LLVM

Repository on GitHub, which provides public git repositories with URLs.

Repository on GitHub, which uses git. git can track the changes, who made them, and when they were made.

Every commit included in our releases is in the public git repository: https://github.com/llvm/llvm-project. We also do release candidate releases prior to final versions e.g.: https://github.com/llvm/llvm-project/releases/tag/llvmorg-17.0.0-rc1 https://github.com/llvm/llvm-project/releases/tag/llvmorg-17.0.0-rc2 https://github.com/llvm/llvm-project/releases/tag/llvmorg-17.0.0-rc3 https://github.com/llvm/llvm-project/releases/tag/llvmorg-17.0.0-rc4

Repository on GitHub, which uses git. git is distributed.

The current project policy is to release a new major release every six months with bug fix releases every two weeks afterwards for 10 to 12 weeks. Example of a year's worth of releases: https://github.com/llvm/llvm-project/releases/tag/llvmorg-16.0.0 https://github.com/llvm/llvm-project/releases/tag/llvmorg-16.0.1 https://github.com/llvm/llvm-project/releases/tag/llvmorg-16.0.2 https://github.com/llvm/llvm-project/releases/tag/llvmorg-16.0.3 https://github.com/llvm/llvm-project/releases/tag/llvmorg-16.0.5 https://github.com/llvm/llvm-project/releases/tag/llvmorg-16.0.6 * Note due to a packaging mistake, we withdrew the 17.0.0 release and replaced it with 17.0.1. https://github.com/llvm/llvm-project/releases/tag/llvmorg-17.0.1 https://github.com/llvm/llvm-project/releases/tag/llvmorg-17.0.2 https://github.com/llvm/llvm-project/releases/tag/llvmorg-17.0.3 https://github.com/llvm/llvm-project/releases/tag/llvmorg-17.0.4 https://github.com/llvm/llvm-project/releases/tag/llvmorg-17.0.5 https://github.com/llvm/llvm-project/releases/tag/llvmorg-17.0.6

We use git tags to identify each release. e.g. https://github.com/llvm/llvm-project/releases/tag/llvmorg-17.0.6

We have started doing individual release notes for each bug fix release now:

https://github.com/llvm/llvm-project/releases/tag/llvmorg-18.1.3

We added a note about the most recent CVE to our release notes:

https://github.com/llvm/llvm-project/releases/tag/llvmorg-18.1.3

https://github.com/llvm/llvm-project/issues

https://github.com/llvm/llvm-project/issues

On March 28, 2024, I ran a query looking at all the issues in the last 12 months:

87.2% of the bugs had at least one person other than the reporter 'participate' in the bug. 49.9% of the bugs has at least two people other than the reporter 'participate' in the bug.

From what I can tell 'participate' means someone added a comment, a label, or a reaction to a bug.

https://github.com/llvm/llvm-project/issues

Security Reporting Process: https://llvm.org/docs/Security.html#how-to-report-a-security-issue

The instructions here are for reporting a vulnerability privately: https://llvm.org/docs/Security.html#how-to-report-a-security-issue

We aim to respond in 2 business days: https://llvm.org/docs/Security.html#how-to-report-a-security-issue

We provide a CMake build system for general use. In addition, there is a GN and also a Bazel build system that can be used as an alternative to CMake in some configurations.

You can build the software using CMake, which is a very common tool.

CMake is a FLOSS tool you can build the project with.

The main test suites are integrated into the https://github.com/llvm/llvm-project repository. Instructions for how to run the tests can be found in our testing guide: https://llvm.org/docs/TestingGuide.html We have buildbots that automatically build and test the new code when it is committed: https://lab.llvm.org/buildbot/#/console

You can run the test suite using make check-all or ninja check-all depending on which tool you are using. See https://llvm.org/docs/TestingGuide.html

As of November 2023, our tests suite covered ~85% of the clang, llvm, and lldb sub-projects. See https://lab.llvm.org/coverage/coverage-reports/coverage/Users/buildslave/jenkins/workspace/coverage/llvm-project/index.html

When code is merged to the main branch, there is an automated buildbot system that tests the result: https://lab.llvm.org/buildbot/#/console

We have a policy of requiring tests for bug fixes and new features: https://llvm.org/docs/DeveloperPolicy.html#test-cases

Commit logs for some of our test directories: https://github.com/llvm/llvm-project/commits/main/llvm/test https://github.com/llvm/llvm-project/commits/main/clang/test

This is a smaller feature, but this patch for new functionality added tests: https://github.com/llvm/llvm-project/commit/8186e1500b1d9709f10199b7c599274f8a6f8e3a

We don't really have an official change proposal policy, but we do mention n the developer policy that tests should be added for new features: https://llvm.org/docs/DeveloperPolicy.html#test-cases

The project enables -Wextra and other warnings by default and also enables -Wall except when compiling with clang-cl: https://github.com/llvm/llvm-project/blob/e07a2f49e3d3c13b6e9b89e0f6118652f2b2d3ac/llvm/cmake/modules/HandleLLVMOptions.cmake#L774

Our latest release (17.0.6) had 9,636,137 lines of code ( cloc --include-lang="C,C++,C/C++ Header" compiler-rt/ clang-tools-extra/ libcxx libcxxabi/ libunwind/ openmp/ lld lldb polly mlir flang llvm/ bolt clang/). In our official release builds, there were 110 warnings: https://github.com/llvm/llvm-project/actions/runs/7017442066/job/19094022079. This is less that 1 per 100 lines.

The project enables -Wall (in most configurations) and -Wextra by default. https://github.com/llvm/llvm-project/blob/e07a2f49e3d3c13b6e9b89e0f6118652f2b2d3ac/llvm/cmake/modules/HandleLLVMOptions.cmake#L774

As of 4/23/2024, we have at least 2 developers how meet this criteria, see the discussion here: https://discourse.llvm.org/t/do-you-have-secure-development-knowledge/78429/4

As of 4/23/2024, we have at least 2 developers how meet this criteria, see the discussion here: https://discourse.llvm.org/t/do-you-have-secure-development-knowledge/78429/4

Releases are hosted on https://github.com/llvm/llvm-project/releases

We sign our source tarballs, but not our release binaries.

All our release assets are hosted at https://github.com/llvm/llvm-project/releases which uses https.

As of May 9, 2024, all medium or higher CVEs listed here have been fixed: https://nvd.nist.gov/vuln/search/results?form_type=Advanced&results_type=overview&search_type=all&isCpeNameSearch=false&cpe_vendor=cpe%3A%2F%3Allvm

As of May 9, 2024, according to https://nvd.nist.gov/vuln/search/results?form_type=Advanced&results_type=overview&search_type=all&isCpeNameSearch=false&cpe_vendor=cpe%3A%2F%3Allvm there have been no critical CVEs assigned to the project.

We use https://www.passwordstore.org/ to encrypt and store our project credentials in a private git repository.

We are running the clang static analyzer against our main branch one per day, and we will be running it for every commit the release branches going forward. https://github.com/llvm/llvm-project/actions/workflows/ci-post-commit-analyzer.yml

We don't currently use a static analysis tool.

We don't currently use a static analysis tool.

We don't currently use a static analysis tool.

We have several buildbots that run tests with the sanitizers enabled: https://lab.llvm.org