Re: tar + cpio - covscan issues

[Bruno Haible]

Paul Eggert wrote:
> Another possibility would be to libraryize Gnulib, scan that library 
> once and record its false positives on your side once, and then change 
> Gnulib-using packages to use that library instead of their in-source 
> Gnulib copies. This would also be some work on your side, but it might 
> fit better into your workflow.

This is nontrivial work. We started some of it in 2010; the current status
is written up in the file 'STATUS-libposix'. We haven't worked on it
for 10 years. Part of the problem is that we have no clue how to address
the versioning of this library.

Bruno