Integrate securify into Travis-ci

MatthiasEgli-chainsecurity commented 5 years ago

The goal is to write an integration into travis-ci for securify to allow projects easy access to a security scan.

MatthiasEgli-chainsecurity commented 5 years ago

See PR https://github.com/eth-sri/securify/pull/34

hiqua commented 5 years ago

See current README.md, some configuration is possible to compile via solc provided that the dependencies are installed. We should decide whether it makes sense to also compile via Truffle.

Advantages:

using same compiler settings (optimization runs, maybe others I'm forgetting right now)

Drawbacks:

unless the compilation output is semantically different depending on the compiler used (meaning that there's a bug in at least one of them), or a bug in Securify, or that the compilation output is semantically the same but the analysis Securify is too appromixate to detect it, the patterns matched will be the same
more code to maintain

@MatthiasEgli-chainsecurity @ritzdorf if you think it makes sense to integrate truffle beyond what's currently possible (analyze a truffle project with dependencies already installed, but compile it via solc), please let us know. See also the PR to follow the discussion regarding compilation outputs.

hiqua commented 5 years ago

Closing as per last comment, Truffle integration can be followed in the PR.

eth-sri / securify

Integrate securify into Travis-ci #20