Paul Eggert wrote: > Another possibility would be to libraryize Gnulib, scan that library > once and record its false positives on your side once, and then change > Gnulib-using packages to use that library instead of their in-source > Gnulib copies. This would also be some work on your side, but it might > fit better into your workflow.
This is nontrivial work. We started some of it in 2010; the current status is written up in the file 'STATUS-libposix'. We haven't worked on it for 10 years. Part of the problem is that we have no clue how to address the versioning of this library. Bruno