aurora-lint Developer Guide

aurora-lint is a terminal-based static analysis tool that validates C code compliance with SEI CERT C Coding Standards. It tracks 311 rules (307 implemented and enabled by default) across 17 CERT C categories, using tree-sitter for fast AST-based analysis with cross-file context, control-flow graphs, and inter-procedural reasoning.

This guide covers advanced usage, CI/CD integration, the interactive console UI, testing methodology, project internals, and contributing.

Contents

• Advanced CLI Usage
  • Full Command Reference
  • Cross-File Analysis
  • Using a Compile Database
  • Reaching the Compiler’s Own Headers
  • Seeing Where the Engine Is Blind
  • File Exclusion
  • Export Formats
  • Severity Filtering
  • Rule Filtering
  • Diff Mode
  • Project-Relevance Detection
  • Exit Codes
• Suppression System
  • Design intent: surface, don’t silence
  • Inline Comment Suppression
  • Pre-rename spellings (still accepted)
  • External Suppression File
  • Wildcard Suppression
  • Hash Details
• Configuration
  • Manifest File
  • Custom Manifest Format
  • Supported CERT C Rules
  • Strict vs. Relaxed Onboarding
  • Tracked but not implemented
• CI/CD Integration
  • General Strategy
  • GitHub Actions
  • Azure DevOps
  • Knowing What the Scan Could Not See
  • SARIF Integration Tips
  • CI/CD Readiness
• Interactive Console UI
  • Violations Tab
  • Configuration Tab
  • Keyboard Reference
    • Navigation (both tabs)
    • Tab Switching
    • Violations Tab – Selection
    • Violations Tab – Actions
    • Violations Tab – Sorting / Grouping
    • Configuration Tab
• Testing Methodology
  • Benchmark Strategy
  • Unit Tests
    • The Benchmark Harness (Python)
    • Fixture Provenance
    • What the Fixture Corpus Does and Does Not Measure
  • NIST Juliet Test Suite Benchmarking
    • How Juliet Benchmarking Works
    • Current Results (v0.4.116)
    • FP Reduction History
  • Real-World Code Analysis
    • Known Per-Rule Corpus Caveats
  • Cross-Tool Comparison Methodology
    • Apples-to-Apples Concerns
    • Recommended Comparison Workflow
    • Published CERT-C Results
  • Test Infrastructure Details
    • Build-Time Test Generation
    • Test File Naming Conventions
    • Test Distribution by Rule Size
    • What Tests Do NOT Cover
    • Coverage Gate
    • Embedded Rust Unit Tests
    • Known Rule Implementation Gaps
  • Benchmark Caveats And Rule-Suite Coverage
  • Juliet TP rate is not the ceiling signal — the flaw-hit rate is
  • Rule-suite coverage
• Comparison To Other Tools
  • The Tools
  • Coverage Is The Difference
  • Juliet, On The Overlap
  • Speed
  • Real-World Precision, Per Rule
  • What The Trade Actually Is
• Juliet Benchmark History
  • Benchmark Environment
  • FP Reduction History (Full Round List)
  • Per-Round Fix Details
    • v0.3.19 — Fast Benchmark Mode + CWE-78 Taint Tracking
    • v0.3.17 — CWE-78 Macro Alias Resolution + CWE-253 Incorrect Return Check
    • v0.3.14 — EXP33-C, INT30-C, EXP34-C FP Fixes (Full Suite)
    • v0.3.9 — P3214 Real-World FP Fixes (12-CWE Subset)
    • v0.3.8 — STR31-C, API00-C, EXP34-C, EXP33-C FP Fixes (12-CWE Subset)
    • v0.3.5 — Struct Field Type Resolution, Real-World FP Fixes
    • v0.2.25 — ARR32-C Tightening, Rule Removals, Value-Range FP Fixes
    • v0.2.23 — INT32-C Const-Eval for Allocation/Memory/Abs + INT30-C Built-in Macros
    • v0.2.16 — EXP34-C: Call-Site Null Propagation (Phase 2)
    • v0.2.21 — Const-Eval Value-Range Analysis + Real-World Round 6 FP Fixes
    • v0.2.20 — Real-World FP Fixes (API00-C, INT01-C, EXP37-C, EXP34-C)
    • v0.2.19 — Real-World FP Reduction (INT30-C Loop Guards, Prescan Null Guards, ARR00-C Fix)
    • v0.2.18 — Quick Wins FP Reduction (INT31-C, ARR36-C, API00-C, INT30-C)
    • v0.2.17 — Phase 3: CWE-476 FP Reduction (MEM10-C, API00-C, API02-C, Prescan)
    • v0.2.15 — Real-World FP Cleanup (17 Patterns)
    • v0.2.13 — INT31-C Implicit Narrowing + Real-World FP Fixes
    • v0.2.12 — DCL13-C Pointer Modification + INT01-C sizeof Skip
    • v0.2.7 — INT36-C TP Restore + INT31-C FP Fix
    • Round 16 — DCL13-C main() Exemption + MEM10-C Parameter-Only Null Check
