hohnlab.org — Master Index

1. Overview

Welcome to the hohnlab.org master index. This page links to subprojects hosted here and on github.

2. CodeQL end-to-end

CodeQL turns a source tree into a queryable database, applies a selected query pack to that database, and emits SARIF for downstream review. The detailed local workflow is documented in the CodeQL end-to-end report.

Build mode none (D_bmn)

Success counts: 843 CodeQL DB zip bundles; 832 C/C++ security-and-quality SARIF files. Workflow and results.

1. Source treeProject checkout or extracted package source.
→
2. BMN CodeQL DBCreate with codeql database create --build-mode=none.
→
3. Query packFor example, C/C++ security-and-quality.
→
4. AnalyzeApply the query pack with codeql database analyze.
→
5. BMN SARIFCollect build-mode=none results for review.

Full trace builds (D_bmf)

Success counts: 2,487 CodeQL DB zip bundles; 1,782 C/C++ security-and-quality SARIF files. Workflow and results.

1. Source treeProject checkout or extracted package source.
→
2. BMF CodeQL DBCreate by tracing the real package build command.
→
3. Query packFor example, C/C++ security-and-quality.
→
4. AnalyzeApply the query pack with codeql database analyze.
→
5. BMF SARIFCollect full-trace results for review.

The local comparison uses two database creation modes:

  • full trace / BMF: run the package build under CodeQL so real compiler invocations are observed;
  • build-mode=none / BMN: let CodeQL infer the database from source discovery.

In the sampled corpus, full tracing produced many more successful database bundles and SARIF files. BMN can still produce much larger SARIF for some packages, especially when inferred extraction reaches source sets or diagnostics that the traced build did not cover. The end-to-end report is the best starting point for the size and coverage tradeoffs: CodeQL end-to-end report.

3. MRVA

Components of the MRVA project (Multi-Repository-Variant-Analysis). A fancy term for running a (set of) queries across many repositories and viewing the result. This can be done by hand, from the shell, using a workstation-class machine – but that is exceedingly tedious. The purpose of this system is two-fold:

  1. Allow quick deployment / testing on a single server-class machine
  2. Serve as a basis for depoloyment across a cluster

The client machine parts:

  • gh-mrva — Patched GitHub CLI extension for running multi-repo variant analysis (MRVA) from the command line.
  • vscode-codeql — Patched CodeQL VS Code extension for CodeQL with MRVA support in VS Code.

The server machine / cluster parts:

  • mrvacommander — common library
  • mrvaserver — Go server; configures RabbitMQ, MinIO artifacts, HEPC DB store; HTTP API.
  • mrvaagent — Go worker agent; processes queue work; uses MinIO artifacts and HEPC DB store.
  • mrvahepc — HTTP endpoint for serving CodeQL databases and metadata (Python package). HTML

Development / server part coordination

  • mrva-docker — Lima VM + Docker setup and container builds for the MRVA stack. HTML

4. CodeQL workshops

These are links to CodeQL-related workshops; being workshops, the notes here are frequently lecture-style; they are intended to assist an instructor and may be of limited help in self study. That said, they bridge the gap (chasm) between introductory CodeQL documentation and the CodeQL reference documentation.

5. CodeQL documentation

6. Notes