Hi Varun,

To provide some more context. As you know the membership fees to trustedfirmware.org [1] provide funding to help support services to the various projects hosted by trustedfirmware.org. The licensing of Bugseng ECLAIR is one such service approved by the trustedfirmware.org board that is itself made up membership representatives being made available to projects.

For the TF-A project deployment answers to your questions are below.

1. Is the tool available to the community? Yes.

1. Can people run this before submission? Or is it restricted to a certain group? The objective is to run this as part of patch submission testing for all patches submitted for review.

1. Will full reports be released to the community? Yes.

1. What will the deployment model look like? So access to Bugseng ECLAIR will be via the OpenCI and in the case of TF-A will be on all patches submitted for review in Gerrit with the Bugseng ECLAIR testing invoked via the Allow-CI Gerrit label setting to kick off appropriate Jenkins jobs. The goal is to identify new MISRA failures introduced by the patch against a baseline run(s) against the mainline branch. There will be other OpenCI Jenkin jobs and scripts to help establish and evolve the baseline run(s). Detailed run logs will be made available via the existing OpenCI Jenkins jobs artifact mechanism and reporting pages. The exact details are still being worked out but hopefully that gives you the basic idea.

We can indeed have a future Tech Forum session on TF-A usage of Bugseng ÉCLAIR.

Thanks

Joanna

[1] https://www.trustedfirmware.org/join/

From: Varun Wadekar vwadekar@nvidia.com Date: Monday, 9 May 2022 at 21:36 To: Joanna Farley Joanna.Farley@arm.com Cc: tf-a@lists.trustedfirmware.org tf-a@lists.trustedfirmware.org Subject: ECLAIR for static analysis Hi @Joannamailto:Joanna.Farley@arm.com,

I am glad that tf.org has taken this step to improve code quality with the latest announcement [1]. Some questions to understand the model a bit better.

1. Is the tool available to the community? 2. Can people run this before submission? Or is it restricted to a certain group? 3. Will full reports be released to the community? 4. What will the deployment model look like?

I suggest we discuss this in a tech forum to reach the entire community.

-Varun

[1] https://www.trustedfirmware.org/news/BugSeng_press_release/https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.trustedfirmware.org%2Fnews%2FBugSeng_press_release%2F&data=05%7C01%7Cvwadekar%40nvidia.com%7C8d9c839387744742638808da31e1f16a%7C43083d15727340c1b7db39efd9ccc17a%7C0%7C0%7C637877143725610148%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=GZNSsOA6wmwWtxccBC1apPy9ZjPldqU7Sp52hLu2eSY%3D&reserved=0 https://www.bugseng.com/eclairhttps://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.bugseng.com%2Feclair&data=05%7C01%7Cvwadekar%40nvidia.com%7C8d9c839387744742638808da31e1f16a%7C43083d15727340c1b7db39efd9ccc17a%7C0%7C0%7C637877143725610148%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=BMfTU322hCct6pbTXNA8FtgQNeWRmvMyEgaTrMK2yTw%3D&reserved=0 https://www.bugseng.com/sites/default/files/resources/ECLAIR_TUV-SUD_Certifi...https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.bugseng.com%2Fsites%2Fdefault%2Ffiles%2Fresources%2FECLAIR_TUV-SUD_Certificate.pdf&data=05%7C01%7Cvwadekar%40nvidia.com%7C8d9c839387744742638808da31e1f16a%7C43083d15727340c1b7db39efd9ccc17a%7C0%7C0%7C637877143725610148%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=88Ng0%2BDeaAJeEyqlIadgnpO2PeHWunsuyPkHiLxFZJI%3D&reserved=0