    • Round 15 — EXP34-C: if/else Branch Merge
    • Round 14 — EXP34-C: deref_after_check Pattern
    • Round 13 — STR31-C: L-prefix and Literal-Source Fixes
    • Round 12 — INT07-C, INT32-C, EXP10-C, EXP34-C, INT30-C, MEM10-C, STR31-C, Windows API
    • Round 9 — CFG, Data-Flow, Inter-Procedural Analysis
    • Round 8 — DCL40-C, FLP32-C, ERR33-C
    • Round 7 — EXP36-C, EXP34-C, ARR37-C
    • Round 6 — Cross-File Analysis (-d)
    • Round 5 — FLP02-C, DCL06-C, INT30-C
    • Round 4 — EXP12-C, FLP03-C, INT32-C
    • Round 3 — DCL31-C, DCL07-C, FLP34-C
    • Round 2 — EXP33-C, SIG31-C, ARR01-C, DCL30-C, DCL02-C
    • Round 1 — INT08-C, CON08-C, DCL20-C, ARR38-C
  • Performance by CWE Category (Historical Snapshot)
    • Tier 1: Strong Detection (TP > 50%) — 18 categories
    • Tier 2: Moderate Detection (35–50%) — 68 categories
    • Tier 3: Below Average (25–35%) — 16 categories
    • Tier 4: Weak Detection (<25%) — 4 categories
  • Full Per-CWE Results (Round 1 Baseline)
  • Per-Rule Data Accuracy Note (2026-03-03)
  • Competitor Comparison
  • Version History (v0.2.1 – v0.3.17)
  • Version History (v0.3.20 – present, fast mode)
  • Scripts and Data Locations
• Analysis Architecture
  • Analysis Modules
  • Current Capabilities
  • Known Limitations
  • Architectural Ceiling
  • Competitor Landscape
• Benchmark Setup
  • Benchmark Host Layout
  • Installing Comparison Tools
    • cppcheck
    • clang-tidy
    • bear (for compile_commands.json)
    • Facebook Infer
    • Frama-C
    • Build-based tools need a compile database
  • Juliet Test Suite Setup
  • Third-Party Library Headers
    • Per-Project Include Paths
  • Real-World Project Setup
    • Pinned Source Commits
    • Verifying the Pins
    • Clone and Pin
  • Running Each Tool Manually
    • cppcheck
    • clang-tidy
  • Per-Project Commands
    • libcrc
    • sqlite
    • mosquitto
    • curl
    • hostap
  • Verifying Results
    • Known Pitfalls
  • Output Format Reference
  • Distributed Benchmarking with GNU Parallel
  • Exporting competitor results for ingest
• Running Benchmarks (MCP Server)
  • Benchmark Infrastructure
    • SQLite Schema
  • Benchmark Workflow Protocol
    • Pre-Benchmark Checklist
  • Juliet Benchmark
    • Compile-Database Runs
  • Real-World Benchmark
    • Per-Codebase Rule Configs
    • Per-Codebase Scan Scope
    • Auto-Scoring
  • Real-World Ground-Truth Oracle (measured precision/recall)
    • Delta-Adjudication Gate
  • Comparing Across Runs
    • Juliet
    • Real-World
  • Competitor Benchmarks (Infer / Frama-C)
    • Infrastructure
    • Running
    • Timing Estimates
    • Classification Logic
  • Troubleshooting
    • Resolved Issues
• Reproducing the Published Numbers
  • What “reproduces” means
  • Input 1: the analyzer – tag, SHA and version string
    • Determinism boundary
  • Input 2: the labels – benchmark_adjudication at a SHA
  • Input 3: the corpus – pinned checkouts and Juliet
    • Real-world codebases
    • Juliet
  • Procedure
    • Real-world half
    • Juliet half
    • Hardware, time and memory
    • What another machine reproduces, measured
  • Reading a mismatch
• Project Structure
• Future Rulesets Beyond CERT C
  • Why CERT C Is The Base Standard
  • The Power of 10 Rules (NASA JPL, 2006)
  • JPL Institutional Coding Standard (2009)
    • Multi-threading / Concurrency
    • Other Key Rules
    • Earlier Standards Referenced by JPL
  • BARR-C Embedded C Coding Standard
  • Candidate Rules for Implementation
    • Core Safety Rules (Pre-MISRA)
    • Embedded-Specific Rules
    • Multi-threading Safety (JPL-specific)
• Contributing
  • Adding a New CERT C Rule
  • Build Requirements
  • Development Node Setup
• Licensing and content provenance
  • Summary
  • The CERT terms
  • Trademark, which is separate from copyright
  • What a packager needs to write
  • Re-deriving the counts
  • Third-party Rust dependencies
• Bibliography
  • Juliet & Vulnerability Detection Studies
  • NIST SATE Reports
  • Tool Comparison & Industry Studies
  • False Positive Rate Benchmarks
    • Industry FP Rate Context
  • Standards & Specifications
  • NASA & Aerospace