scripts/coverity-scan/run-coverity-scan

#!/bin/sh -e

# Upload a created tarball to Coverity Scan, as per
# https://scan.coverity.com/projects/qemu/builds/new

# This work is licensed under the terms of the GNU GPL version 2,
# or (at your option) any later version.
# See the COPYING file in the top-level directory.
#
# Copyright (c) 2017-2020 Linaro Limited
# Written by Peter Maydell

# Note that this script will automatically download and
# run the (closed-source) coverity build tools, so don't
# use it if you don't trust them!

# This script assumes that you're running it from a QEMU source
# tree, and that tree is a fresh clean one, because we do an in-tree
# build. (This is necessary so that the filenames that the Coverity
# Scan server sees are relative paths that match up with the component
# regular expressions it uses; an out-of-tree build won't work for this.)
# The host machine should have as many of QEMU's dependencies
# installed as possible, for maximum coverity coverage.

# To do an upload you need to be a maintainer in the Coverity online
# service, and you will need to know the "Coverity token", which is a
# secret 8 digit hex string. You can find that from the web UI in the
# project settings, if you have maintainer access there.

# Command line options:
#   --check-upload-only : return success if upload is possible
#   --dry-run : run the tools, but don't actually do the upload
#   --docker : create and work inside a container
#   --docker-engine : specify the container engine to use (docker/podman/auto);
#                     implies --docker
#   --update-tools-only : update the cached copy of the tools, but don't run them
#   --no-update-tools : do not update the cached copy of the tools
#   --tokenfile : file to read Coverity token from
#   --version ver : specify version being analyzed (default: ask git)
#   --description desc : specify description of this version (default: ask git)
#   --srcdir : QEMU source tree to analyze (default: current working dir)
#   --results-tarball : path to copy the results tarball to (default: don't
#                       copy it anywhere, just upload it)
#   --src-tarball : tarball to untar into src dir (default: none); this
#                   is intended mainly for internal use by the Docker support
#
# User-specifiable environment variables:
#  COVERITY_TOKEN -- Coverity token (default: looks at your
#                    coverity.token config)
#  COVERITY_EMAIL -- the email address to use for uploads (default:
#                    looks at your git coverity.email or user.email config)
#  COVERITY_BUILD_CMD -- make command (default: 'make -jN' where N is
#                    number of CPUs as determined by 'nproc')
#  COVERITY_TOOL_BASE -- set to directory to put coverity tools
#                        (default: /tmp/coverity-tools)
#
# You must specify the token, either by environment variable or by
# putting it in a file and using --tokenfile. Everything else has
# a reasonable default if this is run from a git tree.

upload_permitted() {
    # Check whether we can do an upload to the server; will exit *the script*
    # with status 99 if the check failed (usually a bad token);
    # will return from the function with status 1 if the check indicated
    # that we can't upload yet (ie we are at quota)
    # Assumes that COVERITY_TOKEN and PROJNAME have been initialized.

    echo "Checking upload permissions..."

    if ! up_perm="$(wget https://scan.coverity.com/api/upload_permitted --post-data "token=$COVERITY_TOKEN&project=$PROJNAME" -q -O -)"; then
        echo "Coverity Scan API access denied: bad token?"
        exit 99
    fi

    # Really up_perm is a JSON response with either
    # {upload_permitted:true} or {next_upload_permitted_at:<date>}
    # We do some hacky string parsing instead of properly parsing it.
    case "$up_perm" in
        *upload_permitted*true*)
            return 0
            ;;
        *next_upload_permitted_at*)
            return 1
            ;;
        *)
            echo "Coverity Scan upload check: unexpected result $up_perm"
            exit 99
            ;;
    esac
}


check_upload_permissions() {
    # Check whether we can do an upload to the server; will exit the script
    # with status 99 if the check failed (usually a bad token);
    # will exit the script with status 0 if the check indicated that we
    # can't upload yet (ie we are at quota)
    # Assumes that COVERITY_TOKEN, PROJNAME and DRYRUN have been initialized.

