Automated Analysis failing for cmake project

github / codeql

CodeQL: the libraries and queries that power security researchers around the world, as well as code scanning in GitHub Advanced Security

https://codeql.github.com

MIT License

7.49k stars 1.49k forks source link

Automated Analysis failing for cmake project #6128

Open schmidtw opened 3 years ago

schmidtw commented 3 years ago

cmake is not correctly searching for dependencies

I'm trying to get this project to be added as an "active project", but lgtm's cmake is not working. The same cmake calls work in github actions, and locally. Based on the logs it looks like somehow libcurl is being interpreted as liblibcurl as one example.

I'm not sure what's special about this project but other projects work fine.

Not working: https://github.com/xmidt-org/xmidt-agent

Working: https://github.com/xmidt-org/curlws

criemen commented 3 years ago

Hey,

this looks like a bug on our side. I pinged the relevant engineering team, and will get back to you once I know more.

jbj commented 3 years ago

Thanks for the report. I've checked the CMake documentation for find_library, and I can see that this is indeed a bug on our part. CMake should look for the literal file name first and only check for lib${name}.so if the literal file name does not exist.

You should be able to work around the bug by changing the line NAMES "libcurl.so" into NAMES curl.

I can't promise any time line on fixing the bug from our side as LGTM is a product that's being phased out. The new way to analyze your code with CodeQL is via GitHub Code scanning.