Coverity Reviews

We use Coverity during the software integration phase. We have a lot of components so we use Coverity to build the components, analyze and publish the data into sonar server and that's our work.

Depending on our product's needs, we defined the rule set to check and improve the source code.

The features I find most valuable is that our entire company can publish the analysis results into our central space. That allows us to see the latest quality of all components on the sonar web page.

My personal opinion is that the webpage of the last version of Coverity is not very easy to use. They've made some unnecessary changes and now I can't see all the analysis results or my status from when we started using the solution up to now. Because we have many components on the integration field, it is sometimes hard to find files of one specific component because we use relative path. When I look at the components, they all look very similar. But that is just my personal opinion.

I would also like to see a more user-friendly user interface and configuration. I can see the menu on the left but it's a little different from the other tools that I use, but this is perhaps only a personal thing. 

Coverity is a very stable solution.

I believe the solution is scalable. Sometimes I want to put one component in a certain project, and I need to find what's the best way for us. We have a lot of users using Coverity and we will adapt it into our program. 

Most of the time I just do some research myself and Google their webpage to see how I can find a solution for my problem. The program has a tools team to help find the solutions. 

My personal business used other tools that offered sonar language tracking. We used a mix of programs with specific options and some standard gcc options. But last year our team preferred to use more visual tools to follow the whole company's policy. That is why we chose Coverity.

We have an administrator for the deployment, so I am only a user. I just added a few projects and streams, and use the data extracted from the compilation, and run the analysis. The setup did take a long time, however.

We implement through an in-house tools team.

I don't care it so much.

For the setup, it's better to adapt the solution from the mature projects.

Don't care so much the pricing and licensing being the end user.

Before choosing, we tried to use gcc compiler options, i.e. 

EXT_GCOV_FLAGS='-fprofile-arcs -ftest-coverage'
EXT_GCOV_LDFLAGS=-fprofile-arcs
EXT_CC_FLAGS=-fdiagnostics-show-option
GCOV_LIB=-lgcov

I will suggest that when they use the program for a new project, they should just copy the data from a mature solution to the new project because the setup really takes a long time. We spent a lot of time to set Coverity up because I thought of creating the project in the Coverity server and use Coverity for the sonar part properly. But it took a long time. I will give the solution a 7.5 rating out of ten. When we officially use all the data, it will accumulate more experiences and then we will have different opinions.

I use the solution for static analysis.

The product has good API documentation. I’m quite happy with it. The product is easy to use.

Sometimes it's a bit hard to figure out how to use the product’s UI.

I have been using the solution for some years.

I have not faced any issues with the product’s stability.

The solution is scalable. Four people in my organization use the solution.

The initial setup is easy.

I am using the latest version of the product. I have also used Clang Static Analyzer. People planning to use the solution should try the open-source version first to understand how it works. We must have the paid version of the product to get all the resources and documentation. Overall, I rate the product an eight out of ten.

We are working on medical devices, and the code base is written in C++. We use Coverity to find the vulnerability in those C++ codes.

Coverity is easy to set up and has a less lengthy process to find vulnerabilities.

The solution's user interface and quality gate could be improved.

I have been using Coverity for four months.

Coverity has good stability.

I rate Coverity more than eight out of ten for stability.

Around 20 to 25 developers use Coverity in our organization.

I rate Coverity a seven to eight out of ten for scalability.

We use SonarQube for Java-based projects and Coverity for C and C++-based projects.

The solution’s initial setup is simple.

Overall, I rate Coverity a seven out of ten.

• Raising the level of code quality, security, and robustness in the codebase
• Tracking and addressing code quality issues.
  

Coverity provides developers with a good, best practice, coding advice, and tracks risks of poor coding quality. Coverity reports have urged developers to improve the quality of their code.

• I like that it gives advice and training on how to resolve the most common quality issues. 
• Links to more details on each issue and the background and risks.
  

