Merge remote-tracking branch 'origin/topic/timw/clang-tidy-performance-fixes'

* origin/topic/timw/clang-tidy-performance-fixes:
  Add move operations for LogWriteHeader
  Add missing setting of type in session::Key move operations
  Update .clang-tidy to have performance-* enabled with some exclusions
  Fix clang-tidy performance-inefficient-string-concatenation warnings
  Fix clang-tidy performance-unnecessary-copy-initialization warnings
  Fix clang-tidy performance-move-const-argument warnings (not move assignable/copyable)
  Fix clang-tidy performance-move-const-argument warnings (passing move to const argument)
  Fix clang-tidy performance-move-const-argument warnings (moving trivially copyable)
  Fix clang-tidy performance-move-const-argument warnings (moving const variables)
  Fix clang-tidy performance-inefficient-vector-operation warnings
  Fix clang-tidy performance-for-range-copy warnings
  Fix clang-tidy performance-faster-string-find warnings
  Fix clang-tidy performance-enum-size warnings
  Fix clang-tidy performance-avoid-endl warnings

.clang-tidy

@@ -1,9 +1,11 @@
 Checks: [-*,
          bugprone-*,
+         performance-*,
 
          # Skipping these temporarily because they are very noisy
          -bugprone-narrowing-conversions,
          -bugprone-unchecked-optional-access,
+         -performance-unnecessary-value-param,
 
          # The following cause either lots of pointless or advisory warnings
          -bugprone-easily-swappable-parameters,
@@ -22,5 +24,9 @@ Checks: [-*,
          -bugprone-undefined-memory-manipulation,
          -bugprone-pointer-arithmetic-on-polymorphic-object,
          -bugprone-empty-catch,
-         -bugprone-exception-escape
+         -bugprone-exception-escape,
+
+         # This one returns a bunch of findings in DFA and the sqlite library.
+         # We're unlikely to fix either of them.
+         -performance-no-int-to-ptr,
 ]

CHANGES

@@ -1,3 +1,13 @@
+8.0.0-dev.286 | 2025-05-30 08:12:43 -0700
+
+  * Add move operations for LogWriteHeader (Tim Wojtulewicz, Corelight)
+
+  * Add missing setting of type in session::Key move operations (Tim Wojtulewicz, Corelight)
+
+  * Update .clang-tidy to have performance-* enabled with some exclusions (Tim Wojtulewicz, Corelight)
+
+  * Fix clang-tidy performance-* warnings (Tim Wojtulewicz, Corelight)
+
 8.0.0-dev.271 | 2025-05-30 16:48:43 +0200
 
   * Update doc submodule [nomail] [skip ci] (Arne Welzel, Corelight)

VERSION

@@ -1 +1 @@
-8.0.0-dev.271
+8.0.0-dev.286

src/Expr.cc

@@ -1026,8 +1026,8 @@ ValPtr BinaryExpr::TableFold(Val* v1, Val* v2) const {
 }
 
 ValPtr BinaryExpr::AddrFold(Val* v1, Val* v2) const {
-    IPAddr a1 = v1->AsAddr();
+    const IPAddr& a1 = v1->AsAddr();
-    IPAddr a2 = v2->AsAddr();
+    const IPAddr& a2 = v2->AsAddr();
     bool result = false;
 
     switch ( tag ) {

src/Reassem.cc

@@ -52,7 +52,7 @@ void DataBlockList::Delete(DataBlockMap::const_iterator it) {
 }
 
 DataBlock DataBlockList::Remove(DataBlockMap::const_iterator it) {
-    auto b = std::move(it->second);
+    auto b = it->second;
     auto size = b.Size();
 
     block_map.erase(it);

src/ScannedFile.cc

@@ -49,6 +49,6 @@ bool ScannedFile::AlreadyScanned() const {
 SignatureFile::SignatureFile(std::string file) : file(std::move(file)) {}
 
 SignatureFile::SignatureFile(std::string file, std::string full_path, Location load_location)
-    : file(std::move(file)), full_path(std::move(full_path)), load_location(std::move(load_location)) {}
+    : file(std::move(file)), full_path(std::move(full_path)), load_location(load_location) {}
 
 } // namespace zeek::detail

src/Type.cc

@@ -2348,7 +2348,7 @@ TypePtr merge_record_types(const Type* t1, const Type* t2) {
                 attrs3->AddAttrs(td2->attrs);
 
             attrs3->AddAttr(make_intrusive<detail::Attr>(detail::ATTR_OPTIONAL));
-            auto td_merge = new TypeDecl(util::copy_string(td2->id), std::move(td2->type), attrs3);
+            auto td_merge = new TypeDecl(util::copy_string(td2->id), td2->type, attrs3);
             tdl3->push_back(td_merge);
         }
     }

src/Var.cc

@@ -467,7 +467,7 @@ static std::optional<FuncType::Prototype> func_type_check(const FuncType* decl,
                 auto msg = ad->DeprecationMessage();
 
                 if ( ! msg.empty() )
-                    msg = ": " + msg;
+                    msg = std::string{": "}.append(msg);
 
                 reporter->Deprecation(util::fmt("use of deprecated parameter '%s'%s (%s)", rval->args->FieldName(i),
                                                 msg.data(), obj_desc_short(impl).c_str()),

src/analyzer/protocol/http/HTTP.cc

@@ -20,14 +20,14 @@ const bool DEBUG_http = false;
 