    if upload_permitted; then
        echo "Coverity Scan: upload permitted"
    else
        if [ "$DRYRUN" = yes ]; then
            echo "Coverity Scan: upload quota reached, continuing dry run"
        else
            echo "Coverity Scan: upload quota reached; stopping here"
            # Exit success as this isn't a build error.
            exit 0
        fi
    fi
}


build_docker_image() {
    # build docker container including the coverity-scan tools
    echo "Building docker container..."
    # TODO: This re-unpacks the tools every time, rather than caching
    # and reusing the image produced by the COPY of the .tgz file.
    # Not sure why.
    tests/docker/docker.py --engine ${DOCKER_ENGINE} build \
                   -t coverity-scanner -f scripts/coverity-scan/coverity-scan.docker \
                   --extra-files scripts/coverity-scan/run-coverity-scan \
                                 "$COVERITY_TOOL_BASE"/coverity_tool.tgz
}

update_coverity_tools () {
    # Check for whether we need to download the Coverity tools
    # (either because we don't have a copy, or because it's out of date)
    # Assumes that COVERITY_TOOL_BASE, COVERITY_TOKEN and PROJNAME are set.

    mkdir -p "$COVERITY_TOOL_BASE"
    cd "$COVERITY_TOOL_BASE"

    echo "Checking for new version of coverity build tools..."
    wget https://scan.coverity.com/download/cxx/linux64 --post-data "token=$COVERITY_TOKEN&project=$PROJNAME&md5=1" -O coverity_tool.md5.new

    if ! cmp -s coverity_tool.md5 coverity_tool.md5.new; then
        # out of date md5 or no md5: download new build tool
        # blow away the old build tool
        echo "Downloading coverity build tools..."
        rm -rf coverity_tool coverity_tool.tgz
        wget https://scan.coverity.com/download/cxx/linux64 --post-data "token=$COVERITY_TOKEN&project=$PROJNAME" -O coverity_tool.tgz
        if ! (cat coverity_tool.md5.new; echo "  coverity_tool.tgz") | md5sum -c --status; then
            echo "Downloaded tarball didn't match md5sum!"
            exit 1
        fi

        if [ "$DOCKER" != yes ]; then
            # extract the new one, keeping it corralled in a 'coverity_tool' directory
            echo "Unpacking coverity build tools..."
            mkdir -p coverity_tool
            cd coverity_tool
            tar xf ../coverity_tool.tgz
            cd ..
            mv coverity_tool.md5.new coverity_tool.md5
        fi
    fi
    rm -f coverity_tool.md5.new
    cd "$SRCDIR"

    if [ "$DOCKER" = yes ]; then
        build_docker_image
    fi
}


# Check user-provided environment variables and arguments
DRYRUN=no
UPDATE=yes
DOCKER=no
PROJNAME=QEMU

while [ "$#" -ge 1 ]; do
    case "$1" in
        --check-upload-only)
            shift
            DRYRUN=check
            ;;
        --dry-run)
            shift
            DRYRUN=yes
            ;;
        --no-update-tools)
            shift
            UPDATE=no
            ;;
        --update-tools-only)
            shift
            UPDATE=only
            ;;
        --version)
            shift
            if [ $# -eq 0 ]; then
                echo "--version needs an argument"
                exit 1
            fi
            VERSION="$1"
            shift
            ;;
        --description)
            shift
            if [ $# -eq 0 ]; then
                echo "--description needs an argument"
                exit 1
            fi
            DESCRIPTION="$1"
            shift
            ;;
        --tokenfile)
            shift
            if [ $# -eq 0 ]; then
                echo "--tokenfile needs an argument"
                exit 1
            fi
            COVERITY_TOKEN="$(cat "$1")"
            shift
            ;;
        --srcdir)
            shift
            if [ $# -eq 0 ]; then
                echo "--srcdir needs an argument"
                exit 1
            fi
            SRCDIR="$1"
            shift
            ;;
        --results-tarball)
            shift
            if [ $# -eq 0 ]; then
                echo "--results-tarball needs an argument"
                exit 1
            fi
            RESULTSTARBALL="$1"
            shift
            ;;
        --src-tarball)
            shift
            if [ $# -eq 0 ]; then
                echo "--src-tarball needs an argument"
                exit 1
            fi
            SRCTARBALL="$1"
            shift
            ;;
        --docker)
            DOCKER=yes
            DOCKER_ENGINE=auto
            shift
            ;;
        --docker-engine)
            shift
            if [ $# -eq 0 ]; then
                echo "--docker-engine needs an argument"
                exit 1
            fi
            DOCKER=yes
            DOCKER_ENGINE="$1"
            shift
            ;;
        *)
            echo "Unexpected argument '$1'"
            exit 1
            ;;
    esac
done

