From f377310679d4d7c85bd2396d9c02e88f9672187d Mon Sep 17 00:00:00 2001
From: Jesus Checa Hidalgo <jchecahi@redhat.com>
Date: Tue, 16 Nov 2021 10:59:41 +0100
Subject: [PATCH] Add valgrind specific rpminspect configuration

---
 gating.yaml     |  1 +
 rpminspect.yaml | 33 +++++++++++++++++++++++++++++++++
 2 files changed, 34 insertions(+)
 create mode 100644 rpminspect.yaml

diff --git a/gating.yaml b/gating.yaml
index 8daf6e5..0ae927e 100644
--- a/gating.yaml
+++ b/gating.yaml
@@ -5,6 +5,7 @@ decision_context: bodhi_update_push_stable
 subject_type: koji_build
 rules:
   - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build.tier0.functional}
+  - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build.rpminspect.static-analysis}
 --- !Policy
 product_versions:
   - rhel-8
diff --git a/rpminspect.yaml b/rpminspect.yaml
new file mode 100644
index 0000000..37b57a6
--- /dev/null
+++ b/rpminspect.yaml
@@ -0,0 +1,33 @@
+---
+inspections:
+  # xml files shipped are GDB register set descriptions which can only be
+  # verified with gdb/features/gdb-target.dtd, provided in GDB sources.
+  xml: off
+
+annocheck:
+  # Ignore files built specially without hardening flags
+  ignore:
+    # Valgrind tools themselves (memcheck, cachegrind, massif, etc) are
+    # statically linked and need to be built without PIE to be loaded at
+    # a fixed address in the program's address space.
+    # Also need to be built without stack protection so the generated
+    # code (valgrind VEX jit) interacts correctly with their own static code.
+    - /usr/libexec/valgrind/*-*-linux
+    # Wrappers for various string and mem functions such as memcpy, strlen, etc
+    # that valgrind uses to keep track of memory usage. Hardening settings such
+    # as optimizations need to be disabled so they don't interfere or break
+    # the checks that valgrind does internally.
+    - /usr/libexec/valgrind/vgpreload*so
+    # libmpiwrap is special since it is a LD_PRELOAD wrapper used by valgrind
+    # memcheck for MPI using programs, the wrapper is against a specific MPI
+    # implementation though, in our case openmpi. We don't want to have a hard
+    # dependency on openmpi however, so a user can use the wrapper without
+    # explicitly pulling in openmpi unless the program explicitly uses it.
+    - /usr/lib*/openmpi/valgrind/libmpiwrap-*-linux.so
+
+runpath:
+  allowed_paths:
+    # As described above, libmpiwrap is a wrapper against openmpi
+    # so we set DT_RUNPATH to openmpi libs path
+    - /usr/lib/openmpi/lib
+    - /usr/lib64/openmpi/lib