{"action":"created","issue":{"url":"https://api.github.com/repos/awslabs/s2n/issues/264","repository_url":"https://api.github.com/repos/awslabs/s2n","labels_url":"https://api.github.com/repos/awslabs/s2n/issues/264/labels{/name}","comments_url":"https://api.github.com/repos/awslabs/s2n/issues/264/comments","events_url":"https://api.github.com/repos/awslabs/s2n/issues/264/events","html_url":"https://github.com/awslabs/s2n/issues/264","id":165439655,"number":264,"title":"Integrate Static Code Analysis into Travis Builds","user":{"login":"alexw91","id":3596374,"avatar_url":"https://avatars.githubusercontent.com/u/3596374?v=3","gravatar_id":"","url":"https://api.github.com/users/alexw91","html_url":"https://github.com/alexw91","followers_url":"https://api.github.com/users/alexw91/followers","following_url":"https://api.github.com/users/alexw91/following{/other_user}","gists_url":"https://api.github.com/users/alexw91/gists{/gist_id}","starred_url":"https://api.github.com/users/alexw91/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/alexw91/subscriptions","organizations_url":"https://api.github.com/users/alexw91/orgs","repos_url":"https://api.github.com/users/alexw91/repos","events_url":"https://api.github.com/users/alexw91/events{/privacy}","received_events_url":"https://api.github.com/users/alexw91/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2016-07-13T22:52:23Z","updated_at":"2016-07-30T07:20:56Z","closed_at":null,"body":"Coverity is a popular static code analyzer integrated into a lot of Github projects, but this issue could apply to any similar static code analyzer.\r\n\r\n### Overview\r\nI think it would be a good idea to integrate Coverity Static Code analysis into the Travis build to catch any errors that might be missed during human review. It is currently used by the Linux Kernel, OpenSSL, and Python, all of which seem to have good experiences with it, and all saying that it has helped their defect rate go down. \r\n\r\nIf it were to be integrated, any issues found by Coverity Static analysis would be kept private and only accessible to developers of s2n until the issues are fixed.\r\n\r\nThere is some rate limiting on the number of scans that are allowed, but it seems high enough for the number of changes/commits that s2n is getting. From their website: \r\n> Up to 12 builds per week, with a maximum of 3 builds per day, for projects with fewer than 100K lines of code \r\n\r\n### See Also:\r\n- https://scan.coverity.com/faq\r\n- http://codemonkey.org.uk/2014/08/13/year-coverity-linux-kernel-scans/ \r\n- https://scan.coverity.com/o/oss_success_stories\r\n- https://docs.python.org/devguide/coverity.html\r\n- http://security.coverity.com/blog/2014/Apr/on-detecting-heartbleed-with-static-analysis.html"},"comment":{"url":"https://api.github.com/repos/awslabs/s2n/issues/comments/236350323","html_url":"https://github.com/awslabs/s2n/issues/264#issuecomment-236350323","issue_url":"https://api.github.com/repos/awslabs/s2n/issues/264","id":236350323,"user":{"login":"alexw91","id":3596374,"avatar_url":"https://avatars.githubusercontent.com/u/3596374?v=3","gravatar_id":"","url":"https://api.github.com/users/alexw91","html_url":"https://github.com/alexw91","followers_url":"https://api.github.com/users/alexw91/followers","following_url":"https://api.github.com/users/alexw91/following{/other_user}","gists_url":"https://api.github.com/users/alexw91/gists{/gist_id}","starred_url":"https://api.github.com/users/alexw91/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/alexw91/subscriptions","organizations_url":"https://api.github.com/users/alexw91/orgs","repos_url":"https://api.github.com/users/alexw91/repos","events_url":"https://api.github.com/users/alexw91/events{/privacy}","received_events_url":"https://api.github.com/users/alexw91/received_events","type":"User","site_admin":false},"created_at":"2016-07-30T07:20:56Z","updated_at":"2016-07-30T07:20:56Z","body":"I think it's awesome that we've added clang `scan-build` as a build requirement to s2n, but I also believe we should be going for defense in depth here as well, and try to add as many free, low false-positive rate, static code analyzers as possible. Having multiple different static analyzers running during our builds protects us from any blind spots that may be present in any particular analyzer. To give an example, the maintainer of `curl` wrote a [blog post](https://daniel.haxx.se/blog/2012/07/12/three-static-code-analyzers-compared/) about `Coverity` vs `clang` vs `Fortify` analyzers, and found that `Coverity` found about double the security issues that `clang` did, while `Fortify` output a ton of noisy false positives.\r\n\r\nI've looked around a little bit and ended up finding [SANS Institute - Secure Software Development and Code Analysis Tools](https://www.sans.org/reading-room/whitepapers/securecode/secure-software-development-code-analysis-tools-389) which has some relevant recommendations for static analysis tools for C (even though it's almost 15 years out of date). You can look at Appendix A of that document to see example output of the different analyzer output to get a feel for what types of issues are found. \r\n\r\nIt may make sense to add one (or more) of the following as `make` targets and eventually add them as Travis build requirements once we're sufficiently confident that they won't generate false positives:\r\n\r\n1. FlawFinder - [http://www.dwheeler.com/flawfinder/](http://www.dwheeler.com/flawfinder/)\r\n2. RATS (Rough Auditing Tool for Security) - [https://github.com/andrew-d/rough-auditing-tool-for-security](https://github.com/andrew-d/rough-auditing-tool-for-security)\r\n3. Splint (Secure Programming Lint) - [http://www.splint.org/documentation/](http://www.splint.org/documentation/)\r\n\r\nA \"List of Lists\" of C Code Static Analyzers:\r\n\r\n1. https://en.wikipedia.org/wiki/List_of_tools_for_static_code_analysis#C.2C_C.2B.2B\r\n2. http://www.dwheeler.com/essays/static-analysis-tools.html\r\n3. https://www.owasp.org/index.php/Source_Code_Analysis_Tools\r\n4. https://samate.nist.gov/index.php/Source_Code_Security_Analyzers.html"}}
{"actor":{"display_login":"alexw91"}}