Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

Inputs: names starting with '-' become tool options, --static with --invoke runs a tool twice, missing inputs found late

Open
  • Is something wrong?
#190 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
3/5
Estimated time
1-2 days
Newbie friendliness
50/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
cpp
Domain
cli, devtools

Research direction

Start with src/Process/Tools/FlawfinderToolImplementation.cpp near line 18 and include/Process/Tools/AnalysisTools.hpp lines 212-213, where input paths are passed to tools without a -- separator, and compare with how the cppcheck and runtime-analyzer paths are built. Then find where --static and --invoke selections are combined, and check the input-resolution step for missing files and --compile-commands. Done means each acceptance item in the issue has a test: a -x.c input is analyzed, cppcheck runs once, and a missing path exits 1 with that path named.

Written by the indexing model from the issue text.

Description

bug severity/minor

Three problems with how inputs reach the tools, found by the resilience campaign (docs/quality/resilience.md).

1. File names that start with - are read as options (C37)

ctrace --input ./-F.c --invoke flawfinder

The path is normalized to -F.c and passed to flawfinder as an argument, which reads it as an option: *** getopt error: option -. not recognized, exit 3. A repository can name its files freely, and flawfinder and ikos have options that write files. src/Process/Tools/FlawfinderToolImplementation.cpp:18 and include/Process/Tools/AnalysisTools.hpp:212-213 pass paths without a -- separator; cppcheck and tscancode use --file-list, and the runtime analyzer already passes --.

Fix: pass -- before the file paths, or ./ before a path that starts with -.

2. --static with --invoke runs a tool twice (C36)

ctrace --input ok.c --static --invoke cppcheck runs cppcheck twice and counts each of its findings twice.

Fix: merge the selections into one set of tools before running them.

3. Missing inputs are found late (C07, C08, C23)

A missing input file is passed to the tools, which fail: the run ends with exit 3, "cppcheck could not run", instead of saying that the file does not exist. A --compile-commands that does not exist gives "No input files resolved" without naming it.

Fix: check that each input exists before running any tool, and exit 1 naming the missing path.

Acceptance

  • An input named -x.c is analyzed by every tool.
  • --static --invoke cppcheck runs cppcheck once.
  • A missing input or compile database exits 1 with its path in the message.
  • A test for each.
Dominant language
C++
Stars
5
Forks
4
Avg merge
1h 10m
Merged PRs (30d)
79

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from CoreTrace/coretrace

All issues in CoreTrace/coretrace

Similar issues

More C++ issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.