if [ -z "$COVERITY_TOKEN" ]; then
    COVERITY_TOKEN="$(git config coverity.token)"
fi
if [ -z "$COVERITY_TOKEN" ]; then
    echo "COVERITY_TOKEN environment variable not set"
    exit 1
fi

if [ "$DRYRUN" = check ]; then
    upload_permitted
    exit $?
fi

if [ -z "$COVERITY_BUILD_CMD" ]; then
    NPROC=$(nproc)
    COVERITY_BUILD_CMD="make -j$NPROC"
    echo "COVERITY_BUILD_CMD: using default '$COVERITY_BUILD_CMD'"
fi

if [ -z "$COVERITY_TOOL_BASE" ]; then
    echo "COVERITY_TOOL_BASE: using default /tmp/coverity-tools"
    COVERITY_TOOL_BASE=/tmp/coverity-tools
fi

if [ -z "$SRCDIR" ]; then
    SRCDIR="$PWD"
fi

TARBALL=cov-int.tar.xz

if [ "$UPDATE" = only ]; then
    # Just do the tools update; we don't need to check whether
    # we are in a source tree or have upload rights for this,
    # so do it before some of the command line and source tree checks.

    if [ "$DOCKER" = yes ] && [ ! -z "$SRCTARBALL" ]; then
        echo --update-tools-only --docker is incompatible with --src-tarball.
        exit 1
    fi

    update_coverity_tools
    exit 0
fi

if [ ! -e "$SRCDIR" ]; then
    mkdir "$SRCDIR"
fi

cd "$SRCDIR"

if [ ! -z "$SRCTARBALL" ]; then
    echo "Untarring source tarball into $SRCDIR..."
    tar xvf "$SRCTARBALL"
fi

echo "Checking this is a QEMU source tree..."
if ! [ -e "$SRCDIR/VERSION" ]; then
    echo "Not in a QEMU source tree?"
    exit 1
fi

# Fill in defaults used by the non-update-only process
if [ -z "$VERSION" ]; then
    VERSION="$(git describe --always HEAD)"
fi

if [ -z "$DESCRIPTION" ]; then
    DESCRIPTION="$(git rev-parse HEAD)"
fi

if [ -z "$COVERITY_EMAIL" ]; then
    COVERITY_EMAIL="$(git config coverity.email)"
fi
if [ -z "$COVERITY_EMAIL" ]; then
    COVERITY_EMAIL="$(git config user.email)"
fi

