Project-specific ‘coverity.conf’ files

Use case: Your build uses the ARM (RISC) compiler rather than the more widespread GCC (GNU Compiler Collection). The following coverity.conf code specifies this:

{
    "type": "Coverity configuration",
    "format_version": 1,
    "format_minor_version": 7,
    "settings": {
        "add_compiler_configurations": [
            /* arm-none-eabi-gcc is a common gcc variant
               for ARM-based embedded development */
            {
                "cov_configure_args": [
                    "--template",
                    "--compiler",
                    "arm-none-eabi-gcc",
                    "--comptype",
                    "gcc"
                ]
            }
        ]
    }
}

Use case: You want to continue using the Clang compiler front end, but you want to invoke it using the old-style (and self-descriptive) aliases cc and c++. The following coverity.conf code specifies this:

{
    "type": "Coverity configuration",
    "format_version": 1,
    "format_minor_version": 7,
    "settings": {
        "add_compiler_configurations": [
            /* On a Mac, CMake will use the "cc" and "c++" aliases
               instead of "clang" */
            {
                "cov_configure_args": [
                    "--template",
                    "--compiler",
                    "cc",
                    "--comptype",
                    "clangcc"
                ]
            },
            {
                "cov_configure_args": [
                    "--template",
                    "--compiler",
                    "c++",
                    "--comptype",
                    "clangcxx"
                ]
            }
        ]
    }
}

Here is a sample configuration file that contains a cov_run_desktop object:

{
    "type": "Coverity configuration",
    "format_version": 1,
    "format_minor_version": 7,
    "settings": {
        "cov_run_desktop": {
            "build_cmd": ["make", "all"],
            "clean_cmd": ["make", "clean"]
        },
        "ide": {
            "build_strategy": "CUSTOM"
        }
    }
}

This particular sample configuration sets up a project that uses the make build system. In your own file, you would replace the "build_cmd" and "clean_cmd" values with the names of the build and clean commands that your project actually uses.

For example, to use Apache Maven as your build tool, the "cov_run_desktop" fields would look like this:

        "cov_run_desktop": {
            "build_cmd": ["mvn", "compile"],
            "clean_cmd": ["mvn", "clean"]
        }

Don’t forget: In the "ide" object, you must set "build_strategy" to equal "CUSTOM". If this field is missing, or is set to a different value, Code Sight does not recognize the custom settings, or use the alternative tools you specified.

Before you begin to configure Bazel, please see the "requirements and limitations" for Coverity and Bazel.

To enable the Coverity-Bazel integration:

1. Follow the steps in the Coverity documentation: See "Building with Bazel" in the Coverity Analysis User and Administrator Guide.

   You will need to modify the Bazel build file and either the workspace file or the module file. More steps are needed if you use Bazel 7 or a newer version.

2. Add a coverity.conf file to the root of your project and configure it for Bazel support.

   Here is an example of such a configuration file:

   {
       "type": "Coverity configuration",
       "format_version": 1,
       "format_minor_version": 7,
       "settings": {
           "cov_run_desktop": {
               "build_options": [
                   "--bazel"
               ],
               "build_cmd": [
                   "bazel",
                   "build",
                   "--registry=file:///<myLocn>/../../cov-registry",
                   "--registry=http://<myURL>/../packages/bazel/central-registry",
                   ":coverity_build"
               ]
           },
           "ide": {
               "build_strategy": "CUSTOM"
           }
       }
   }

   If you already have a project-specific coverity.conf file, add the "settings" fields to it.

There are two ways to exclude files or directories from a Coverity Analysis scan, as the following sections describe.

• Use the project-specific coverity.conf file

Add the following "settings" section to this file:

{
    "type": "Coverity configuration",
    "format_version": 1,
    "format_minor_version": 7,
    "settings": {
        "cov_run_desktop": {
            "ignore_all_files_regex":"<regex>"
        }
    }
}

• Use the Advanced options for your Coverity scan configuration

Add the option string to the Coverity section of the Advanced section of the Scan Configuration dialog (IntelliJ) or tab (VS Code).

