Skip to main content
Add as a preferred source on Google


Coverity Adds Java Support to OSS Scan Service

  • By Kurt Mackie
  • 11/27/07

San Francisco-based Coverity Inc. has expanded its static source-code analysis scanning solution. The solution now supports Java-based open source software (OSS) projects. Developers can check their OSS Java applications for free using Coverity's hosted solution. The solution scans applications and points out security and quality problems in the code without actually running the tested application.

Coverity's scanning site already checks open source applications based on C and C++ code. The site has scanned more than 250 C/C++ solutions, entailing "55 million lines of code," according to an announcement issued by the company. The announcement adds that because of the scans, "more than 7,500 security and quality defects" have been fixed by project administrators.

The new Java code-scanning capability of the site is being enabled, in part, through Coverity's contract with the U.S. Department of Homeland Security. David Maxwell, Coverity's open source strategist, said that Coverity has three-year contract with the government agency. The Coverity solution is tested by Symantec, which also has a contract with the agency, he added.

The Department of Homeland Security issued the contract as part of its security initiatives, Maxwell explained.

"Under their Cybersecurity initiative, [the Department of Homeland Security has] a section which is securing the Internet infrastructure," he said. "A large portion of the Internet is built based on open source software--when you think of the most popular Web server, it's Apache, and obviously Linux is a very popular operating system for servers. Many of the components of the Internet are open source."

Static source-code analysis is a way of checking code before compiling it. Maxwell said that the technology has been around for a while but that Coverity has enhanced a solution that was originally developed at Stanford University. Static source-code analysis complements unit testing and quality assurance efforts because you check the code before running it.

The standard method of dynamically testing code by compiling it can be cumbersome, especially for large projects. Maxwell said that some standard dynamic testing tools can run for weeks and not exhaust finding possible errors in programs.

The Coverity Prevent SQS engine, which underlies Coverity's scanning site, "analyzes software dependencies, key third-party libraries and projects spread across multiple development groups," according to Coverity's announcement.

Coverity's open source scanning solution is available for free -- although with no support -- to OSS developers as a hosted application. The company also offers licenses to commercial software developers, where companies can purchase training and use the solution with as many developers as wanted, Maxwell said. For the commercial environment, Coverity's solution is installed, not hosted, he added.

Developers can access Coverity's OSS code analysis site here.

About the Author

Kurt Mackie is online news editor, Enterprise Group, at 1105 Media Inc.

Featured

  • woman

    AI Giants Back Nonprofit Focused on Workforce Transition

    The AI industry's biggest names are investing in more than just models and infrastructure — they're focusing on workforce readiness. OpenAI, Anthropic, Microsoft and Amazon are backing Raise US, a new nonprofit that aims to raise $1 billion to help American workers prepare for an AI-driven economy.

  • VSLive! session

    VSLive! San Diego 2026 Puts AI at the Core of the Campus IT Stack

    For higher education IT teams working through AI pilots, ERP integrations, student-facing apps, analytics projects, and mounting security concerns, Visual Studio Live! San Diego 2026 offers a look at the development practices that are shaping the campus technology landscape.

  • A glowing digital brain with neural connections and light trails

    AI Giants Warn It May Be Time to Slow Down

    For years, leaders in the artificial intelligence industry have warned that increasingly capable AI systems could eventually become dangerous, all the while continuing to race to build them. Now, their sentiments have changed.

  • abstract smartphone translucent screen displaying AI interface

    Apple Introduces Redesigned Siri AI

    At its recent Worldwide Developers Conference, Apple introduced Siri AI, a redesigned version of its voice assistant that Apple describes in its own announcement as "a profoundly more capable and personal assistant." The update is intended to make Siri more conversational, more context-aware, and more useful across iPhone, iPad, Mac, Apple Watch, and Vision Pro.