote: > On Thu, Jan 24, 2013 at 9:44 AM, David Malcolm wrote: > > * packaging more static analyzers in Fedora (e.g. has anyone looked at > > Frama-C ?) > > Frama-C has been in Fedora for nearly 3 years now. :-) Aha! Thanks - yes, I now see that it

Re: Static Analysis: results of FUDcon Lawrence hackfest

2013-01-24 Thread Alec Leamas
On 2013-01-24 17:44, David Malcolm wrote: Michael Hrivnak and I spent some time at FUDcon Lawrence looking at static code analysis. We hacked on the proposed common format for analysis tools (aka "firehose"). [cut] The plan is that the interchange format can be uploaded into a web UI/databas

Re: Static Analysis: results of FUDcon Lawrence hackfest

2013-01-24 Thread Jerry James
On Thu, Jan 24, 2013 at 9:44 AM, David Malcolm wrote: > * packaging more static analyzers in Fedora (e.g. has anyone looked at > Frama-C ?) Frama-C has been in Fedora for nearly 3 years now. :-) I'm very interested in this topic. I tried packaging BLAST at one point, but ran into insurmountable

Static Analysis: results of FUDcon Lawrence hackfest

2013-01-24 Thread David Malcolm
Michael Hrivnak and I spent some time at FUDcon Lawrence looking at static code analysis. We hacked on the proposed common format for analysis tools (aka "firehose"). We now have parsers (and test suites) for coercing the following into a common format: * gcc warnings * "cppcheck" warnings (spe