 // The EXPECT_*_NOTHING states are used to prevent further parsing. Used if a
 // message was interrupted.
-enum HTTP_ExpectRequest {
+enum HTTP_ExpectRequest : uint8_t {
     EXPECT_REQUEST_LINE,
     EXPECT_REQUEST_MESSAGE,
     EXPECT_REQUEST_TRAILER,
     EXPECT_REQUEST_NOTHING,
 };
 
-enum HTTP_ExpectReply {
+enum HTTP_ExpectReply : uint8_t {
     EXPECT_REPLY_LINE,
     EXPECT_REPLY_MESSAGE,
     EXPECT_REPLY_TRAILER,
@@ -1417,7 +1417,7 @@ void HTTP_Analyzer::HTTP_Upgrade() {
                 analyzer_tag_val->GetType<EnumType>()->Lookup(analyzer_tag_val->AsEnum()),
                 upgrade_protocol_val->CheckString());
         auto analyzer_tag = analyzer_mgr->GetComponentTag(analyzer_tag_val.get());
-        auto* analyzer = analyzer_mgr->InstantiateAnalyzer(std::move(analyzer_tag), Conn());
+        auto* analyzer = analyzer_mgr->InstantiateAnalyzer(analyzer_tag, Conn());
         if ( analyzer ) {
             AddChildAnalyzer(analyzer);
 

src/analyzer/protocol/irc/IRC.cc

@@ -357,8 +357,10 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig) {
                 parts.erase(parts.begin(), parts.begin() + 4);
 
                 string real_name = parts[0];
-                for ( size_t i = 1; i < parts.size(); ++i )
+                for ( size_t i = 1; i < parts.size(); ++i ) {
-                    real_name = real_name + " " + parts[i];
+                    real_name += " ";
+                    real_name += parts[i];
+                }
 
                 if ( real_name[0] == ':' )
                     real_name = real_name.substr(1);

src/analyzer/protocol/mime/MIME.cc

@@ -30,13 +30,13 @@ int mime_header_only = 0;
 int mime_decode_data = 1;
 int mime_submit_data = 1;
 
-enum MIME_HEADER_FIELDS {
+enum MIME_HEADER_FIELDS : uint8_t {
     MIME_CONTENT_TYPE,
     MIME_CONTENT_TRANSFER_ENCODING,
     MIME_FIELD_OTHER,
 };
 
-enum MIME_CONTENT_SUBTYPE {
+enum MIME_CONTENT_SUBTYPE : uint8_t {
     CONTENT_SUBTYPE_MIXED,       // for multipart
     CONTENT_SUBTYPE_ALTERNATIVE, // for multipart
     CONTENT_SUBTYPE_DIGEST,      // for multipart
@@ -50,7 +50,7 @@ enum MIME_CONTENT_SUBTYPE {
     CONTENT_SUBTYPE_OTHER,
 };
 
-enum MIME_CONTENT_ENCODING {
+enum MIME_CONTENT_ENCODING : uint8_t {
     CONTENT_ENCODING_7BIT,
     CONTENT_ENCODING_8BIT,
     CONTENT_ENCODING_BINARY,
@@ -59,7 +59,7 @@ enum MIME_CONTENT_ENCODING {
     CONTENT_ENCODING_OTHER,
 };
 
-enum MIME_BOUNDARY_DELIMITER {
+enum MIME_BOUNDARY_DELIMITER : uint8_t {
     NOT_MULTIPART_BOUNDARY,
     MULTIPART_BOUNDARY,
     MULTIPART_CLOSING_BOUNDARY,

src/analyzer/protocol/ssl/SSL.cc

@@ -131,7 +131,7 @@ void SSL_Analyzer::SetKeys(const zeek::StringVal& nkeys) {
     std::copy(nkeys.Bytes(), nkeys.Bytes() + nkeys.Len(), std::back_inserter(keys));
 }
 
-void SSL_Analyzer::SetKeys(const std::vector<u_char> newkeys) { keys = std::move(newkeys); }
+void SSL_Analyzer::SetKeys(std::vector<u_char> newkeys) { keys = std::move(newkeys); }
 
 std::optional<std::vector<u_char>> SSL_Analyzer::TLS12_PRF(const std::string& secret, const std::string& label,
                                                            const std::string& rnd1, const std::string& rnd2,

src/analyzer/protocol/ssl/SSL.h

@@ -90,7 +90,7 @@ public:
      * @param keys The key buffer as derived via TLS PRF (for
      * AES_GCM this should be 72 bytes in length)
      */
-    void SetKeys(const std::vector<u_char> newkeys);
+    void SetKeys(std::vector<u_char> newkeys);
 
