Icu4j coverity

.gitignore

@@ -11,3 +11,5 @@
 src/tmp
 /Makefile.local
 /local-*
+/src/bin/cov-analysis-linux64*
+/src/bin/local-*

.vscode/settings.json

@@ -0,0 +1,7 @@
+{
+    "files.exclude": {
+        "src/icu": true,
+        "tmp": true,
+        "dist": true   
+    }
+}

README.md

@@ -45,12 +45,49 @@ this will make error messages work
 
 - do some command line builds
 
-```
+```shell
     $ docker-compose run ubuntu bash
     build@59b67f6c5058:~$ /src/icu/icu4c/source/configure
     checking for ICU version numbers...
 ```
 
+## ICU4J
+
+- the following will build (in-source!) using adoptopenjdk9
+
+```shell
+docker-compose run fedora-j ant jar check
+```
+
+## Coverity Scan
+
+### ICU4C
+
+https://scan.coverity.com/
+
+- download the scanning tools and install them as `src/bin/cov-analysis-linux64/`
+(you can unpack the .tgz in src/bin and create a symlink)
+
+- create an executable script file named `src/bin/local-coverity.sh` with
+the following contents: (see the coverity page for the project for more details)
+
+```shell
+export COVERITY_TOKEN=yourtoken
+export [email protected]
+```
+
+
+- Kick it off: `docker-compose run ubuntu /src/bin/cov-icu4c.sh`
+
+Note: you may want to do `docker-compose run ubuntu` and then run the script from the command line
+if there are problems.
+
+### ICU4J 
+
+- For J, create a similar `src/bin/local-coverity-j.sh`
+- Then run:
+`docker-compose -f local-docker-compose.yml run fedora-j /src/bin/cov-icu4j.sh`
+
 ## Author
 
 Steven R. Loomis

docker-compose.yml

@@ -1,6 +1,12 @@
 # © 2016 and later: Unicode, Inc. and others.
 # License & terms of use: http://www.unicode.org/copyright.html
 
+fedora-j:
+  build: ./dockerfiles/fedora-j
+  volumes:
+    - ./src:/src
+    - ./dist:/dist
+
 ubuntu:
   build: ./dockerfiles/ubuntu
   volumes:

dockerfiles/fedora-j/Dockerfile

@@ -0,0 +1,28 @@
+# © 2016 and later: Unicode, Inc. and others.
+# License & terms of use: http://www.unicode.org/copyright.html
+
+FROM registry.fedoraproject.org/fedora:latest
+MAINTAINER Steven R. Loomis <[email protected]>
+
+USER root
+ENV HOME /home/build
+RUN useradd -c "Build user" -d $HOME -m build
+#ENV RPMOPTZ --setopt=deltarpm=false
+# sanity and safety
+RUN dnf -q -y upgrade $RPMOPTZ
+ADD adoptopenjdk.repo /etc/yum.repos.d
+RUN dnf -q -y install adoptopenjdk-8-openj9 $RPMOPTZ
+RUN dnf -q -y install ant $RPMOPTZ
+RUN dnf -q -y install git curl maven gpg $RPMOPTZ
+#extra
+# editing
+#RUN apt-get -q -y install emacs24-nox
+RUN mkdir /src /dist
+VOLUME /src
+VOLUME /dist
+VOLUME /home/build
+WORKDIR /home/build
+USER build
+ENV JAVA_HOME /usr/lib/jvm/adoptopenjdk-8-openj9/
+WORKDIR /src/icu/icu4j
+

dockerfiles/fedora-j/adoptopenjdk.repo

@@ -0,0 +1,6 @@
+[AdoptOpenJDK]
+name=AdoptOpenJDK
+baseurl=http://adoptopenjdk.jfrog.io/adoptopenjdk/rpm/fedora/$releasever/$basearch
+enabled=1
+gpgcheck=1
+gpgkey=https://adoptopenjdk.jfrog.io/adoptopenjdk/api/gpg/key/public

src/bin/cov-icu4c.sh

@@ -0,0 +1,50 @@
+#!/bin/sh
+
+PROJ=icu4c
+COVDIR=/src/bin/cov-analysis-linux64/
+#  much of the rest is common to C and J - except build and auth
+if [ ! -x /src/bin/local-coverity.sh ];
+then
+    echo missing /src/bin/local-coverity.sh
+    exit 1
+fi
+. /src/bin/local-coverity.sh
+if [ ! -d ${COVDIR} ];
+then
