2024

OpenScanHub November 2024

openscanhub@lists.fedoraproject.org

4 participants
2 discussions

Findings by static analyzers in Fedora 42 Critical Path Packages
by Siteshwar Vashisht 20 Nov '24

20 Nov '24

Hello, I am writing this message to get feedback from the community on new findings by static analyzers in Critical Path Packages that have changed in Fedora 42. TLDR: This report[1] contains 37330 findings. Please review the report and provide feedback. A mass scan was performed this week on the packages that have changed in Fedora 42. This report[1] contains all the new findings that have been identified in the packages listed in Critical Path Packages. Newly added findings since Fedora 41 are listed under ‘+’ column. Please review the report and fix or report any findings upstream that may be real bugs. Not all findings reported by OpenScanHub may be actual bugs, so please verify reported findings before investing time into fixing or reporting them. We hope this is helpful for the packages you maintain and for the upstream projects. Questions can be asked on the OpenScanHub mailing list[2]. If you want to see the full logs of the scans, they are available on the tasks[3] page. User documentation for performing a scan is available on the Fedora wiki[4]. Constructive feedback is appreciated. Thank you! [1] https://svashisht.fedorapeople.org/openscanhub/mass-scans/f42-13-Nov-2024/ [2] https://lists.fedoraproject.org/archives/list/openscanhub@lists.fedoraproje… [3] https://openscanhub.fedoraproject.org/task/ [4] https://fedoraproject.org/wiki/OpenScanHub

4 5

please make gcc-latest available in buildroot
by Kamil Dudka 11 Nov '24

11 Nov '24

Hello, could you please add repositories from https://copr.fedorainfracloud.org/coprs/dmalcolm/gcc-latest/ to the corresponding mock configs used by https://openscanhub.fedoraproject.org/? It should be safe to add them to the default configuration because the gcc-latest package will not be installed unless a user explicitly requests it (or the scanned SRPM depends on it, which is unlikely). There is a draft pull request to make csmock-plugin-gcc optionally consume the SARIF output of GCC and it depends on this COPR: https://github.com/csutils/csmock/pull/187 Kamil

2 1

2024

OpenScanHub November 2024 ----- 2024 ----- December 2024 November 2024 October 2024 September 2024 August 2024 July 2024 June 2024 May 2024 April 2024 March 2024 February 2024 January 2024

OpenScanHub November 2024