Build the Sample Program (Java)

We will build and analyze the project with a codesonar analyze command line.

1. Save a copy of BasicJava.java to the working directory (right-click on the link and select Save Target As... or equivalent).
   Make sure your browser does not append any file extension (such as .txt) to the downloaded file. If it does, rename the file back to BasicJava.java.
2. The CodeSonar Java analysis operates on compiled Java classes, so we start by compiling BasicJava.java with javac.
   javac --release 18 BasicJava.java
   • If the path to your JDK bin directory is not in your PATH, you will need to provide the full path to javac.
   • If you prefer, you can use your normal Java build tools instead of invoking javac. Make sure you compile as Java 18, and output the resulting BasicJava.class to the current directory (or specify the path to BasicJava.class in the next step).
3. Execute the project build/analysis command.
   If your hub is running at the default location, you don't need to specify it.

   Default hub location	CodeSonar SaaS	codesonar analyze cs-BasicProj -remote "/saas/*" cs-java-scan -include-artifacts BasicJava.class -include-sources BasicJava.java
   	otherwise	codesonar analyze cs-BasicProj cs-java-scan -include-artifacts BasicJava.class -include-sources BasicJava.java
   Explicit hub location	CodeSonar SaaS	codesonar analyze cs-BasicProj -remote "/saas/*" hub_address:hub_port cs-java-scan -include-artifacts BasicJava.class -include-sources BasicJava.java
   	otherwise	codesonar analyze cs-BasicProj hub_address:hub_port cs-java-scan -include-artifacts BasicJava.class -include-sources BasicJava.java

   Note that this command line includes the following elements.

   Command Line Element	Value	Notes
   Project Name	cs-BasicProj	This functions as the unique identifier for the analyzed project when analysis results are sent to the hub. We give the CodeSonar project a different name from the underlying software project (BasicProj) to distinguish them for the purpose of the tutorial. There is, however, no reason you cannot give a CodeSonar project the same name as the analyzed software project, and many users prefer to do so.
   Project Path	[empty]	We will analyze in the current working directory. File cs-BasicProj.prj and directory cs-BasicProj.prj_files/ will be created here to store analysis information.
   Analysis Launch Daemon	-remote "/saas/*" or [empty]	For CodeSonar SaaS analysis, instruct the hub to choose a suitable analysis launch daemon from its saas launchd group so that the analysis can be started and managed remotely. Otherwise, start and manage the analysis locally.
   Hub Location	hub_address:hub_port	The location of the hub you are using. If your hub is running at the default location, you do not need to specify it.
   Observed Build Command	cs-java-scan -include-artifacts BasicJava.class -include-sources BasicJava.java cs-java-scan itself is a null function: its only purpose is to be recognized by CodeSonar so that the Java bytecode and source files it specifies can be incorporated into the project. -include-artifacts BasicJava.class specifies that file BasicJava.class in the current directory should be included in the CodeSonar project as an ordinary artifact: one for which we wish CodeSonar to issue warnings and are providing the corresponding source code. -include-sources BasicJava.java specifies that the CodeSonar project should include file BasicJava.java in the current directory as a source file. (For full information on the cs-java-scan command, see Build and Analysis for Java Projects)

4. If CodeSonar requests a hub user account username and password, enter them at the prompt.
   (If Anonymous can authorize the analysis, CodeSonar will not prompt you for credentials.)
   
   • If you need hub account credentials to proceed but do not have any, consult the hub Administrator. They may need to create a user account for you, or to provide you with information about an existing account that has been created for you.

   Once the command has been authorized, CodeSonar will start building the project. Command-line output will describe the actions that CodeSonar is performing.

5. In some cases you may be prompted to perform one or more of the following.

   Accept the CodeSonar License	[Command line prompt] If this is the first time you are building a project and you have not yet accepted the CodeSonar license agreement, CodeSonar will print the text of the agreement and ask whether you want to accept it. Press y to accept the license and proceed with the build. (If you accidentally press the wrong key, causing CodeSonar to abandon the build, just re-run the build command.) If your window history is not long enough to scroll over the entire text of the license agreement, you can examine the agreement file at $CSONAR/EULA.txt.
   Opt in or out of uploading anonymous usage statistics	[Command line prompt] If this is the first time you are building a project and you have not yet specified whether you want to upload anonymized usage statistics to CodeSecure, CodeSonar will ask "Send anonymous usage statistics to CodeSecure?" now. Press y to opt in; n to opt out. You can change this setting at any time.
   User Account Control	If User Account Control is enabled, your system may request permission for cs_uac_daemonize.exe from CodeSecure, Inc to continue. Click Continue to proceed.
   Service Authentication	[Dialog, Windows only] If you are running CodeSonar with services, a services authentication dialog may open at the point where the command-line output looks something like this: ... ok Checking whether I can connect to [::1]:num... ok Creating cshub database... ok Enter your username and password, and click OK. For more information, see section CodeSonar as a Windows Service.

   CodeSonar will continue building, then perform the analysis and print a URL for the analysis results.

   ...
   codesonar: Logging to cs-BasicProj.prj_files\log.txt...
   your_build_command
   codesonar: Building cs-BasicProj.prj...
   codesonar: Analysis initialized.
   codesonar: Live progress and results are visible at:
   codesonar: http://[::1]:7340/analysis/1.html
   codesonar: This url is only accessible from http clients on machine_name.
   codesonar: However, there may be other urls that are more widely accessible.
   

   (If you specified a different hub location, this will be reflected in the result location URL.)

6. Open the specified URL in a web browser.
7. If the CodeSonar GUI displays a message requesting that you sign in, enter your hub user account credentials.
   • You will not be asked to sign in if the hub is configured to permit anonymous browsing. Hubs with factory settings will permit anonymous browsing.
   • If you are asked to sign in and do not know your hub user account username or password, consult your hub Administrator.
8. Go on to Analysis Page and Warning Reports.