+    echo missing coverity dir ${COVDIR}
+    exit 1
+fi
+
+export PATH=${COVDIR}/bin:${PATH}
+export WORKSPACE=$(pwd)
+export SRCDIR=/src/icu/${PROJ}
+BLDDIR=${WORKSPACE}/build/${PROJ}.build.cov
+echo building ${SRCDIR} in ${BLDDIR}
+rm -rf ${BLDDIR} ; mkdir -p ${BLDDIR}
+VERFILE=${SRCDIR}/source/common/unicode/uvernum.h
+# Get the ICU version from uversion.h or other headers
+geticuversion() {
+    sed -n 's/^[ 	]*#[ 	]*define[ 	]*U_ICU_VERSION[ 	]*"\([^"]*\)".*/\1/p' "$@"
+}
+ICUVER=`geticuversion ${VERFILE}`
+SVN_REVISION=$(cd ${SRCDIR} >/dev/null && (git describe --tags --exact-match 2>/dev/null || git rev-parse --short HEAD) || echo 'unknown')
+echo $ICUVER $SVN_REVISION
+cd ${BLDDIR}
+# C specific build
+${SRCDIR}/source/configure --disable-renaming --disable-extras --with-data-packaging=archive
+env COVERITY_UNSUPPORTED=1 ${COVDIR}/bin/cov-build --dir cov-int make || exit 1
+fgrep '[WARNING] No files were emitted' cov-int/build-log.txt  && exit 1
+tar cfpz ${PROJ}.tgz cov-int &&
+ls -lh ${PROJ}.tgz &&
+curl --form token=${COVERITY_TOKEN} \
+     --form email=${COVERITY_EMAIL} \
+     --form file=@${PROJ}.tgz \
+     --form version="${ICUVER}" \
+     --form description="Manual submit from ${COVERITY_EMAIL} ${SVN_REVISION}" \
+     https://scan.coverity.com/builds?project=${PROJ} -o form-submit.$$
+cat form-submit.$$ || exit 1
+echo uploaded r${SVN_REVISION} ${PROJ} ${ICUVER} as ${PROJ}.tgz
+echo done
+exit 0
+
+

src/bin/cov-icu4j.sh

@@ -0,0 +1,52 @@
+#!/bin/sh
+
+PROJ=icu4j
+COVDIR=/src/bin/cov-analysis-linux64/
+#  much of the rest is common to C and J - except build and auth
+if [ ! -x /src/bin/local-coverity.sh ];
+then
+    echo missing /src/bin/local-coverity-j.sh
+    exit 1
+fi
+. /src/bin/local-coverity-j.sh
+if [ ! -d ${COVDIR} ];
+then
+    echo missing coverity dir ${COVDIR}
+    exit 1
+fi
+
+export PATH=${COVDIR}/bin:${PATH}
+# export WORKSPACE=$(pwd)
+export SRCDIR=/src/icu/icu4j
+# BLDDIR=${HOME}/${PROJ}.build.cov
+# echo building ${SRCDIR} in ${BLDDIR}
+# rm -rf ${BLDDIR} ; mkdir -p ${BLDDIR}
+# assume we can use C's ver!
+VERFILE=${SRCDIR}/../icu4c/source/common/unicode/uvernum.h
+# Get the ICU version from uversion.h or other headers
+geticuversion() {
+    sed -n 's/^[ 	]*#[ 	]*define[ 	]*U_ICU_VERSION[ 	]*"\([^"]*\)".*/\1/p' "$@"
+}
+ICUVER=`geticuversion ${VERFILE}`
+SVN_REVISION=$(cd ${SRCDIR} >/dev/null && (git describe --tags --exact-match 2>/dev/null || git rev-parse --short HEAD) || echo 'unknown')
+echo $ICUVER $SVN_REVISION
+cd ${SRCDIR}
+# C specific build
+# ${SRCDIR}/source/configure --disable-renaming --disable-extras --with-data-packaging=archive
+ant clean
+env COVERITY_UNSUPPORTED=1 ${COVDIR}/bin/cov-build --dir ${HOME}/cov-int ant || exit 1
+fgrep '[WARNING] No files were emitted' ${HOME}/cov-int/build-log.txt  && exit 1
+cd ${HOME} && tar cfpz ${PROJ}.tgz ./cov-int &&
+ls -lh ${PROJ}.tgz &&
+curl --form token=${COVERITY_TOKEN} \
+     --form email=${COVERITY_EMAIL} \
+     --form file=@${PROJ}.tgz \
+     --form version="${ICUVER}" \
+     --form description="Manual submit from ${COVERITY_EMAIL} ${SVN_REVISION}" \
+     https://scan.coverity.com/builds?project=${PROJ} -o form-submit.$$
+cat form-submit.$$ || exit 1
+echo uploaded r${SVN_REVISION} ${PROJ} ${ICUVER} as ${PROJ}.tgz
+echo done
+exit 0
+
+