     /**
      * Check if the connection is flipped--meaning that the TLS client is the responder of the

src/broker/Data.cc

@@ -198,13 +198,13 @@ struct val_converter {
 
                     if ( disambiguate ) {
                         // Disambiguate from composite key w/ multiple vals.
-                        composite_key.emplace_back(std::move(item));
+                        composite_key.emplace_back(item);
                         indices = &composite_key;
                     }
                 }
             }
             else {
-                composite_key.emplace_back(std::move(item));
+                composite_key.emplace_back(item);
                 indices = &composite_key;
             }
 
@@ -247,13 +247,13 @@ struct val_converter {
 
                     if ( disambiguate ) {
                         // Disambiguate from composite key w/ multiple vals.
-                        composite_key.emplace_back(std::move(item.first));
+                        composite_key.emplace_back(item.first);
                         indices = &composite_key;
                     }
                 }
             }
             else {
-                composite_key.emplace_back(std::move(item.first));
+                composite_key.emplace_back(item.first);
                 indices = &composite_key;
             }
 
@@ -694,8 +694,7 @@ struct type_checker {
         else if ( type->Tag() == TYPE_OPAQUE ) {
             // TODO: Could avoid doing the full unserialization here
             // and just check if the type is a correct match.
-            auto cpy = a;
+            auto ov = OpaqueVal::UnserializeData(BrokerListView{&a});
-            auto ov = OpaqueVal::UnserializeData(BrokerListView{&cpy});
             return ov != nullptr;
         }
 
@@ -729,19 +728,19 @@ std::optional<broker::data> val_to_data(const Val* v) {
             return {broker::port(p->Port(), to_broker_port_proto(p->PortType()))};
         }
         case TYPE_ADDR: {
-            auto a = v->AsAddr();
+            const auto& a = v->AsAddr();
             in6_addr tmp;
             a.CopyIPv6(&tmp);
             return {broker::address(reinterpret_cast<const uint32_t*>(&tmp), broker::address::family::ipv6,
                                     broker::address::byte_order::network)};
         } break;
         case TYPE_SUBNET: {
-            auto s = v->AsSubNet();
+            const auto& s = v->AsSubNet();
             in6_addr tmp;
             s.Prefix().CopyIPv6(&tmp);
             auto a = broker::address(reinterpret_cast<const uint32_t*>(&tmp), broker::address::family::ipv6,
                                      broker::address::byte_order::network);
-            return {broker::subnet(std::move(a), s.Length())};
+            return {broker::subnet(a, s.Length())};
         } break;
         case TYPE_DOUBLE: return {v->AsDouble()};
         case TYPE_TIME: {
@@ -1036,7 +1035,7 @@ IMPLEMENT_OPAQUE_VALUE(zeek::Broker::detail::DataVal)
 std::optional<BrokerData> DataVal::DoSerializeData() const { return BrokerData{data}; }
 
 bool DataVal::DoUnserializeData(BrokerDataView dv) {
-    data = std::move(*dv.value_);
+    data = *dv.value_;
     return true;
 }
 

src/broker/Manager.cc

@@ -539,7 +539,7 @@ void Manager::DoInitPostScript() {
         reporter->FatalError("Invalid Broker::web_socket_overflow_policy: %s", web_socket_overflow_policy);
     }
 
-    broker::configuration config{std::move(options)};
+    broker::configuration config{options};
 
     config.openssl_cafile(get_option("Broker::ssl_cafile")->AsString()->CheckString());
     config.openssl_capath(get_option("Broker::ssl_capath")->AsString()->CheckString());
@@ -678,6 +678,7 @@ void Manager::DoTerminate() {
     iosource_mgr->UnregisterFd(bstate->loggerQueue->FlareFd(), this);
 
     vector<string> stores_to_close;
+    stores_to_close.reserve(data_stores.size());
 
     for ( auto& x : data_stores )
         stores_to_close.push_back(x.first);
@@ -910,7 +911,7 @@ bool Manager::PublishIdentifier(std::string topic, std::string id) {
         return false;
     }
 
-    broker::zeek::IdentifierUpdate msg(std::move(id), std::move(data.value_));
+    broker::zeek::IdentifierUpdate msg(std::move(id), data.value_);
     DBG_LOG(DBG_BROKER, "Publishing id-update: %s", RenderMessage(topic, msg.as_data()).c_str());
     bstate->endpoint.publish(std::move(topic), msg.move_data());
     num_ids_outgoing_metric->Inc();
@@ -951,10 +952,9 @@ bool Manager::PublishLogCreate(EnumVal* stream, EnumVal* writer, const logging::
     }
 
     std::string topic = default_log_topic_prefix + stream_id;
-    auto bstream_id = broker::enum_value(std::move(stream_id));
+    auto bstream_id = broker::enum_value(stream_id);
-    auto bwriter_id = broker::enum_value(std::move(writer_id));
+    auto bwriter_id = broker::enum_value(writer_id);
-    broker::zeek::LogCreate msg(std::move(bstream_id), std::move(bwriter_id), std::move(writer_info),
+    broker::zeek::LogCreate msg(bstream_id, bwriter_id, writer_info, fields_data);
-                                std::move(fields_data));
 
     DBG_LOG(DBG_BROKER, "Publishing log creation: %s", RenderMessage(topic, msg.as_data()).c_str());
 
