journal article
Apr 10, 2026
CMakeSonar: A Static Approach to Detecting CMake Bugs with a Fine-Grained Type System
Proceedings of the ACM on Programming Languages
Vol. 10
No. OOPSLA1
pp. 513-539
·
Association for Computing Machinery (ACM)
Abstract
As build systems and their scripts grow in size and complexity, detecting bugs in build configurations becomes increasingly challenging due to the rich functionality and weak typing of build scripting languages. This paper introduces CMakeSonar, the first static approach to precisely identifying semantic bugs in CMake scripts. CMakeSonar addresses this challenge by (1) designing a fine-grained type system that captures the runtime semantics of CMake values, and (2) performing a flow-sensitive analysis that detects inconsistent and ill-typed value usages by solving type constraints. Our approach identifies configuration and usage errors that can silently affect build correctness, portability, and deployment safety. In our evaluation, CMakeSonar identifies 155 bugs across 36 real-world CMake projects on GitHub, of which 23 have been accepted and fixed by developers. With a false positive rate of 4.32% and a recall of 97.48%, CMakeSonar demonstrates that precise static analysis can effectively uncover high-impact bugs in untyped build systems.
Topics
No keywords indexed for this article. Browse by subject →
References
43
[2]
Anthropic Inc. 2025. Claude Sonnet 4. https://www.anthropic.com/claude
[3]
Ellen Arteca Max Schäfer and Frank Tip. 2023. A statistical approach for finding property-access errors. https://doi.org/10.48550/arXiv.2306.08741 10.48550/arXiv.2306.08741
10.48550/arxiv.2306.08741
[5]
Brett Cannon. 2005. Localized type inference of atomic types in python. California Polytechnic State University.
[8]
cmake-format contributers. 2012. CMake-Lint. https://cmake-format.readthedocs.io/en/latest/cmake-lint.html
[11]
Dropbox. 2017. Pyannotate: Auto-generate PEP-484 annotations.. https://github. com/dropbox/pyannotate
[13]
Facebook. 2014. Flow: A Static Type Checker for JavaScript. https://flow.org/
[14]
Facebook. 2017. Pyre-check: Performant type-checking for python.. https://github.com/facebook/pyre-check
[15]
Facebook. 2023. Buck2. https://github.com/facebook/buck2
[17]
GitHub Inc. 2025. GitHub. https://github.com/
[18]
Google Inc. 2015. Bazel. https://github.com/bazelbuild/bazel
[19]
Google, Inc. 2015. Pytype: A static type analyzer for Python code.. https://github.com/google/pytype
[22]
Haotian Han et al. 2026. CMakeSonar Data. https://github.com/orgs/CMakeSonar/repositories
[23]
Haotian Han Zihang Zhong Qingan Li Jingling Xue and Mengting Yuan. 2026. Software Artifact for "CMakeSonar : A Static Approach to Detecting CMake Bugs with a Fine-Grained Type System". https://doi.org/10.1145/3747415 10.1145/3747415
10.1145/3747415
[25]
Instagram. 2017. MonkeyType. https://github.com/Instagram/MonkeyType
[26]
Kitware Inc. 2024. CMake. https://cmake.org/
[28]
Jukka Lehtosalo et al. 2012. mypy - Optional Static Typing for Python. http://mypy-lang.org/
[29]
LLVM Project. 2003. LLVM. https://github.com/llvm/llvm-project
[30]
Microsoft. 2012. TypeScript: JavaScript With Syntax for Types. https://www.typescriptlang.org/
[31]
Microsoft. 2019. Pyright: Static Type Checker for Python. https://github.com/microsoft/pyright
[33]
Neil Mitchell. 2011. Shake Build System. https://shakebuild.com/
[34]
[37]
Jussi Pakkanen. 2013. Meson Build System. https://github.com/mesonbuild/meson
[43]
Chen Yang Ziqi Wang Yanjie Jiang Lin Yang Yuteng Zheng Jianyi Zhou and Junjie Chen. 2025. Reflective Unit Test Generation for Precise Type Error Detection with Large Language Models. https://doi.org/10.48550/arXiv.2507.02318 10.48550/arXiv.2507.02318
10.48550/arxiv.2507.02318
Metrics
0
Citations
43
References
Details
- Published
- Apr 10, 2026
- Vol/Issue
- 10(OOPSLA1)
- Pages
- 513-539
Authors
Funding
National Key R&D Program of China
Award: 2022YFB4400704
Cite This Article
Haotian Han, Zihang Zhong, Qingan Li, et al. (2026). CMakeSonar: A Static Approach to Detecting CMake Bugs with a Fine-Grained Type System. Proceedings of the ACM on Programming Languages, 10(OOPSLA1), 513-539. https://doi.org/10.1145/3798218
Related
You May Also Like
code2vec: learning distributed representations of code
Uri Alon, Meital Zilberstein · 2019
880 citations
Grounded Copilot: How Programmers Interact with Code-Generating Models
Shraddha Barke, Michael B. James · 2023
275 citations