This document discusses static code analysis and tools like SonarQube and Coverity. Static code analysis examines code without executing it to find bugs. Monitoring and fixing code quality issues improves application quality and delivery. SonarQube is an open source tool that manages code quality through analysis, issues detection, and metrics. Coverity also detects defects early through static analysis of various languages. Both tools help improve code quality.

1. 1/21/2016 1

2.  What Is Static Code Analysis?
 Why Static Code Analysis Is Useful?
 Seven axes of code quality
 Effects of Fixing Code Quality
 Static coda analysis tools
◦ Sonarqube
◦ Coverity
1/21/2016 2

3.  Static code analysis is a method of computer
program debugging that is done by examine
in the code without executing the program.
1/21/2016 3

4. From W. S. Humphrey, "Using a Defined and
Measured Personal Software Process," IEEE
Software, May, 1996
 “Even experienced programmers typically
make a mistake for every seven to ten lines of
code they develop.”
1/21/2016 4

5. 1/21/2016 5

6.  monitoring and fixing code quality issues is
something that is proven to raise the quality
of your application AND your ability to deliver
that application to stakeholders on time.
1/21/2016 6

7. 1/21/2016 7

8. 1/21/2016 8

9. What is SonarQube
Code quality
Features
Benefits
Strength of the platform
1/21/2016 9

10.  Platform to manage code
quality.
 Open source, possible to pay
for support and some plug-
ins.
 Active community support,
plug-ins,books
1/21/2016 10

11. 1/21/2016 11

12. 1/21/2016 12

13. 1/21/2016 13

14.  Platform Independent
Runs on Windows, Mac OSX, Linux, Solaris.
 Server is fairly light weight.
 Plug-in architecture
Vibrant community extending sonar
functionalities
Plug-ins for nearly every language you can
expect.
Plug-ins providing additional metrics, including
total quality, technical debt and more.
1/21/2016 14

15.  Total cost of ownership
 Functional coverage
 Continuous inspection
 Actionable reporting
 Interaction
 Strong community
 Languages coverage
 Extensibility
1/21/2016 15

16. 1/21/2016 16

17. 1/21/2016 17

18. 1/21/2016 18

19.  User runs client to analyze source
 Analyzer sends data on source files to
database
 Web server provides presentation for violation
data, administration for users and analyses,
configuration of plug-ins, features and
functionalities.
1/21/2016 19

20. 1/21/2016 20

21.  Coverity Static Analysis (CSA) helps
developers find hard-to-spot, yet potentially
crash-causing defects early in the software
development life-cycle, reducing the cost,
time, and risk of software errors
1/21/2016 21

22.  Concurency Defects
 Performance degradation
 Crash causing errors
 Incorrect program behavior
 Security Vulnarabilities
1/21/2016 22

23. 1/21/2016 23

24. 1/21/2016 24

25.  API usage errors
 Code maintainability issues
 Concurrent data access violations
 Control flow issues
 Error handling issues
 Incorrect expression
 Integer handling issues
 Memory - corruptions
 Memory - illegal accesses
 Null pointer dereferences
 Program hangs
 Resource leaks
 Security best practices violations
 Uninitialized variables
1/21/2016 25

26. 1/21/2016 26

27.  Best of Bread Analysis
 Integration With The Developer Workflow
 Defect Management and Impact Management
 Performance and Scale
 Extensible Platform
1/21/2016 27

28. Supported
Platforms
Supported
Compilers
Supported IDEs Minimum System
Requiremets
• AIX
• FreeBSD
• HP-UX
• Linux
• Mac OS X
• NetBSD
• Solaris
• Windowss
• ARM
• Cosmic C
Cross Compilers
• Freescale Code
Warrior
• GNU GCC,
G++
• Intel C++
• Keil
• QNX
• Renesas
• Sun (Oracle)CC
and cc
• Texas
Instruments
• Visual Studio
• WindRiver
• Xcode GCC
and G++
• Eclipse v3.5,
v3.6, v3.7
• WindRiver
Workbench v3.2,
v3.3
• Visual Studio
versions 2005,
2008, and 2010
• 1 GHz CPU
• 1 GB of RAM
minimum,
2 GB
recommended
• 1 GB of free
hard disk space
1/21/2016 28

29. 1/21/2016 29

30.  Proven significant operational cost
reduction.
 Metric visibility of code estate onshore and
offshore.
 Proven history of finding crash causing or
unexpected behavior causing defects.
 Process improvement of the Application
Lifecycle Management.
1/21/2016 30

31. THANKYOU!!
1/21/2016 31

32.  http://zeroturnaround.com/rebellabs
 http://docs.codehaus.org/display/SONAR/Co
nfiguring+SonarQube+in+Eclipse
1/21/2016 32