@@ -1028,9 +1028,9 @@ bool Manager::PublishLogWrite(EnumVal* stream, EnumVal* writer, const string& pa
 
     std::string topic = v->AsString()->CheckString();
 
-    auto bstream_id = broker::enum_value(std::move(stream_id));
+    auto bstream_id = broker::enum_value(stream_id);
-    auto bwriter_id = broker::enum_value(std::move(writer_id));
+    auto bwriter_id = broker::enum_value(writer_id);
-    broker::zeek::LogWrite msg(std::move(bstream_id), std::move(bwriter_id), std::move(path), std::move(serial_data));
+    broker::zeek::LogWrite msg(bstream_id, bwriter_id, std::move(path), std::move(serial_data));
 
     DBG_LOG(DBG_BROKER, "Buffering log record: %s", RenderMessage(topic, msg.as_data()).c_str());
 
@@ -1301,8 +1301,7 @@ void Manager::ProcessMessages() {
             // message. Since `topic` still points into the original memory
             // region, we may no longer access it after this point.
             auto topic_str = broker::get_topic_str(message);
-            broker::zeek::visit_as_message([this, topic_str](auto& msg) { ProcessMessage(topic_str, msg); },
+            broker::zeek::visit_as_message([this, topic_str](auto& msg) { ProcessMessage(topic_str, msg); }, message);
-                                           std::move(message));
         } catch ( std::runtime_error& e ) {
             reporter->Warning("ignoring invalid Broker message: %s", +e.what());
             continue;

src/cluster/backend/zeromq/ZeroMQ.cc

@@ -39,7 +39,7 @@ extern zeek::plugin::Zeek_Cluster_Backend_ZeroMQ::Plugin plugin;
 
 namespace cluster::zeromq {
 
-enum class DebugFlag : zeek_uint_t {
+enum class DebugFlag : uint8_t {
     NONE = 0,
     POLL = 1,
     THREAD = 2,
@@ -50,9 +50,7 @@ enum class InprocTag : uint8_t {
     Terminate,
 };
 
-constexpr DebugFlag operator&(zeek_uint_t x, DebugFlag y) {
+constexpr DebugFlag operator&(uint8_t x, DebugFlag y) { return static_cast<DebugFlag>(x & static_cast<uint8_t>(y)); }
-    return static_cast<DebugFlag>(x & static_cast<zeek_uint_t>(y));
-}
 
 #define ZEROMQ_DEBUG(...) PLUGIN_DBG_LOG(zeek::plugin::Zeek_Cluster_Backend_ZeroMQ::plugin, __VA_ARGS__)
 

src/cluster/serializer/binary-serialization-format/Serializer.cc

@@ -134,7 +134,7 @@ std::optional<zeek::logging::detail::LogWriteBatch> detail::BinarySerializationF
 
     fmt.EndRead();
 
-    return logging::detail::LogWriteBatch{std::move(header), std::move(records)};
+    return logging::detail::LogWriteBatch{header, std::move(records)};
 }
 
 #include "zeek/ID.h"

src/input/ReaderBackend.cc

@@ -49,7 +49,7 @@ private:
 
 class ReaderErrorMessage final : public threading::OutputMessage<ReaderFrontend> {
 public:
-    enum Type { INFO, WARNING, ERROR };
+    enum Type : uint8_t { INFO, WARNING, ERROR };
 
     ReaderErrorMessage(ReaderFrontend* reader, Type arg_type, const char* arg_msg)
         : threading::OutputMessage<ReaderFrontend>("ReaderErrorMessage", reader) {

src/logging/Manager.cc

@@ -768,7 +768,7 @@ bool Manager::TraverseRecord(Stream* stream, Filter* filter, RecordType* rt, Tab
 
         // Add the ext prefix if this is an ext field.
         if ( j < num_ext_fields )
-            new_path = filter->ext_prefix + new_path;
+            new_path = string{filter->ext_prefix}.append(new_path);
 
         if ( t->InternalType() == TYPE_INTERNAL_OTHER ) {
             if ( t->Tag() == TYPE_RECORD ) {

src/logging/Types.cc

@@ -8,8 +8,6 @@
 
 namespace zeek::logging::detail {
 
-LogWriteHeader::LogWriteHeader() = default;
-
 LogWriteHeader::LogWriteHeader(EnumValPtr arg_stream_id, EnumValPtr arg_writer_id, std::string arg_filter_name,
                                std::string arg_path)
     : stream_id(std::move(arg_stream_id)),
@@ -20,10 +18,6 @@ LogWriteHeader::LogWriteHeader(EnumValPtr arg_stream_id, EnumValPtr arg_writer_i
     writer_name = obj_desc_short(writer_id.get());
 }
 
-LogWriteHeader& LogWriteHeader::operator=(const LogWriteHeader& other) = default;
-
-LogWriteHeader::~LogWriteHeader() = default;
-
 bool LogWriteHeader::PopulateEnumVals() {
     static const auto& stream_id_type = zeek::id::find_type<zeek::EnumType>("Log::ID");
     static const auto& writer_id_type = zeek::id::find_type<zeek::EnumType>("Log::Writer");

src/logging/Types.h

@@ -40,7 +40,7 @@ struct LogWriteHeader {
     /**
      * Default constructor.
      */
-    LogWriteHeader();
+    LogWriteHeader() = default;
 