• Ability to follow source file s-links into the target location for issuing assignments through GIT.  Our current build environment uses symbolic links into the git repo and Coverity does not follow the link into the actual location of the source file to determine the git author.
• Single API for all interactions. I am not a fan of using both SOAP and REST APIs and Coverity offers a mix of functionality depending on the interface used. I would greatly prefer a full REST API with improved documentation for all actions including issuing assignments, streaming, and project creation. 

We are using GK and the latest version for port deployment.

I have been using Coverity for three and a half years.

Coverity is not stable but it is sufficient for our organization's requirements.

Coverity is scalable.

We contacted technical support to help us clean up an issue we had.

If they have a cluster structure, then definitely they should use Coverity. I would rate Coverity a nine out of ten.

We use Coverity for static analysis of our code.

Coverity is far from perfection, and I'm not 100 percent sure it's helping me find what I need to find in my role. We need exactly what we are looking for, i.e. security errors and vulnerabilities. It doesn't seem to be reporting while we are changing our code. So either we are perfect, or the tool is missing something. 

I've been using Coverity for a couple of years.

I haven't had much experience trying to scale up Coverity. Only three people at our company work with it.

I encountered a bug with Coverity, and I opened a ticket. Support provided me with a workaround. So it's working at the moment, or at least it seems to be. They are on par with other tech support in terms of knowledge. However, their style of communication could use some improvement.

Setting up Coverity is highly complex. The upgrade procedure is also pretty tough. We've had trouble with it on at least one occasion. When I went ahead with it, it destroyed the installation. I couldn't go back. So it's challenging to understand from the documentation. It seems like they tried to cover all possible topics in their manuals, so they ended up scratching the surface of everything in the world except for the particular practical items that I needed.

Coverity is very expensive.

I rate Coverity five out of 10, but it's tough for me to judge because we decided to purchase it based on one requirement that no other static analysis tool could satisfy. For that reason, we haven't tried anything else. So, let's make an analogy. Let's say I used Sony TVs my entire life, and someone comes up and says, "Hey, there is a new brand of TVs. What do you think of them? Do you think they are good?" How would I know? By comparison, SonarQube seems to be more feature-rich for a standard programming language, and it works with more continuous integration tools.

We use it in our company during product development.

It provides reports about a lot of potential defects.

Its price can be improved. Price is always an issue with Synopsys.

I have been using Coverity for about three or four years.

It has good stability.

Its scalability is good. 

They are professional and very responsible. They have a local FAE.

It is not straightforward, but it is also not too complex. The learning curve needed for installing Coverity is okay.

It is expensive.

I would recommend this solution if you can afford it. If you have enough budget, it is one of the best solutions right now. There may be other cheaper solutions, but you get what you pay for.

We have been using Coverity for several years. We would not have continued using it if it was not a good solution. We always have some minor questions or improvements for them, and they always give us a relatively fast response.

I would rate Coverity a nine out of ten. Only its price should be improved.

We have a development team and we are using this product for static code analysis.

This product has definitely helped our organization. Based on what I have heard from the development team, they have found a lot of issues before code goes into production.

The most valuable feature is the integration with Jenkins. Jenkins can be used to automatically run it to perform the code analysis.

Integration with GitLab is helpful.

Coverity is too costly, which is why we are trying other tools. Ideally, it would have a user-based license that does not have a restriction in the number of lines of code.

We have been using Coverity for between five and six years.

Coverity is used across our entire organization.

The initial setup in the Windows environment was straightforward. However, for Linux, it has some complexity.

We have a separate team in the company that takes care of deployment. One person is enough for the task

The licensing fees are based on the number of lines of code. We may not need more than five user licenses but with a restriction on the number of lines of code, for a small company the cost will shoot up.

Our license for Coverity has expired and we are in the process of exploring new static code analysis tools. Ideally, we would like to have one that is low-cost.

One of the products that I have downloaded a trial version for is SonarQube. At this point, I have only installed the Windows version but I plan on testing the Linux version, as well.

In summary, this is a helpful product and the feedback that I have heard from the development team is good.

I would rate this solution an eight out of ten.