Whatever happened to Coverity?

Wednesday, September 17. 2008

Whatever happened to Coverity?

Once upon a time we had the whole of KDE included in Coverity's code quality checker, which they kindly offer (offered?) for free to FOSS projects. Coverity's analysis is tremendously helpful in finding really twisted bugs, and has in the past helped to fix countless complicated issues in KDE code.

All was fine until 2008-Apr-24, when the scan apparently stopped for technical reasons. The last I heard of the problem was that Dirk is still waiting for a reply from them.

We Amarok guys are really keen on getting our code checked again. Not wanting to sit idly and wait, I have in the meantime also contacted Coverity, asking them to check Amarok 2. Sadly, I have not received any reply so far.

Does anyone know what's going on here, and what we could do to accelerate things?

Posted by Mark Kretschmann in markey at 06:30 | Comments (11) | Trackbacks (0)

Trackbacks

Trackback specific URI for this entry

No Trackbacks

Comments

Display comments as (Linear | Threaded)

Coverity is dependent on the build system working; when our dependencies and/or build system change, they need to follow suit. I think the reason was that they didn't have enough people to track everything all the time.

#1 Adriaan de Groot on 2008-09-17 07:30 (Reply)

Maybe someone needs to contact Stanford and tell them their $800,000 gift from DHS has run out?

#2 DHS on 2008-09-17 11:55 (Reply)

Sorry, not getting the reference. Care to elaborate?

#2.1 Mark Kretschmann on 2008-09-17 12:28 (Reply)

I think that DHS stands for "U.S. Department of Homeland Security" (I found it in the wikipedia page you linked).
So I think he's telling that they spent all the money they got from the contract with the DHS.

#2.1.1 Diego (Homepage) on 2008-09-17 12:44 (Reply)

This is the proprietary trap. They aren't profiting from you (you're just free advertising for them) so where's their incentive to put resources into ensuring continued compatibility with your build system? You could help them out by sending them patches -- oh wait, you can't do that... they're proprietary and closed!

Well at least it wasn't an SCM tool with all of your code locked up in it -- it's "merely" QA tools. Now that you realize you can't free ride forever with closed source, if there aren't any open, non-proprietary replacements on par with Coverity's offerings, find the closest thing and help make it better!

#3 Alex on 2008-09-17 12:52 (Reply)

Their incentive in the first place was to get a bunch of people using their system who wouldn't have otherwise. And we have day jobs, so then we might buy it in our companies. That incentive didn't change.

#3.1 Ian Monroe on 2008-09-17 13:11 (Reply)

Exactly my point; that was their initial incentive, that you would help spread their word.

So now they've grown (with the help of our tax dollars, no less!) where's their continued incentive? As a small project, you no longer bring them the level of market visibility they need to justify the level of support (in terms of continuous compatibility) they were devoting to you.

#3.1.1 Alex on 2008-09-17 16:16 (Reply)

Just an idea, but if you're interested in receiving ongoing analysis, we'd be glad to help. Yes, we compete with Coverity. Yes, you might get different results from us than you were getting from them. Yes, we do this for other FOSS projects. No, we're not dependent on US Federal money (nor are they, to be fair).

If you'd like to take us up on this offer, please have one of the committers respond here or e-mail me directly, either works.

Cheers,
Gwyn Fisher
CTO, Klocwork.
gwyn-at-klocwork.com

#4 Gwyn Fisher (Homepage) on 2008-09-17 14:33 (Reply)

Gwyn, thank you very much for your offer. In fact I've already had the pleasure to work with Klocwork on a different project, and we are looking forward to receiving an analysis for Amarok too.

We have already contacted Klocwork a few weeks ago, but your engineer apparently had problems with building Amarok 2. I will contact you soon via email.

#4.1 Mark Kretschmann on 2008-09-17 18:05 (Reply)

Hi Mark,

We have been working on getting our new build servers set up. It has taken a while, but they're serving up builds now. KDE is 3rd from the top of my list of projects with build issues to get cleaned up, so you will start seeing regular builds again shortly.

Re: DHS - the actual dollar figure Coverity received for the Open Source Hardening Project was a total of $300,000 for the three year effort.

Despite the fact that those three years are almost at an end, we'll be continuing the program, and have acquired more hardware to run it on, and have a second full time person on the project as well - Erinn Clark from Debian. Hopefully that addresses some of Alex's concerns as well.

--
David Maxwell
Coverity Open Source Strategist
http://scan.coverity.com/

#5 David Maxwell (Homepage) on 2008-09-17 15:48 (Reply)

David, thank you very much for the clarification. It's great to hear that Coverity is already working on the issue

#5.1 Mark Kretschmann on 2008-09-17 17:52 (Reply)

Add Comment

Name
Email
Homepage
In reply to
Comment	Enclosing asterisks marks text as bold (word), underscore are made via _word_. Standard emoticons like :-) and ;-) are converted to images. To prevent automated Bots from commentspamming, please enter the string you see in the image below in the appropriate input box. Your comment will only be submitted if the strings match. Please ensure that your browser supports and accepts cookies, or your comment cannot be verified correctly. Enter the string from the spam-prevention image above:
	Remember Information? Subscribe to this entry