     /**
      * Constructor that populates stream_name and writer_name.
@@ -55,12 +55,22 @@ struct LogWriteHeader {
     /**
      * Assignment operator.
      */
-    LogWriteHeader& operator=(const LogWriteHeader& other);
+    LogWriteHeader& operator=(const LogWriteHeader& other) = default;
 
     /**
      * Destructor.
      */
-    ~LogWriteHeader();
+    ~LogWriteHeader() = default;
+
+    /**
+     * Copy constructor.
+     */
+    LogWriteHeader(const LogWriteHeader& other) = default;
+
+    /**
+     * Move constructor.
+     */
+    LogWriteHeader(LogWriteHeader&& other) noexcept = default;
 
     /**
      * Helper to populate stream_id and writer_id after the

src/logging/writers/none/None.cc

@@ -11,10 +11,10 @@ namespace zeek::logging::writer::detail {
 
 bool None::DoInit(const WriterInfo& info, int num_fields, const threading::Field* const* fields) {
     if ( BifConst::LogNone::debug ) {
-        std::cout << "[logging::writer::None]" << std::endl;
+        std::cout << "[logging::writer::None]\n";
-        std::cout << "  path=" << info.path << std::endl;
+        std::cout << "  path=" << info.path << "\n";
-        std::cout << "  rotation_interval=" << info.rotation_interval << std::endl;
+        std::cout << "  rotation_interval=" << info.rotation_interval << "\n";
-        std::cout << "  rotation_base=" << info.rotation_base << std::endl;
+        std::cout << "  rotation_base=" << info.rotation_base << "\n";
 
         // Output the config sorted by keys.
 
@@ -26,14 +26,15 @@ bool None::DoInit(const WriterInfo& info, int num_fields, const threading::Field
         std::sort(keys.begin(), keys.end());
 
         for ( std::vector<std::pair<std::string, std::string>>::const_iterator i = keys.begin(); i != keys.end(); i++ )
-            std::cout << "  config[" << (*i).first << "] = " << (*i).second << std::endl;
+            std::cout << "  config[" << (*i).first << "] = " << (*i).second << "\n";
 
         for ( int i = 0; i < num_fields; i++ ) {
             const threading::Field* field = fields[i];
-            std::cout << "  field " << field->name << ": " << type_name(field->type) << std::endl;
+            std::cout << "  field " << field->name << ": " << type_name(field->type) << "\n";
         }
 
-        std::cout << std::endl;
+        std::cout << "\n";
+        std::cout << std::flush;
     }
 
     return true;

src/packet_analysis/protocol/icmp/ICMP.cc

@@ -15,11 +15,6 @@
 #include "zeek/packet_analysis/protocol/icmp/events.bif.h"
 #include "zeek/session/Manager.h"
 
-enum ICMP_EndpointState {
-    ICMP_INACTIVE, // no packet seen
-    ICMP_ACTIVE,   // packets seen
-};
-
 using namespace zeek::packet_analysis::ICMP;
 using namespace zeek::packet_analysis::IP;
 

src/packet_analysis/protocol/icmp/ICMPSessionAdapter.cc

@@ -9,7 +9,7 @@
 using namespace zeek::packet_analysis::ICMP;
 using namespace zeek::packet_analysis::IP;
 
-enum ICMP_EndpointState {
+enum ICMP_EndpointState : uint8_t {
     ICMP_INACTIVE, // no packet seen
     ICMP_ACTIVE,   // packets seen
 };

src/packet_analysis/protocol/udp/UDPSessionAdapter.cc

@@ -9,7 +9,7 @@
 using namespace zeek::packet_analysis::UDP;
 using namespace zeek::packet_analysis::IP;
 
-enum UDP_EndpointState {
+enum UDP_EndpointState : uint8_t {
     UDP_INACTIVE, // no packet seen
     UDP_ACTIVE,   // packets seen
 };

src/plugin/Manager.cc

@@ -317,7 +317,7 @@ void Manager::ActivateDynamicPlugin(const std::string& name) {
         UpdateInputFiles();
     else
         // Reschedule for another attempt later.
-        requested_plugins.insert(std::move(name));
+        requested_plugins.insert(name);
 }
 
 void Manager::ActivateDynamicPlugins(bool all) {

src/script_opt/CPP/Driver.cc

@@ -341,9 +341,12 @@ void CPPCompile::RegisterCompiledBody(const string& f) {
     auto be = body_events.find(f);
     if ( be != body_events.end() )
         for ( const auto& e : be->second ) {
-            if ( events.size() > 0 )
+            if ( ! events.empty() )
                 events += ", ";
-            events = events + "\"" + e + "\"";
+
+            events += "\"";
+            events += e;
+            events += "\"";
         }
 
     events = string("{") + events + "}";

src/script_opt/CPP/Exprs.cc

@@ -28,7 +28,7 @@ string CPPCompile::GenListExpr(const Expr* e, GenType gt, bool nested) {
 
         if ( nested && e_i->Tag() == EXPR_LIST )
             // These are table or set indices.
-            gen_i = string("index_val__CPP({") + gen_i + "})";
+            gen_i = util::fmt("index_val__CPP({%s})", gen_i.c_str());
 
         gen += gen_i;
 
