search

coverity / coverity-sonar-plugin

51 stars 27 forks source link

readme

Coverity® Sonar Plugin

The Coverity Sonar Plug-in automatically imports issues from Coverity Connect into SonarQube.

Current Version: 1.7.5

Coverity Scan Build Status

Coverity Sonar Plug-in Installation and Configuration Guide

This guide is intended to assist you with the installation and configuration of the Coverity Sonar plug-in. Once completed, you will be able to view Coverity Analysis issues within the SonarQube environment.

Compatibility Matrix

The table below displays the software versions supported by the Coverity Sonar plug-in.

Software Supported versions
SonarQube 7.9.1 - 8.9
SonarQube Scanner 3.0 - 4.0
Coverity Connect 8.0+

Installing the Coverity Sonar Plug-in

To install the Coverity Sonar plug-in, complete the following steps.

  1. Ensure that you have a supported version of SonarQube and SonarQube Scanner installed.
    Sonar installation and setup instructions are located at http://docs.sonarqube.org/display/SONAR/Setup+and+Upgrade.

  2. Download and unzip the Coverity Sonar plug-in to the Sonar plugins folder: <SonarInstallDirectory>/extensions/plugins

  3. Restart SonarQube.

Note: After upgrading SonarQube, reset the quality profile for the languages which use Coverity (in Quality Profiles, select Restore Built-in Profiles, and select the language.)

Configuring the Coverity Sonar Plug-in

Once installed, you must configure the Coverity Sonar plug-in for general use.

  1. Log in to SonarQube as an administrator.

  2. Click on Administration.

  3. Choose Configuration > General Settings.

  4. Choose Coverity.

  5. Enter the appropriate information in each of the fields for your Coverity Connect instance. Ensure that the Enable Coverity option is set to “True” to allow the import of Coverity data.

  6. Click Save Coverity Settings to complete the basic configuration.

Configuring your Project Settings

After configuring the general plug-in settings, you must select the correct Coverity Connect project to associate with each of your Sonar projects.

  1. Log in to SonarQube as an administrator.

  2. Ensure that you have uploaded your project at least once (with SonarQube Scanner), and select the project in SonarQube.

  3. Click on Quality Profiles.

  4. Change the Quality Profile option for your project to Coverity(<language>), and click Update.

  5. Choose Configuration > General Settings.

  6. Choose Coverity.

  7. Ensure that the Enable Coverity option is set to “True” to allow the import of Coverity data.

  8. Enter the name of the Coverity Connect project that corresponds to the current Sonar project.

  9. Click Save Coverity Settings.

Once completed, SonarQube will pull the current Coverity Analysis data whenever you run SonarQube Scanner on the specified project. This configuration must be completed for each project you wish to link with Coverity Connect.

Setting Up sonar-project.properties

For the plug-in to successfully display Coverity defects, the correct source paths must be entered in the sonar-project.properties file at the root of the project you are scanning. The sonar.sources variable must contain the absolute path names of the source files. For example, on a Linux system, the variable’s setting might look like this:

sonar.sources=/home/gwen/source/ces-tools/src/main/java

On windows it might look like this:

sonar.sources=C:\\Users\\gwen\\source\\ces-tools\\src\\main\\java

See below for a complete example sonar-project.properties file.

# Required metadata

sonar.projectKey=My-Project-Key

sonar.projectName=My-Project-Name

sonar.login=admin

sonar.password=admin

sonar.host.url=http://localhost:9000

sonar.projectVersion=1.5.0

# Comma-separated paths to directories with sources (required)

sonar.sources=.

# Encoding of the source files

sonar.sourceEncoding=UTF-8

sonar.coverity.connect.hostname=localhost

sonar.coverity.connect.port=8080

sonar.coverity.connect.username=user

sonar.coverity.connect.password=password

sonar.projectVersion=1.5.0

sonar.coverity.stream=MyStream

sonar.coverity.project=MyProject

sonar.coverity.enable=true

# sonar.coverity.prefix=MyOptionalPrefix

Note: When using the Coverity plug-in, use the language key "cov-cpp" instead of "c", "c++", or "cpp". This language key prevents conflicts with non-Coverity plug-ins.

To specify the language key:

Note: The "sonar.coverity.prefix" property is used to help locate files when anlyzing with the sonar scanner. The prefix value will be removed from the "File path" value on the Coverity Connect issue.

Note: Coverity SonarQube Plugin now supports both stream and project.

The Coverity Widget

The Coverity plug-in includes a Coverity widget that displays Coverity-specific measures. The Coverity widget is available with SonarQube versions before version 6.2.

Sonar Scanner with SSL

Coverity SonarQube Plugin provides a connection to Coverity Connect through SSL. The certificates should be imported to the java key chain where Sonar Scanner is running from.

Sonar Scanner provides its own jre bundle as part of Sonar Scanner. This means that if a user installed java locally, the certificates need to be imported to the jre which is bundled with Sonar Scanner.

keytool -importcert -keystore /jre/lib/security/cacerts -storepass changeit -file -alias

Limitations

The Coverity Sonar plug-in has the following limitations, which may be addressed in future releases.

To do so, navigate to the “Configuration -> General Settings -> Coverity” menu, and specify the prefix to be removed in the “Coverity Files Prefix” field.

Support

If you have questions or issues with the Coverity plugin, please contact coverity-support@synopsys.com

Changelog