Add the Cppcheck command line program

Cppcheck is a static analysis tool that's pretty easy to build and
include. Its "addons" are excluded since they depend on Python, as are
the "platforms" configuration since none of them are useful for Windows
applications. The "win32A" and "win32W" platforms are already embedded
within the tool.

It has a "FILESDIR" option to locate its configuration data. Relative
paths are unsupported, and so this feature is useless for a "portable"
Windows application. Fortunately it searches next to the executable, so
it can still find its configuration as long as it resides in the same
directory. These should not be in bin/, so build an alias to redirect
execution into share/.

This is yet another open source project that does not publish a stable
source tarball, so this build is likely to fail in the future when
GitHub changes its tarball layout. The --remote-header-name curl option
tells it to pick up the GitHub-provided name rather than use the request
path. Fortunately this doesn't seem to interfere with other downloads.

Dockerfile

@@ -14,6 +14,7 @@ ARG MINGW_VERSION=10.0.0
 ARG MPC_VERSION=1.2.1
 ARG MPFR_VERSION=4.1.0
 ARG NASM_VERSION=2.15.05
+ARG CPPCHECK_VERSION=2.8
 ARG VIM_VERSION=9.0
 
 RUN apt-get update && apt-get install --yes --no-install-recommends \
@@ -21,7 +22,7 @@ RUN apt-get update && apt-get install --yes --no-install-recommends \
 
 # Download, verify, and unpack
 
-RUN curl --insecure --location --remote-name-all \
+RUN curl --insecure --location --remote-name-all --remote-header-name \
     https://ftp.gnu.org/gnu/binutils/binutils-$BINUTILS_VERSION.tar.xz \
     https://ftp.gnu.org/gnu/gcc/gcc-$GCC_VERSION/gcc-$GCC_VERSION.tar.xz \
     https://ftp.gnu.org/gnu/gdb/gdb-$GDB_VERSION.tar.xz \
@@ -34,7 +35,8 @@ RUN curl --insecure --location --remote-name-all \
     http://ftp.vim.org/pub/vim/unix/vim-$VIM_VERSION.tar.bz2 \
     https://www.nasm.us/pub/nasm/releasebuilds/$NASM_VERSION/nasm-$NASM_VERSION.tar.xz \
     http://deb.debian.org/debian/pool/main/u/universal-ctags/universal-ctags_0+git$CTAGS_VERSION.orig.tar.gz \
-    https://downloads.sourceforge.net/project/mingw-w64/mingw-w64/mingw-w64-release/mingw-w64-v$MINGW_VERSION.tar.bz2
+    https://downloads.sourceforge.net/project/mingw-w64/mingw-w64/mingw-w64-release/mingw-w64-v$MINGW_VERSION.tar.bz2 \
+    https://github.com/danmar/cppcheck/archive/$CPPCHECK_VERSION.tar.gz
 COPY src/SHA256SUMS $PREFIX/src/
 RUN sha256sum -c $PREFIX/src/SHA256SUMS \
  && tar xJf binutils-$BINUTILS_VERSION.tar.xz \
@@ -49,7 +51,8 @@ RUN sha256sum -c $PREFIX/src/SHA256SUMS \
  && tar xzf make-$MAKE_VERSION.tar.gz \
  && tar xjf mingw-w64-v$MINGW_VERSION.tar.bz2 \
  && tar xJf nasm-$NASM_VERSION.tar.xz \
- && tar xjf vim-$VIM_VERSION.tar.bz2
+ && tar xjf vim-$VIM_VERSION.tar.bz2 \
+ && tar xzf cppcheck-$CPPCHECK_VERSION.tar.gz
 COPY src/w64devkit.c src/w64devkit.ico src/alias.c src/debugbreak.c \
      $PREFIX/src/
 
@@ -413,6 +416,20 @@ RUN sed -i /RT_MANIFEST/d win32/ctags.rc \
         OPT= CFLAGS=-Os LDFLAGS=-s \
  && cp ctags.exe $PREFIX/bin/
 
