Hi Stefan,

On Wed, 10 May 2017, Stefan Beller wrote:

On Wed, May 10, 2017 at 12:48 PM, Johannes Schindelin
[off-list ref] wrote:

quoted

On Fri, 5 May 2017, Johannes Schindelin wrote:

quoted

On Fri, 28 Apr 2017, Johannes Schindelin wrote:

quoted

On Fri, 28 Apr 2017, Stefan Beller wrote:

quoted

On Thu, Apr 27, 2017 at 3:50 PM, Johannes Schindelin
[off-list ref] wrote:

quoted

I still have to find the time to figure out one more detail: how
to download and extract the Coverity tool (the .zip archive has a
variable name for the top-level directory), and doing that only
every once in a while, say, only when there is no previously
unpacked tool, or it is already 4 weeks old.

That is an interesting problem, which I ignored as the older
versions of their tools still works once they release new versions.
So I just manually check every once in a while if they have new
versions out there.

So if you find a nice solution to that problem, let me know, please.

I think I have a working idea (jotting it down in the editor,
untested):

[... totally untested snippet ...]

And now I edited it and tested it. The code is now part of the script I
use for pretty much all administrative (i.e. recurring and boring) tasks
in the Git for Windows project:

      https://github.com/git-for-windows/build-extra/commit/05b5342128

Oh, I completely forgot to mention that I tried to set the FLEX_ARRAY
constant to something quite large (I used 64k), but apparently that does
not work as expected, Coverity still insists on complaining about strbufs.

On a second thought, it is actually quite obvious why it does not fix
those reports: STRBUF_INIT has nothing to do with FLEX_ARRAY. D'oh.

D'oh. I must have been living in an alternate universe for quite some time
as I seemed to have confused different things here.

Checkout this commit,
https://github.com/stefanbeller/git/commit/977f81d6dec4461a1a12da2df6c5c919b41129b4
that is cherry-picked for the coverity build. That fixes it.

I saw that patch, and since Junio did not pick it up, I figured that it
won't make it into git.git's source code. That's why I went with the `sed`
approach, as the #ifndef __COVERITY__ guard is not even necessary if I
have to patch the code before running the Coverity tool anyway.

That is about the only patch I apply before sending it off to coverity.
I am still contemplating a nice solution for FLEX_ARRAYs in other cases.

For FLEX_ARRAYs, I use this:

	cov-build --dir cov-int \
                make -j15 DEVELOPER=1 CPPFLAGS=-DFLEX_ARRAY=65536

I have not had time to go over more than half a dozen CIDs, but I *think*
it helps.

Ciao,
Dscho