Will clang frontend plan/accept misra check tools?

Clang Frontend
22

While I cannot speak for anyone that follows me, my understanding of the Rules is that, once placed into the Open Source space, it cannot be withdrawn…

You will also forgive me for spluttering at the term restrictive - I appreciate it’s a different world out here

23

What I said was that for another names open source tool we have placed the headlines under a CC NC ND. The NC was explicitly stated because said tool has a non-free (commercial, premium) version…

Other options are possibly available, subject to negotiation…

24

Also, please remember that the MISRA Guidelines are much more than just the headline text - the amplifications contain tweaks/clarifications (to keep headlines shorter) and there are exceptions, while the rationale and examples provide clarification.

This is most often evidenced by tool users not understanding why they are getting a violation (based on the headline) - when they’ve obviously not read the full guidance!

25

I don’t know that the community wants to “negotiate” here. This is the LLVM license:

If MISRA wants to provide the headline text under the LLVM license terms, that makes the licensing side of things easy because we don’t need lawyers involved. If MISRA is not willing to do that, we would need a s strong urging from the community for the LLVM Foundation to pursue this further.

1 Like
26

I assumed the worst, but if it really works the way you describe, this helps with one of the concerns I have.

That’s fair. I used that word in literal sense, because CC-BY-NC-ND imposes additional restrictions compared to Apache 2.0 with LLVM exception, and some of them make it quite difficult for us, as outlined earlier in this thread.

I’m glad you chimed in on our forums. Now it’s clear who can be contacted on the MISRA side to start such negotiations.

1 Like
27

The way I see it, the rule headlines are the least of our problems. clang-tidy can simply print the rule number without any restrictions or negotiations. A user of clang-tidy is expected to have the MISRA document if they want to get their code checked against it, to fully understand the rationale and exceptions to the rules (as mentioned before).

The real problem is getting access to the full MISRA document for LLVM contributors, to ensure code review can be done and the implementation and tests are correct.

The LLVM foundation could purchase the document (one-time payment) licensed up to X number of developers, and host it in a place that only contributors have access to. Of course, this greatly restricts the number of people that can develop MISRA checks. It’s slightly better than no-one being able to develop, though :slight_smile:

28

I really appreciate @AndrewBanks coming here to discuss this with us! This kind of communication is really helpful to us.

That said, I’m not convinced that MISRA is actually workable with an open source contribution model, at least from what I’ve seen so far in the thread. The problems as I see them are (in no particular order):

  1. There’s uncertainty around the license. We can likely work through that, but it involves the foundation lawyers doing the legwork, so we’d need some commitment that someone will actually develop the checks before we involve the lawyers.
  2. Documenting the checks will be novel for us. We usually document what the checks are going to do, what options they have and why, and we may link to external resources to explain in more detail (C++ Core Guidelines, CERT, etc). We can’t really link anywhere for MISRA and we have to walk a fine line in terms of what we document. This potentially involves the foundation lawyers signing off on the documentation for each check.
  3. We have never had checks which the community cannot freely validate the correctness of before. We could go through the foundation to handle the licensing, but that’s putting a burden on them to track who has access to what documents. Our community members come and go, so there’s additional complexity there.
  4. Our community pays the development, review, and maintenance costs to ultimately produce additional sales for MISRA, while taking on not-insignificant legal risks.
  5. There are no guarantees that the terms won’t be changed in the future (for better or for worse).

Basically, most of the concerns revolve around legal issues. None of this impossible for us to overcome, but it’s a lot of challenges and uncertainty for us.

@AndrewBanks is there a way MISRA can help remove these kinds of barriers? I’d like to support MISRA checks, but I’d only be comfortable doing so if there were fewer legal concerns, the guidelines were freely available to developers in our community for purposes of helping to develop and review checks, and/or MISRA could provide labor to sign off on things like check correctness and documentation suitability in any situation where license concerns may still apply (basically, indemnify us so we don’t have to worry about the legal concerns of releasing the checks to our users).

8 Likes
29

Thanks :slight_smile:

Let me raise this at MISRA Towers, and see what the feedback is…

Thanks to all the contributors to the discussion so far… I appreciate the concerns, but on the other hand, I have to be mindful of the views of the commercial entities that have funded MISRA development…

3 Likes
31

@AndrewBanks Are there any news in this area?

I can mention that it appears the MISRA C++:2023 Rule Texts seems to be publicly available, for example here:
https://se.mathworks.com/help/bugfinder/misra-cpp-2023-rules-and-directives.html

Since the “cat is already out of the bag”, can’t MISRA simply publish exactly that somewhere (Gitlab, MISRA webpage, etc)? I think that is enough documentation for us to be able to implement checks. Otherwise we would need to refer to the Matlab webpage which does not feel like a “source of truth”.

32

I guess the TL;DR; answer is No

The proposal for a CC-BY-NC-ND file (as with other tools) was rejected as being too restrictive…

We have a meeting in July, where I can see what options we heve.

1 Like