Static code analysis
- 1. 1/21/2016 1
- 2. What Is Static Code Analysis? Why Static Code Analysis Is Useful? Seven axes of code quality Effects of Fixing Code Quality Static coda analysis tools ◦ Sonarqube ◦ Coverity 1/21/2016 2
- 3. Static code analysis is a method of computer program debugging that is done by examine in the code without executing the program. 1/21/2016 3
- 4. From W. S. Humphrey, "Using a Defined and Measured Personal Software Process," IEEE Software, May, 1996 “Even experienced programmers typically make a mistake for every seven to ten lines of code they develop.” 1/21/2016 4
- 5. 1/21/2016 5
- 6. monitoring and fixing code quality issues is something that is proven to raise the quality of your application AND your ability to deliver that application to stakeholders on time. 1/21/2016 6
- 7. 1/21/2016 7
- 8. 1/21/2016 8
- 9. What is SonarQube Code quality Features Benefits Strength of the platform 1/21/2016 9
- 10. Platform to manage code quality. Open source, possible to pay for support and some plug- ins. Active community support, plug-ins,books 1/21/2016 10
- 11. 1/21/2016 11
- 12. 1/21/2016 12
- 13. 1/21/2016 13
- 14. Platform Independent Runs on Windows, Mac OSX, Linux, Solaris. Server is fairly light weight. Plug-in architecture Vibrant community extending sonar functionalities Plug-ins for nearly every language you can expect. Plug-ins providing additional metrics, including total quality, technical debt and more. 1/21/2016 14
- 15. Total cost of ownership Functional coverage Continuous inspection Actionable reporting Interaction Strong community Languages coverage Extensibility 1/21/2016 15
- 16. 1/21/2016 16
- 17. 1/21/2016 17
- 18. 1/21/2016 18
- 19. User runs client to analyze source Analyzer sends data on source files to database Web server provides presentation for violation data, administration for users and analyses, configuration of plug-ins, features and functionalities. 1/21/2016 19
- 20. 1/21/2016 20
- 21. Coverity Static Analysis (CSA) helps developers find hard-to-spot, yet potentially crash-causing defects early in the software development life-cycle, reducing the cost, time, and risk of software errors 1/21/2016 21
- 22. Concurency Defects Performance degradation Crash causing errors Incorrect program behavior Security Vulnarabilities 1/21/2016 22
- 23. 1/21/2016 23
- 24. 1/21/2016 24
- 25. API usage errors Code maintainability issues Concurrent data access violations Control flow issues Error handling issues Incorrect expression Integer handling issues Memory - corruptions Memory - illegal accesses Null pointer dereferences Program hangs Resource leaks Security best practices violations Uninitialized variables 1/21/2016 25
- 26. 1/21/2016 26
- 27. Best of Bread Analysis Integration With The Developer Workflow Defect Management and Impact Management Performance and Scale Extensible Platform 1/21/2016 27
- 28. Supported Platforms Supported Compilers Supported IDEs Minimum System Requiremets • AIX • FreeBSD • HP-UX • Linux • Mac OS X • NetBSD • Solaris • Windowss • ARM • Cosmic C Cross Compilers • Freescale Code Warrior • GNU GCC, G++ • Intel C++ • Keil • QNX • Renesas • Sun (Oracle)CC and cc • Texas Instruments • Visual Studio • WindRiver • Xcode GCC and G++ • Eclipse v3.5, v3.6, v3.7 • WindRiver Workbench v3.2, v3.3 • Visual Studio versions 2005, 2008, and 2010 • 1 GHz CPU • 1 GB of RAM minimum, 2 GB recommended • 1 GB of free hard disk space 1/21/2016 28
- 29. 1/21/2016 29
- 30. Proven significant operational cost reduction. Metric visibility of code estate onshore and offshore. Proven history of finding crash causing or unexpected behavior causing defects. Process improvement of the Application Lifecycle Management. 1/21/2016 30