I don't know if cppcheck is the best static checker there is, but it's found a few problems already, and I had it installed, so this is an initial response to Jani's suggestion of having one or more targets to run static checkers. I punted on a few of the tricker issues: cppcheck is run serially here, even though it scales rather well, and the target is optional. The rest of the series fixes complaints of cppcheck so that in principle, we could run it automatically. My main reason for not doing so is that I don't want builds that break with a new release of cppcheck.