How to ignore 3rd-party sources from static analysis

Usage
1

I’ve been using project options as a way to get some solid defaults for my projects without too much trouble.

One problem I’ve been running into though is the CMAKE_$LANG_CPPCHECK defaults and how they apply to 3rd party dependencies.

It seems like when this option is set, 3rd party libraries (in my case, Catch2) are also subject to these globals. Static analysis (e.g. cppcheck) is performed on them and fails, when it is not my intention to run it on these 3rd-party libs. If it matters, I’m using CPM to download Catch2.

Is there a preferred way to globally ignore 3rd party libraries globally from static analysis like cppcheck?

My current approach is to do set_target_properties(my_target PROPERTIES CXX_CPPCHECK ${some_good_options}), where some_good_options are the ones set by project_options. I clear these CMAKE_$LANG_CPPCHECK properties right after calling into project_options for it to set them up.

1 Like
2

These CMAKE_ variables just initialize target properties when the target is defined. You can do something like:

block (SCOPE_FOR VARIABLES)
  unset(CMAKE_CXX_CPPCHECK)
  add_subdirectory(Catch2)
endblock ()

to clear these initializations for your 3p projects.

1 Like
3

How would that work with FetchContent? I tried this:

block (SCOPE_FOR VARIABLES)
  unset(CMAKE_CXX_CPPCHECK)

FetchContent_Declare(3rdPartyProject
  GIT_REPOSITORY repo_url
  GIT_TAG master
)
FetchContent_MakeAvailable(3rdPartyProject)

endblock ()

but the project is still included in the checks. The third party project provides static library and cpp check runs when the lib is build.

4

I would make sure that the project isn’t setting up CMAKE_CXX_CPPCHECK itself. Or you may need to also unset CMAKE_C_CPPCHECK. Configuring with cmake --trace-expand may help surface any such code.

5

No, the subproject is also my CMakeLists.txt and I do not use CPPCHECK there, also unsetting CMAKE_C_CPPCHECK is not helping.

I assume --trace-expand is something like a verbose cmake mode? I never used it before, but when I add this option then cmake finishes with errors, whereas it finishes fine without it.

6

It does enable some developer mode bits as well, but there’s not enough context here to know. Basically, something is setting the <LANG>_CPPCHECK property on the relevant targets; that needs found.

I suppose one thing that could be confusing it is a cache variable. If a cache variable exists, unset(CMAKE_<LANG>_CPPCHECK will only unset the scoped variable of that name.