.. image:: https://img.shields.io/pypi/v/scan-build.svg :target: https://pypi.python.org/pypi/scan-build
.. image:: https://img.shields.io/pypi/l/scan-build.svg :target: https://pypi.python.org/pypi/scan-build
.. image:: https://img.shields.io/pypi/dm/scan-build.svg :target: https://pypi.python.org/pypi/scan-build
.. image:: https://img.shields.io/pypi/pyversions/scan-build.svg :target: https://pypi.python.org/pypi/scan-build
.. image:: https://badges.gitter.im/rizsotto/scan-build.svg :target: https://gitter.im/rizsotto/scan-build?utm_source=badge&utm_medium=badge&utm_campaign=pr-badge&utm_content=badge
A package designed to wrap a build so that all calls to gcc/clang are
intercepted and logged into a compilation database_ and/or piped to
the clang static analyzer. Includes intercept-build tool, which logs
the build, as well as scan-build tool, which logs the build and runs
the clang static analyzer on it.
It's available from the Python Package Index_ ::
$ pip install scan-build
Should be working on UNIX operating systems.
To run the Clang static analyzer against a project goes like this::
$ scan-build <your build command>
To generate a compilation database file goes like this::
$ intercept-build <your build command>
To run the Clang static analyzer against a project with compilation database goes like this::
$ analyze-build
Use --help to know more about the commands.
Generally speaking, the intercept-build and analyze-build tools
together does the same job as scan-build does. So, you can expect the
same output from this line as simple scan-build would do::
$ intercept-build <your build command> && analyze-build
The major difference is how and when the analyzer is run. The scan-build
tool has three distinct model to run the analyzer:
Use compiler wrappers to make actions.
The compiler wrappers does run the real compiler and the analyzer.
This is the default behaviour, can be enforced with --override-compiler
flag.
Use special library to intercept compiler calls during the build process.
The analyzer run against each modules after the build finished.
Use --intercept-first flag to get this model.
Use compiler wrappers to intercept compiler calls during the build process.
The analyzer run against each modules after the build finished.
Use --intercept-first and --override-compiler flags together to get
this model.
The 1. and 3. are using compiler wrappers, which works only if the build
process respects the CC and CXX environment variables. (Some build
process can override these variable as command line parameter only. This case
you need to pass the compiler wrappers manually. eg.: intercept-build --override-compiler make CC=intercept-cc CXX=intercept-c++ all where the
original build command would have been make all only.)
The 1. runs the analyzer right after the real compilation. So, if the build process removes removes intermediate modules (generated sources) the analyzer output still kept.
The 2. and 3. generate the compilation database first, and filters out those modules which are not exists. So, it's suitable for incremental analysis during the development.
The 2. mode is available only on FreeBSD, Linux and OSX. Where library preload is available from the dynamic loader. Security extension/modes on different operating systems might disable library preload. This case the build behaves normally, but the result compilation database will be empty. (Notable examples for enabled security modes are: SIP on OS X Captain and SELinux on Fedora, RHEL and CentOS.) The program checks the security modes for SIP, and falls back to 3. mode.
intercept-build command uses only the 2. and 3. mode to generate the
compilation database. analyze-build does only run the analyzer against the
captured compiler calls.
Because it uses LD_PRELOAD or DYLD_INSERT_LIBRARIES environment variables,
it does not append to it, but overrides it. So builds which are using these
variables might not work. (I don't know any build tool which does that, but
please let me know if you do.)
If you find a bug in this documentation or elsewhere in the program or would
like to propose an improvement, please use the project's issue tracker_.
Please describing the bug and where you found it. If you have a suggestion
how to fix it, include that as well. Patches are also welcome.
The project is licensed under University of Illinois/NCSA Open Source License. See LICENSE.TXT for details.
.. _compilation database: http://clang.llvm.org/docs/JSONCompilationDatabase.html .. _the Python Package Index: https://pypi.python.org/pypi/scan-build .. _issue tracker: https://github.com/rizsotto/scan-build/issues
FAQs
static code analyzer wrapper for Clang.
We found that scan-build demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
PyPI confirms no security flaws were exploited in the Ultralytics supply chain attack and highlights improvements for safer package publishing.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.