# Otherwise, continue with the full build and upload process.

check_upload_permissions

if [ "$UPDATE" != no ]; then
    update_coverity_tools
fi

# Run ourselves inside docker if that's what the user wants
if [ "$DOCKER" = yes ]; then
    # Put the Coverity token into a temporary file that only
    # we have read access to, and then pass it to docker build
    # using a volume.  A volume is enough for the token not to
    # leak into the Docker image.
    umask 077
    SECRETDIR=$(mktemp -d)
    if [ -z "$SECRETDIR" ]; then
        echo "Failed to create temporary directory"
        exit 1
    fi
    trap 'rm -rf "$SECRETDIR"' INT TERM EXIT
    echo "Created temporary directory $SECRETDIR"
    SECRET="$SECRETDIR/token"
    echo "$COVERITY_TOKEN" > "$SECRET"
    echo "Archiving sources to be analyzed..."
    ./scripts/archive-source.sh "$SECRETDIR/qemu-sources.tgz"
    ARGS="--no-update-tools"
    if [ "$DRYRUN" = yes ]; then
        ARGS="$ARGS --dry-run"
    fi
    echo "Running scanner..."
    # If we need to capture the output tarball, get the inner run to
    # save it to the secrets directory so we can copy it out before the
    # directory is cleaned up.
    if [ ! -z "$RESULTSTARBALL" ]; then
        ARGS="$ARGS --results-tarball /work/cov-int.tar.xz"
    fi
    # Arrange for this docker run to get access to the sources with -v.
    # We pass through all the configuration from the outer script to the inner.
    export COVERITY_EMAIL COVERITY_BUILD_CMD
    tests/docker/docker.py run -it --env COVERITY_EMAIL --env COVERITY_BUILD_CMD \
           -v "$SECRETDIR:/work" coverity-scanner \
           ./run-coverity-scan --version "$VERSION" \
           --description "$DESCRIPTION" $ARGS --tokenfile /work/token \
           --srcdir /qemu --src-tarball /work/qemu-sources.tgz
    if [ ! -z "$RESULTSTARBALL" ]; then
        echo "Copying results tarball to $RESULTSTARBALL..."
        cp "$SECRETDIR/cov-int.tar.xz" "$RESULTSTARBALL"
    fi
    echo "Docker work complete."
    exit 0
fi

TOOLBIN="$(cd "$COVERITY_TOOL_BASE" && echo $PWD/coverity_tool/cov-analysis-*/bin)"

if ! test -x "$TOOLBIN/cov-build"; then
    echo "Couldn't find cov-build in the coverity build-tool directory??"
    exit 1
fi

export PATH="$TOOLBIN:$PATH"

cd "$SRCDIR"

echo "Nuking build directory..."
rm -rf +build
mkdir +build
cd +build

echo "Configuring..."
# We configure with a fixed set of enables here to ensure that we don't
# accidentally reduce the scope of the analysis by doing the build on
# the system that's missing a dependency that we need to build part of
# the codebase.
../configure --disable-modules --enable-sdl --enable-gtk \
    --enable-opengl --enable-vte --enable-gnutls \
    --enable-nettle --enable-curses --enable-curl \
    --audio-drv-list=oss,alsa,sdl,pa --enable-virtfs \
    --enable-vnc --enable-vnc-sasl --enable-vnc-jpeg --enable-png \
    --enable-xen --enable-brlapi \
    --enable-linux-aio --enable-attr \
    --enable-cap-ng --enable-trace-backends=log --enable-spice --enable-rbd \
    --enable-libusb --enable-usb-redir \
    --enable-libiscsi --enable-libnfs --enable-seccomp \
    --enable-tpm --enable-libssh --enable-lzo --enable-snappy --enable-bzip2 \
    --enable-numa --enable-rdma --enable-smartcard --enable-virglrenderer \
    --enable-mpath --enable-glusterfs \
    --enable-virtfs --enable-zstd

echo "Running cov-build..."
rm -rf cov-int
mkdir cov-int
cov-build --dir cov-int $COVERITY_BUILD_CMD

echo "Creating results tarball..."
tar cvf - cov-int | xz > "$TARBALL"

if [ ! -z "$RESULTSTARBALL" ]; then
    echo "Copying results tarball to $RESULTSTARBALL..."
    cp "$TARBALL" "$RESULTSTARBALL"
fi

echo "Uploading results tarball..."

if [ "$DRYRUN" = yes ]; then
    echo "Dry run only, not uploading $TARBALL"
    exit 0
fi

curl --form token="$COVERITY_TOKEN" --form email="$COVERITY_EMAIL" \
     --form file=@"$TARBALL" --form version="$VERSION" \
     --form description="$DESCRIPTION" \
     https://scan.coverity.com/builds?project="$PROJNAME"

echo "Done."