@@ -1144,7 +1144,7 @@ string CPPCompile::GenListAssign(const ExprPtr& lhs, const ExprPtr& rhs) {
 }
 
 string CPPCompile::GenVectorOp(const Expr* e, string op, const char* vec_op) {
-    auto t = e->GetType();
+    const auto& t = e->GetType();
     auto gen_t = GenTypeName(t);
     auto gen = string("vec_op_") + vec_op + "__CPP(" + op + ", " + gen_t + ")";
 
@@ -1196,7 +1196,7 @@ string CPPCompile::GenLambdaClone(const LambdaExpr* l, bool all_deep) {
         if ( captures && ! IsNativeType(id_t) ) {
             for ( const auto& c : *captures )
                 if ( id == c.Id() && (c.IsDeepCopy() || all_deep) )
-                    arg = string("cast_intrusive<") + TypeName(id_t) + ">(" + arg + "->Clone())";
+                    arg = util::fmt("cast_intrusive<%s>(%s->Clone())", TypeName(id_t), arg.c_str());
         }
 
         cl_args += ", " + arg;

src/script_opt/CPP/Inits.cc

@@ -299,7 +299,7 @@ void CPPCompile::GenStandaloneActivation() {
             hashes += Fmt(h);
         }
 
-        hashes = "{" + hashes + "}";
+        hashes = std::string{"{"}.append(hashes).append("}");
 
         auto f = fb.first;
         const auto& fn = f->GetName();

src/script_opt/CPP/RuntimeInits.cc

@@ -190,7 +190,7 @@ void CPP_IndexedInits<T>::Generate(InitsManager* im, std::vector<AttrPtr>& ivec,
         }
 
         case AE_RECORD: {
-            auto t = im->Types(e_arg);
+            const auto& t = im->Types(e_arg);
             auto rt = cast_intrusive<RecordType>(t);
             auto empty_vals = make_intrusive<ListExpr>();
             auto construct = make_intrusive<RecordConstructorExpr>(empty_vals);
@@ -410,7 +410,7 @@ TypePtr CPP_TypeInits::BuildRecordType(InitsManager* im, ValElemVec& init_vals,
         while ( i < n ) {
             auto s = im->Strings(init_vals[i++]);
             auto id = util::copy_string(s);
-            auto type = im->Types(init_vals[i++]);
+            const auto& type = im->Types(init_vals[i++]);
             auto attrs_i = init_vals[i++];
 
             AttributesPtr attrs;
@@ -439,7 +439,7 @@ int CPP_FieldMapping::ComputeOffset(InitsManager* im) const {
         fm_offset = r->NumFields();
 
         auto id = util::copy_string(field_name.c_str(), field_name.size());
-        auto type = im->Types(field_type);
+        const auto& type = im->Types(field_type);
 
         AttributesPtr attrs;
         if ( field_attrs >= 0 )

src/script_opt/CPP/Vars.cc

@@ -158,7 +158,7 @@ string CPPCompile::CaptureName(const ID* c) const {
     // We want to strip both the module and any inlining appendage.
     auto tn = trim_name(c);
 
-    auto appendage = tn.find(".");
+    auto appendage = tn.find('.');
     if ( appendage != string::npos )
         tn.erase(tn.begin() + appendage, tn.end());
 

src/script_opt/IDOptInfo.cc

@@ -127,7 +127,7 @@ void IDOptInfo::DefinedAfter(const Stmt* s, const ExprPtr& e, const std::vector<
     // This needs to come after filling out the confluence
     // blocks, since they'll create their own (earlier) regions.
     usage_regions.emplace_back(s, true, stmt_num);
-    usage_regions.back().SetDefExpr(std::move(e));
+    usage_regions.back().SetDefExpr(e);
 
     if ( tracing )
         DumpBlocks();

src/script_opt/ProfileFunc.cc

@@ -651,7 +651,7 @@ bool ProfileFuncs::HasSideEffects(SideEffectsOp::AccessType access, const TypePt
 
 bool ProfileFuncs::GetSideEffects(SideEffectsOp::AccessType access, const Type* t, IDSet& non_local_ids,
                                   TypeSet& aggrs) const {
-    for ( auto se : side_effects_ops )
+    for ( const auto& se : side_effects_ops )
         if ( AssessSideEffects(se.get(), access, t, non_local_ids, aggrs) )
             return true;
 
@@ -1526,7 +1526,7 @@ ASTBlockAnalyzer::ASTBlockAnalyzer(std::vector<FuncInfo>& funcs) {
 
         auto func = f.Func();
         auto fn = func->GetName();
-        auto body = f.Body();
+        const auto& body = f.Body();
 
