Coverity Scan has been down more than up for the last 6 months or so -- and hasn't had any significant scanner updates in years. I think at this point we just have to assume that #Coverity scan isn't coming back. It's a sad end to a once-useful service.

#enshittification #privateequity

Does anyone know what is happening at #coverity? The 'open source' dashboard is down since a while. Did they went belly up?

https://scan.coverity.com/dashboard

One static analysis tool tells me to use `lstat` and `fstat` to avoid (or at least detect) malicious replacement of a file that I `open`. Then, after doing this, my other static analysis tool complains that I’ve introduced a TOCTOU (time-of-use, time-of-check) between `lstat` and `open`.

Sure, but I’m going to detect that. Real issue I have with all of this is that there’s still a window (which I estimate to be the about the same size in both versions of this program) between creating this pseudoterminal file and the next interaction I have with it (be that pulling file stats with `lstat` or `open`ing it).
#SemGrep #Coverity #StaticAnalysis #Programming #C

I’m pleased to announce release 1.0.4 of #wile #scheme #compiler. There are *no new features*, just a fair number of #coverity cleanups - thank you Coverity/Synopsys for allowing open-source projects to access this!

It’s available at https://github.com/uhollerbach/wile as usual.