The analyze Section

Coverity on Polaris
Version
latest
The analyze section of the configuration makes it possible to specify additional information about how analysis should be performed. Changing between local and central analysis does not alter the results, as long as the configuration file remains otherwise unchanged.

Mode

Specify the use of the Coverity analysis engine as a local instance or in the Coverity on Polaris server (central).

Syntax

analyze:
  mode: "local" | "central"
Table 1. Coverity mode properties
Name Description
local Uses a local instance of the Coverity analysis engine. Coverity on Polaris can detect your Coverity license or request a new one if needed. It also installs the Coverity Analysis tools in your POLARIS_HOME directory if they're not already installed. The results are available in your Coverity on Polaris dashboard, as usual.
Note: Local analysis is not supported on ARM machines.
central Uses the Coverity analysis engine that is in the Coverity on Polaris server.

When organizations use central analysis, the CLI utilizes either the capture kit or their full analysis tool for the capture phase. The CLI attempts to use them in the following order:

  1. The capture kit, if it is available in POLARIS_HOME.
  2. The full analysis tool, if the specified version is available in POLARIS_HOME.
  3. The full analysis tool, if the specified version is installed elsewhere.
  4. A capture kit that the CLI downloads from the Coverity on Polaris tool service if none of the preceding options are available.

This mode is the default.

cov-analyze

Customizes your analysis by allowing you to select Coverity cov-analyze command options.

Syntax
analyze:
  coverity:
    cov-analyze:
    - "<--option1>"
    - "<value1>"
    - "<--option2>"
Table 2. Coverity cov-anaylze properties
Name Description
cov-analyze Coverity on Polaris doesn't support all the options available on standalone Coverity. For a complete listing of available Coverity options, refer to Available Coverity Analyze Options.

Options are the Coverity checkers or groups of checkers used with the cov-analyze command. Each checker detects specific types of issues in your source code. If you run a multi-language analysis, the checkers that are enabled for the analysis will run on all languages to which they apply. An option can have a value.

Options and checker defaults

  • --disable-sigma allows you to disable Rapid Scan Static (the Sigma analysis engine), if you want to turn it off in order to decrease the number of low-severity issues.
  • In the setup phase, no values are generated for this section. In that case, Coverity on Polaris uses the following default options: 
--webapp-security --android-security
  • If you specify options for the analysis, those options replace the default options.
  • In either case, the default Coverity checker set is also enabled unless explicitly disabled using --disable-default. That option disables all the default checkers enabled by Coverity.
  • In addition, the following analysis options are always appended when you use the analyze command:
--jobs 8 --skip-webapp-sanity-check --skip-android-app-sanity-check

Examples

Note that --option can stand for one or more options supported by Coverity on Polaris.

For example, if you want to use the cov-analyze option along with --aggressiveness-level low, specify it as: 

analyze:
  coverity:
    cov-analyze: 
    ["--aggressiveness-level", "low"]

If your settings include several options, the syntax is: 

analyze:
  coverity:
    cov-analyze: 
    ["--aggressiveness-level", "low",
     "--analyze-node-modules",
     "--disable-webapp-security"
     "--disable-sigma"]

Example for the RISKY_CRYPTO checker:

analyze:
  coverity:
    cov-analyze: 
    ["--disable-default", 
     "-en", "RISKY_CRYPTO", 
     "--checker-option", "RISKY_CRYPTO:assume_fips_mode:false"]

Caching

You can improve performance by allowing Coverity to cache files, libraries, and other artifacts.

Syntax

analyze:
  coverity:
    caching:
      dlls: "disable" | "enable"
      jars: "disable" | "enable"
      pfi: "disable" | "enable"
      rws: "disable" | "enable"
      tu-caching: "disable" | "enable"
Table 3. Coverity caching properties
Name Description
dlls If enabled, Coverity on Polaris CLI executes cov-build with the --dll-caching flag. The cache will be shared across the organization's projects. The dlls attribute can be used along with pfi, but not with any other caching properties. Disabled by default. (Enabled by default for Coverity 2022.3.4 and 2022.6.0 but is connected to JAR so if you enable/disable one, both are enabled/disabled.)
jars If enabled, Coverity on Polaris CLI will execute cov-build with the --jar-caching flag. Coverity will cache JAR, JMod and JInfo files in the build. The cache will be shared across the organization's projects. Enabled by default. (Enabled by default for Coverity 2022.3.4 and 2022.6.0 but is connected to DLL so if you enable/disable one, both are enabled/disabled.)
pfi pfi stands for “perfect fidelity incremental”. If pfi is enabled, Coverity caches and uses the cache to speed up subsequent analysis. This cache is project and branch-specific. Enabled by default.
rws If enabled, Coverity on Polaris CLI will execute cov-build with the --record-with-source option. Coverity will capture minimal information during the build and perform the remaining capture-related operations on the Coverity on Polaris cloud. Is mutually exclusive with tu-caching. Disabled by default. (Coverity tech preview feature)
tu-caching Similar to rws, but also stores the previous build data in the cache. Minimizes capture-related operations on the Coverity on Polaris cloud by saving the results from previous builds in the cache. Is project- and branch-specific. Is complementary to jars but is mutually exclusive with rws. Disabled by default. (Coverity tech preview feature)

Examples to Enable or Disable JAR Caching and DLL Caching

When scanning Java projects, Coverity on Polaris improves performance by allowing Coverity to cache JAR files and other artifacts. You can disable it by adding the following properties to the polaris.yml file. 

analyze:
  mode: central
  coverity:
    caching:
      jars: disable

When scanning .NET projects and using central analysis, caching dynamic link libraries can improve performance. You can disable it as follows.

analyze:
  mode: central
  coverity:
    caching:
      dlls: disable

BUDA Engine

Syntax

analyze:
  coverity:
    usebudaforjavadotnet: "enable" | "disable"
Table 4. Coverity BUDA engine properties
Name Description
usebudaforjavadotnet Enable the BUDA engine for security analysis which provides more accurate incremental analysis (LCA) of Java and .NET code. Disabled by default.