csmock - Man Page

source RPM package to be scanned by static analyzers

show this help message and exit

mock profile to use (defaults to mock's default)

comma-separated list of tools to enable (use --listavailable-tools to see the list of available tools)

enable all stable csmock plug-ins (use --listavailable-tools to see the list of available tools)

list available tools and exit

space-separated list of packages to install into the chroot

name of the tarball or directory to put the results to

overwrite the resulting file or directory if it exists already

maximal number of jobs running in parallel (passed to 'make')

shell-quoted options passed to rpm-build

maximal amount of time taken by analysis of a single module [s]

embed a number of lines of context from the source file for the key event (defaults to 3).

stop processing a warning if the count of its occurrences exceeds the specified limit (defaults to 1024).

limit length of diagnostic messages by the specified number of chars (defaults to 512).

continue as much as possible after an error

do not run 'mock --init' before the scan (may lead to unpredictable scan results)

do not run %build and %install sections [EXPERIMENTAL]

use ldpwrap instead of csexec-loader [EXPERIMENTAL]

do not clean chroot when it becomes unused

scrub all caches after the scan

do not analyze any package, just check versions of the analyzers

run the %check section of specfile (disabled by default)

disables --run-check

print the resulting list of defects (default if connected to a tty)

disables --print-defects

perform a differential scan against the specified base package

mock profile to use for the base scan (use only with --base-srpm)

override the build root directory for mock (disables yum and root cache)

skip patches not annotated by %{?_rawbuild} (vanilla build)

scan with/without patches and diff the lists of defects

use shell command to build the given tarball (instead of SRPM)

suppress known false positives loaded from the given file (defaults to "/usr/share/csmock/known-falsepositives.js" if available)

use login shell for build (default)

disables --use-login-shell

print the version of csmock and exit

make bandit scan files in the build directory (disabled by default)

disables --bandit-scan-build

make bandit scan files in the install directory (enabled by default)

disables --bandit-scan-install

report only Bandit defects whose key event matches the given regex (defaults to '^B[0-9]+')

suppress Bandit defects whose severity level is below given level (default 'LOW')

append the given flag when invoking cbmc (can be used multiple times)

maximal amount of time taken by analysis of a single process [s]

append the given flag when invoking clang static analyzer (can be used multiple times)

use host's Cppcheck instead of the one in chroot (automatically enables the Cppcheck plug-in)

append the given flag when invoking cppcheck (can be used multiple times)

append the given flag when invoking divine (can be used multiple times)

maximal amount of time taken by analysis of a single process [s]

append the given flag when invoking strace (can be used multiple times)

append the given flag when invoking valgrind (can be used multiple times)

maximal amount of time taken by analysis of a single process [s]

append the given flag when invoking symbiotic (can be used multiple times)

maximal amount of time taken by analysis of a single process [s]

URL to download gitleaks binary executable (in a .tar.gz) from

directory where downloaded Gitleaks tarballs are cached across runs

local configuration file to be used for gitleaks

drop warnings if their count exceeds the specified limit

trim message if it exceeds max message length

force download of gitleaks binary executable (in a .tar.gz) from

appends the given flag (except '-o') when invoking 'infer analyze' (can be used multiple times)(default flags '--bufferoverrun', '--pulse')

use the given archive to install Infer (default is /opt/infer-linux*.tar.xz)

apply false positive filter (enabled by default)

disables --infer-filter

apply false positive bi-abduction filter (enabled by default)

disables --infer-biabduction-filter

apply false positive inferbo filter (enabled by default)

disables --infer-inferbo-filter

apply false positive uninit filter (enabled by default)

disables --infer-uninit-filter

lower dead store severity (enabled by default)

disables --infer-dead-store-severity

maximal amount of time taken by Infer's analysis phase [s] (default 300)

make pylint scan files in the build directory (disabled by default)

disables --pylint-scan-build

make pylint scan files in the install directory (enabled by default)

disables --pylint-scan-install

filter out Pylint defects whose key event matches the given regex (defaults to '^W[0-9]+', use '.*' to get all defects detected by Pylint)

configure whether usage metrics are sent to the Semgrep server (defaults to off)

semgrep rules repo, assuming rules are located under the 'rules' sub-directory

show more details about what rules are running, which files failed to parse, etc.

space-separated list of additional options passed to the 'semgrep scan' command

make shellcheck scan files in the build directory (disabled by default)

disables --shellcheck-scan-build

make shellcheck scan files in the install directory (enabled by default)

disables --shellcheck-scan-install

maximum number of scripts scanned by a single shellcheck process (defaults to 1)

maximum amount of wall-clock time taken by a single shellcheck process [s] (defaults to 30)

URL to download snyk binary executable

file containing snyk authentication token

directory where downloaded snyk tarballs are cached across runs

force download of snyk binary executable

maximum amount of time taken by invocation of Snyk [s]

space-separated list of additional options passed to the 'snyk code test' command

look for bidirectional control characters only

exclude tests (basically test.* as a component of path)

Adjust GCC warning level. -w0 means default flags, -w1 appends -Wall and -Wextra, and -w2 enables some other useful warnings. (automatically enables the GCC plugin)

run `gcc -fanalyzer` in a separate process

Use custom build of gcc to perform scan. Absolute path to the binary must be provided.

append the given flag when invoking `gcc -fanalyzer` (can be used multiple times)

set $CC and $CXX to gcc and g++, respectively, for build

enable %check and compile with -fsanitize=address

enable %check and compile with -fsanitize=leak

enable %check and compile with -fsanitize=thread

enable %check and compile with -fsanitize=undefined

append the given compiler flag when invoking gcc (can be used multiple times)

append the given compiler flag when invoking gcc for C (can be used multiple times)

append the given compiler flag when invoking gcc for C++ (can be used multiple times)

drop the given compiler flag when invoking gcc (can be used multiple times)