+WORKDIR /cppcheck-$CPPCHECK_VERSION
+RUN $ARCH-g++ -Os -s -o cppcheck.exe \
+    -Ilib -Iexternals/simplecpp -Iexternals/tinyxml2 -Iexternals/picojson \
+    cli/*.cpp lib/*.cpp \
+    externals/tinyxml2/tinyxml2.cpp externals/simplecpp/simplecpp.cpp \
+    -lshlwapi \
+ && mkdir $PREFIX/share/cppcheck/ \
+ && cp -r cppcheck.exe cfg/ $PREFIX/share/cppcheck \
+ && $ARCH-gcc -DEXE=../share/cppcheck/cppcheck.exe -DCMD=cppcheck \
+        -Os -ffreestanding -fno-ident -fno-asynchronous-unwind-tables \
+        -s -nostdlib \
+        -o $PREFIX/bin/cppcheck.exe \
+        $PREFIX/src/alias.c -lkernel32
+
 # Pack up a release
 
 WORKDIR /

README.md

@@ -13,6 +13,7 @@ Included tools:
 * [Vim][vim] : powerful text editor
 * [Universal Ctags][ctags] : source navigation
 * [NASM][nasm] : x86 assembler
+* [Cppcheck][cppcheck] : static code analysis
 
 The toolchain includes pthreads, C++11 threads, and OpenMP. All included
 runtime components are static. **Docker/Podman is not required to use the
@@ -75,6 +76,24 @@ including any headers.
 
     $ cc -Os -D__USE_MINGW_ANSI_STDIO=0 ...
 
+## Cppcheck tips
+
+Use `--library=windows` for programs calling the Win32 API directly, which
+adds additional checks. In general, the following configuration is a good
+default for programs developed using w64devkit:
+
+    $ cppcheck --quiet -j$(nproc) --library=windows \
+               --suppress=uninitvar --enable=portability,performance .
+
+A "strict" check that is more thorough, but more false positives:
+
+    $ cppcheck --quiet -j$(nproc) --library=windows \
+          --enable=portability,performance,style \
+          --suppress=uninitvar --suppress=unusedStructMember \
+          --suppress=constVariable --suppress=shadowVariable \
+          --suppress=variableScope --suppress=constParameter \
+          --suppress=shadowArgument --suppress=knownConditionTrueFalse .
+
 ## Fortran support
 
 Only C and C++ are included by default, but w64devkit also has full
@@ -159,6 +178,7 @@ binaries.
 [bb]: https://frippery.org/busybox/
 [break]: https://nullprogram.com/blog/2022/06/26/
 [bs]: https://www.rdegges.com/2016/i-dont-give-a-shit-about-licensing/
+[cppcheck]: https://cppcheck.sourceforge.io/
 [ctags]: https://github.com/universal-ctags/ctags
 [doc-bb]: https://busybox.net/downloads/BusyBox.txt
 [doc-cpp]: https://en.cppreference.com/w/Cppreference:Archives

src/SHA256SUMS

@@ -1,5 +1,6 @@
 e316477a914f567eccc34d5d29785b8b0f5a10208d36bbacedcc39048ecfe024  binutils-2.38.tar.xz
 4fb69baa813f7ecb305497a2b996220ed5d04c021a4f9d2b3656df10c235c84e  busybox-w32-FRP-4716-g31467ddfc.tgz
+57298f3b805f0eb816a04115fbc70e701f75083cfb0305a44246e365cf27606a  cppcheck-2.8.tar.gz
 f79b8f904b749e3e0d20afeadecf8249c55b2e32d4ebb089ae378df479dcaf25  expat-2.4.8.tar.xz
 62fd634889f31c02b64af2c468f064b47ad1ca78411c45abe6ac4b5f8dd19c7b  gcc-12.1.0.tar.xz
 aaa1223d534c9b700a8bec952d9748ee1977513f178727e1bee520ee000b4f29  gdb-10.2.tar.xz