         // First get the line numbers all sorted out.
         SetBlockLineNumbers sbln;

src/script_opt/Reduce.cc

@@ -471,7 +471,7 @@ bool Reducer::ExprValid(const ID* id, const Expr* e1, const Expr* e2) const {
     std::optional<ExprSideEffects>& e1_se = e1->GetOptInfo()->SideEffects();
     if ( ! e1_se ) {
         bool has_side_effects = false;
-        auto e1_t = e1->GetType();
+        const auto& e1_t = e1->GetType();
 
         if ( e1_t->Tag() == TYPE_OPAQUE || e1_t->Tag() == TYPE_ANY )
             // These have difficult-to-analyze semantics.

src/script_opt/Stmt.cc

@@ -926,7 +926,7 @@ static bool simplify_chain(const std::vector<StmtPtr>& stmts, unsigned int start
     // At this point, chain_stmts has only the remainders that weren't removed.
     for ( auto s : stmts )
         if ( chain_stmts.count(s.get()) > 0 )
-            f_stmts.push_back(s);
+            f_stmts.push_back(std::move(s));
 
     return true;
 }
@@ -1056,6 +1056,8 @@ StmtPtr InitStmt::Duplicate() {
     // Need to duplicate the initializer list since later reductions
     // can modify it in place.
     std::vector<IDPtr> new_inits;
+    new_inits.reserve(inits.size());
+
     for ( const auto& id : inits )
         new_inits.push_back(id);
 
@@ -1102,7 +1104,7 @@ StmtPtr AssertStmt::DoReduce(Reducer* c) {
 
 bool WhenInfo::HasUnreducedIDs(Reducer* c) const {
     for ( auto& cp : *cl ) {
-        auto cid = cp.Id();
+        const auto& cid = cp.Id();
 
         if ( when_new_locals.count(cid.get()) == 0 && ! c->ID_IsReduced(cp.Id()) )
             return true;

src/script_opt/ZAM/BuiltIn.cc

@@ -357,7 +357,7 @@ bool MultiZBI::Build(ZAMCompiler* zam, const NameExpr* n, const ExprPList& args)
                 break;
 
             case 2: {
-                auto c2 = consts[1];
+                const auto& c2 = consts[1];
                 auto c2_t = c2->GetType()->Tag();
 
                 ASSERT(c2_t == TYPE_BOOL || c2_t == TYPE_INT || c2_t == TYPE_COUNT);

src/script_opt/ZAM/Expr.cc

@@ -540,7 +540,7 @@ const ZAMStmt ZAMCompiler::CompileSchedule(const NameExpr* n, const ConstExpr* c
 }
 
 const ZAMStmt ZAMCompiler::CompileEvent(EventHandler* h, const ListExpr* l) {
-    auto exprs = l->Exprs();
+    const auto& exprs = l->Exprs();
     unsigned int n = exprs.length();
 
     bool all_vars = true;
@@ -895,7 +895,7 @@ const ZAMStmt ZAMCompiler::CompileIndex(const NameExpr* n1, int n2_slot, const T
         }
     }
 
-    auto indexes = l->Exprs();
+    const auto& indexes = l->Exprs();
 
     ZOp op;
 
@@ -1515,7 +1515,7 @@ const ZAMStmt ZAMCompiler::ConstructVector(const NameExpr* n, const Expr* e) {
 }
 
 const ZAMStmt ZAMCompiler::ArithCoerce(const NameExpr* n, const Expr* e) {
-    auto nt = n->GetType();
+    const auto& nt = n->GetType();
     auto nt_is_vec = nt->Tag() == TYPE_VECTOR;
 
     auto op = e->GetOp1();

src/script_opt/ZAM/Low-Level.cc

@@ -44,7 +44,7 @@ std::unique_ptr<OpaqueVals> ZAMCompiler::BuildVals(const ListExprPtr& l) {
 }
 
 ZInstAux* ZAMCompiler::InternalBuildVals(const ListExpr* l, int stride) {
-    auto exprs = l->Exprs();
+    const auto& exprs = l->Exprs();
     int n = exprs.length();
 
     auto aux = new ZInstAux(n * stride);

src/script_opt/ZAM/Stmt.cc

@@ -616,7 +616,7 @@ const ZAMStmt ZAMCompiler::TypeSwitch(const SwitchStmt* sw, const NameExpr* v, c
 }
 
 const ZAMStmt ZAMCompiler::CompileWhile(const WhileStmt* ws) {
-    auto loop_condition = ws->Condition();
+    const auto& loop_condition = ws->Condition();
 
     if ( loop_condition->Tag() == EXPR_CONST ) {
         if ( loop_condition->IsZero() )
@@ -1019,7 +1019,7 @@ const ZAMStmt ZAMCompiler::CompileWhen(const WhenStmt* ws) {
     aux->wi = wi;
 
     for ( auto i = 0; i < n; ++i ) {
-        auto la = local_aggr_slots[i];
+        const auto& la = local_aggr_slots[i];
         aux->Add(i, FrameSlot(la), la->GetType());
     }
 
