CMakeSonar: A Static Approach to Detecting CMake Bugs with a Fine-Grained Type System

Abstract

As build systems and their scripts grow in size and complexity, detecting bugs in build configurations becomes increasingly challenging due to the rich functionality and weak typing of build scripting languages. This paper introduces CM ake S onar , the first static approach to precisely identifying semantic bugs in CMake scripts. CM ake S onar addresses this challenge by (1) designing a fine-grained type system that captures the runtime semantics of CMake values, and (2) performing a flow-sensitive analysis that detects inconsistent and ill-typed value usages by solving type constraints. Our approach identifies configuration and usage errors that can silently affect build correctness, portability, and deployment safety. In our evaluation, CM ake S onar identifies 155 bugs across 36 real-world CMake projects on GitHub, of which 23 have been accepted and fixed by developers. With a false positive rate of 4.32 % and a recall of 97.48 % , CM ake S onar demonstrates that precise static analysis can effectively uncover high-impact bugs in untyped build systems.