The regular expression

In either case, the format of the string represented by <regex> depends on the operating system that you use:

Linus or macOS

Here is an example:

.*/<folder_name>/.*

Windows

Here is an example:

.*\\\\<folder_name>\\\\.*

Setting up Kotlin analysis

To enable Kotlin analysis in Android Studio, you must first run the cov-configure --kotlin command to enable the build capture of Kotlin Android source and the filesystem capture of Android configuration files.

You also need to specify --fs-capture-search when you invoke the cov-build command. Coverity will capture Kotlin Android files that are needed by the analysis, including the manifest (AndroidManifest.xml) and the layout resource files.

No special flags are needed for the cov-analyze command, because Kotlin checkers are enabled by default.

Setting up Kotlin/Java analysis

Run both cov-configure --java and cov-configure --kotlin to enable the build capture of both Java and Kotlin Android source and the filesystem capture of Android configuration files. (Filesystem capture can be used as a fallback only for Java.)

Pass --fs-capture-search to the cov-build command. Coverity will capture Java and Kotlin Android files that are needed by the analysis, including the manifest (AndroidManifest.xml) and the layout resource files.

Specify --android-security when you invoke the cov-analyze command.

Sample coverity.conf code for both use cases

Here is an example of a coverity.conf file that meets the requirements for analyzing Kotlin and analyzing a Kotlin/Java combined project:

{
    "type": "Coverity configuration",
    "format_version": 1,
    "format_minor_version": 7,
    "settings": {
        "cov_run_desktop": {
            "build_cmd": ["./gradlew", "build"],
            "build_options": [
                "--fs-capture-search", "<project_directory>"
            ],
            "analysis_args":["--android-security"],
            "clean_cmd": ["./gradlew", "clean"]
        },
                
        "ide": {
            "build_strategy": "CUSTOM"
        },
        "add_compiler_configurations": [
             { "cov_configure_args": ["--kotlin"] }
        ]

    }
}

In your project-specific coverity-conf file, add the string "--kotlin" to the compiler configuration settings. In the same file, specify custom build and clean commands that are compatible with Kotlin.

The following code sample shows a bare-minimum coverity.conf file that can be used to analyze a Kotlin project:

{
    "type": "Coverity configuration",
    "format_version": 1,
    "format_minor_version": 7,
    "settings": {
        "cov_run_desktop": {       
            "build_cmd": ["gradle", "build"],
            "clean_cmd": ["gradle", "clean"]     
        },
        "ide": {       
            "build_strategy": "CUSTOM"     
        },
        "add_compiler_configurations": [
            { "cov_configure_args": ["--kotlin"] }
        ]
    }
}

-Pkotlin.compiler.execution.strategy=in-process

To enable MISRA testing, add the following entry to the "settings" section of the current coverity.conf file:

"cov_run_desktop": {
    "coding_standard_configs": [
        "$(code_base_dir)/MISRA_c2012_7.config"
    ]
}

Changing the settings used for Coverity Analysis is described in existing documentation. We won’t go into details here. If you do edit coverity.conf to specify custom settings, proceed with caution.

These are resources that provide more information about editing coverity.conf:

• The Coverity Desktop Analysis User Guide describes the coverity.conf settings in detail.

  The Coverity document set, which includes the Desktop Analysis User Guide, where coverity.conf is described, is installed on a client system when Coverity Analysis is installed.

  The default location of these documents depends on the operating system you are using. See the following table:

  Table 1. Where Coverity docs are installed by default

  Platform	Location of Coverity documents
  Linux or Mac	/Users/<username>/.blackduck/desktop/controller/installedtools/coverity-analysis/<version>/doc/en/
  Windows	C:\Users\<Username>\AppData\Roaming\BlackDuck\desktop\controller\installedtools\coverity-analysis\<version>\doc\en\

• The following lesson on the Black Duck Community web site describes how to edit coverity.conf for use with Code Sight: “How to Set Up the Coverity Desktop Analysis Configuration File – coverity.conf”.