@@ -1072,7 +1072,7 @@ const ZAMStmt ZAMCompiler::CompileAssert(const AssertStmt* as) {
     auto cond_desc = make_intrusive<StringVal>(new String(as->CondDesc()));
     auto cond_desc_e = make_intrusive<ConstExpr>(cond_desc);
 
-    if ( auto msg = as->Msg() ) {
+    if ( const auto& msg = as->Msg() ) {
         auto& msg_setup_stmt = as->MsgSetupStmt();
         if ( msg_setup_stmt )
             (void)CompileStmt(msg_setup_stmt);

src/session/Key.cc

@@ -15,21 +15,23 @@ Key::Key(const void* session, size_t size, size_t type, bool copy) : size(size),
     copied = copy;
 }
 
-Key::Key(Key&& rhs) {
+Key::Key(Key&& rhs) noexcept {
     data = rhs.data;
     size = rhs.size;
     copied = rhs.copied;
+    type = rhs.type;
 
     rhs.data = nullptr;
     rhs.size = 0;
     rhs.copied = false;
 }
 
-Key& Key::operator=(Key&& rhs) {
+Key& Key::operator=(Key&& rhs) noexcept {
     if ( this != &rhs ) {
         data = rhs.data;
         size = rhs.size;
         copied = rhs.copied;
+        type = rhs.type;
 
         rhs.data = nullptr;
         rhs.size = 0;

src/session/Key.h

@@ -44,8 +44,8 @@ public:
 
     // Implement move semantics for Key, since they're used as keys
     // in a map.
-    Key(Key&& rhs);
+    Key(Key&& rhs) noexcept;
-    Key& operator=(Key&& rhs);
+    Key& operator=(Key&& rhs) noexcept;
 
     // Explicitly delete the copy constructor and operator since copying
     // may cause issues with double-freeing pointers.

src/spicy/manager.cc

@@ -636,20 +636,18 @@ void Manager::InitPostScript() {
     auto spicy_config = ::spicy::rt::configuration::get();
     spicy_config.hook_accept_input = hook_accept_input;
     spicy_config.hook_decline_input = hook_decline_input;
-    ::spicy::rt::configuration::set(std::move(spicy_config));
+    ::spicy::rt::configuration::set(spicy_config);
 
     try {
         ::hilti::rt::init();
         ::spicy::rt::init();
     } catch ( const hilti::rt::Exception& e ) {
-        std::cerr << hilti::rt::fmt("uncaught runtime exception %s during initialization: %s",
+        std::cerr << hilti::rt::fmt("uncaught runtime exception %s during initialization: %s\n",
-                                    hilti::rt::demangle(typeid(e).name()), e.what())
+                                    hilti::rt::demangle(typeid(e).name()), e.what());
-                  << std::endl;
         exit(1);
     } catch ( const std::runtime_error& e ) {
-        std::cerr << hilti::rt::fmt("uncaught C++ exception %s during initialization: %s",
+        std::cerr << hilti::rt::fmt("uncaught C++ exception %s during initialization: %s\n",
-                                    hilti::rt::demangle(typeid(e).name()), e.what())
+                                    hilti::rt::demangle(typeid(e).name()), e.what());
-                  << std::endl;
         exit(1);
     }
 

src/threading/MsgThread.cc

@@ -69,7 +69,7 @@ private:
 // A message from the child to be passed on to the Reporter.
 class ReporterMessage final : public OutputMessage<MsgThread> {
 public:
-    enum Type { INFO, WARNING, ERROR, FATAL_ERROR, FATAL_ERROR_WITH_CORE, INTERNAL_WARNING, INTERNAL_ERROR };
+    enum Type : uint8_t { INFO, WARNING, ERROR, FATAL_ERROR, FATAL_ERROR_WITH_CORE, INTERNAL_WARNING, INTERNAL_ERROR };
 
     ReporterMessage(Type arg_type, MsgThread* thread, std::string_view arg_msg)
         : OutputMessage<MsgThread>("ReporterMessage", thread) {

src/zeek-setup.cc

@@ -711,7 +711,7 @@ SetupResult setup(int argc, char** argv, Options* zopts) {
     plugin_mgr->ExtendZeekPathForPlugins();
 
     for ( const auto& x : requested_plugins )
-        plugin_mgr->ActivateDynamicPlugin(std::move(x));
+        plugin_mgr->ActivateDynamicPlugin(x);
 
     plugin_mgr->ActivateDynamicPlugins(! options.bare_mode);
 
@@ -942,6 +942,7 @@ SetupResult setup(int argc, char** argv, Options* zopts) {
     }
 
     std::vector<SignatureFile> all_signature_files;
+    all_signature_files.reserve(options.signature_files.size() + zeek::detail::sig_files.size());
 
     // Append signature files given on the command line
     for ( const auto& sf : options.signature_files )

src/zeekygen/Target.cc

@@ -491,9 +491,7 @@ void ScriptTarget::DoGenerate() const {
             pkg_deps[i]->Generate();
         }
 
-        for ( size_t i = 0; i < dir_contents.size(); ++i ) {
+        for ( const auto& f : dir_contents ) {
-            string f = dir_contents[i];
-
             if ( targets.find(f) != targets.end() )
                 continue;