y2038: eliminate false positives with automatic build system detection #7631
Conversation
|
Thanks for you contribution. Please add Also please add yourself to |
Hiesx
force-pushed
the
feature/y2038_buildsystem_detection
branch
from
ba0a6d5 to
9edcaf2
Compare
|
Added the buildsystem.py to |
There was a problem hiding this comment.
I haven't really looked at the python code yet. Spontanously I feel this is very interesting and will make the y2038 more useful!
It's unfortunate that the doc/y2038.txt is a text document. It would probably make sense to switch to markdown. And I'm not sure why we don't have the info in the manual instead.
https://github.com/danmar/cppcheck/blob/main/man/manual.md#y2038py
I don't understand why the manual points at https://github.com/3adev/y2038
do you think that makes sense?
The Y2038 addon currently generates false positive warnings when scanning codebases that are properly configured for Y2038 safety through build system flags, making it impractical for comprehensive codebase analysis. This prevents teams from running Y2038 checks across entire projects in CI/CD pipelines due to noise from correctly configured code. Add automatic build system detection to discover Y2038-related compiler flags (_TIME_BITS=64, _FILE_OFFSET_BITS=64, _USE_TIME_BITS64) from: - Makefile variants (Makefile, makefile, GNUmakefile, *.mk) - CMake files (CMakeLists.txt, *.cmake) - Meson build files (meson.build) - Autotools scripts (configure, configure.ac, configure.in) - Compiler flags passed via cppcheck -D options When proper Y2038 configuration is detected (both _TIME_BITS=64 AND _FILE_OFFSET_BITS=64), suppress Y2038 warnings and display an informational message indicating the configuration source. Implement hierarchical directory search up to 5 levels from source files to locate relevant build files, with flag precedence: build system > compiler flags > source code #define directives. Add performance optimizations: - Intelligent file caching with TTL-based invalidation - UTF-8 BOM handling for cross-platform compatibility - Robust import fallback system Extend test suite with comprehensive coverage: - Compiler flag parsing edge cases (18 test scenarios) - Build system detection for all supported formats - Caching behavior and performance validation - Cross-platform file encoding handling This enables organizations to run comprehensive Y2038 analysis on entire codebases without false positives from properly configured projects, while maintaining detection of actual Y2038 safety issues.
Hiesx
force-pushed
the
feature/y2038_buildsystem_detection
branch
from
9edcaf2 to
e84499e
Compare
|
I also moved from the |
| for Y2038 safety. This enables analysis of entire codebases without being | ||
| overwhelmed by warnings from correctly configured code. | ||
|
|
||
| ### Key improvements in this version: |
There was a problem hiding this comment.
This feels more like text for a release notes document. Please write text that will be fully applicable in later releases also not just the next release.
We have a releasenotes.txt file in the rootfolder where you can describe the improvements you've made.
| ### Build System Detection: | ||
| The addon automatically searches for and parses the following build files: | ||
| - Makefiles (`Makefile`, `makefile`, `GNUmakefile`, `*.mk`) | ||
| - CMake files (`CMakeLists.txt`, `*.cmake`) |
There was a problem hiding this comment.
can you get the information you need from a compile_commands.json file? then there is no need to handle cmake/.. explicitly if those can generate the compile_commands.json?
The Y2038 addon currently generates false positive warnings when scanning
codebases that are properly configured for Y2038 safety through build
system flags, making it impractical for comprehensive codebase analysis.
This prevents teams from running Y2038 checks across entire projects in
CI/CD pipelines due to noise from correctly configured code.
Add automatic build system detection to discover Y2038-related compiler
flags (_TIME_BITS=64, _FILE_OFFSET_BITS=64, _USE_TIME_BITS64) from:
When proper Y2038 configuration is detected (both _TIME_BITS=64 AND
_FILE_OFFSET_BITS=64), suppress Y2038 warnings and display an
informational message indicating the configuration source.
Implement hierarchical directory search up to 5 levels from source files
to locate relevant build files, with flag precedence: build system >
compiler flags > source code #define directives.
Add performance optimizations:
Extend test suite with comprehensive coverage:
This enables organizations to run comprehensive Y2038 analysis on entire
codebases without false positives from properly configured projects,
while maintaining detection of actual Y2038 safety issues.