Coverity on Polaris CLI Phases

Phase 1 of 7: Initialize

The first phase in the Coverity on Polaris analysis life cycle, initialize, checks the server status and validates the access token. If Coverity on Polaris cannot determine a server URL, you are prompted for one. If an access token cannot be located, you are prompted for one.

Phase 2 of 7: Setup

In the setup phase, Coverity on Polaris gathers as much information as it can about your project, then generates a configuration file. For example, if your project is in a Git or Subversion repository, Coverity on Polaris uses the repository name for the project name. Failing that, the directory name is used as the project name.

Build settings in the configuration file are inferred based on available build files in the project directory, such as Makefile, pom.xml, or build.xml.

Non-compiled artifacts, such as Python or JavaScript files, are captured by default, although you can edit the configuration YML file to modify this behavior.

The options for the polaris setup command affect the options that are placed into the configuration file. If the configuration file already exists, the setup phase does not overwrite it.

Phase 3 of 7: Configure

The configure phase validates the configuration file. If you have made changes to your configuration file, use the configure phase to verify that the configuration file passes validation.

Phase 4 of 7: Install

The install phase downloads tools that are needed for analysis. This phase determines which tools are necessary, and downloads the respective tools from the server. These tools generate the data submitted to the server for analysis.

The default tools storage location is .blackduck/polaris in your home directory. You can specify an alternate location using the POLARIS_HOME environment variable.

Phase 5 of 7: Capture

In the capture phase, Coverity on Polaris rides along with your project's build to capture source files for analysis. The capture phase determines:

• What is analyzed based on the configuration file.
• Runs a build.
• Saves data to the work directory.

The default work directory is .blackduck/polaris in your project directory. You can change this with a captureDir entry in the configuration file.

This phase also:

• Attempts to clean up the project, using the cleanCommands defined in the configuration file.
• Runs a build as defined by buildCommands in the configuration file.

As the build progresses, Coverity on Polaris extracts the data it needs and saves it in the work directory. You can override the build command at the command line.

Phase 6 of 7: Prepare

The prepare phase completes any final processing before the artifacts are analyzed. This might vary, depending on the tools used.

NOTE: Currently, IP sensitive source is not stripped out of the capture directory.

Phase 7 of 7: Analyze

The analyze phase:

• Submits prepared artifacts for analysis.
• Uploads the capture directory to the Coverity on Polaris server where the submitted artifacts are analyzed.
• Publishes analysis results to the Coverity on Polaris UI.

The JobID displays near the top of your scan results. At a glance, you can see the summary of issues by severity, including the total number of issues discovered in your scan. The issues are listed by severity level:

• High
• Medium
• Low
• Audit

NOTE: Audit is reported if you are running Coverity analysis with audit checkers enabled. Issues with audit severity show a possible security vulnerability with only partial evidence. They require a manual review for complete evidence.

To view complete scan results in Coverity on Polaris, paste the provided summary URL into your browser address bar and press Enter.