Suppress BinSkim BA2008 warning for llvm-mca.exe and FileCheck.exe (#119376)

JulieLeeMSFT · web-flow · commit 367865bf4540 · 2025-09-05T19:38:44.000-07:00
* Suppress BinSkim BA2008 warning for llvm-mca.exe and FileCheck.exe.

* Add a comment on why external libraries are excluded from binskim scanning.
diff --git a/eng/common/sdl/configure-sdl-tool.ps1 b/eng/common/sdl/configure-sdl-tool.ps1
@@ -95,7 +95,8 @@ try {
         if ($targetDirectory) {
           # Binskim crashes due to specific PDBs. GitHub issue: https://github.com/microsoft/binskim/issues/924.
           # We are excluding all `_.pdb` files from the scan.
-          $tool.Args += "`"Target < $TargetDirectory\**;-:file|$TargetDirectory\**\_.pdb`""
+		  # SuperfileCheck uses two external LLVM libraries (llvm-mca.exe and FileCheck.exe) that we don't build. Excluding them to supporess BA2008. 
+          $tool.Args += "`"Target < $TargetDirectory\**;-:file|$TargetDirectory\**\_.pdb;-:file|$TargetDirectory\**\llvm-mca.exe;-:file|$TargetDirectory\**\FileCheck.exe`""
         }
         $tool.Args += $BinskimAdditionalRunConfigParams
       }

Original file line number	Diff line number	Diff line change
`@@ -95,7 +95,8 @@ try {`
`95`	`95`	`if ($targetDirectory) {`
`96`	`96`	`# Binskim crashes due to specific PDBs. GitHub issue: https://github.com/microsoft/binskim/issues/924.`
`97`	`97`	# We are excluding all `_.pdb` files from the scan.
`98`		- $tool.Args += "`"Target < $TargetDirectory\;-:file\|$TargetDirectory\\_.pdb`""
	`98`	`+ # SuperfileCheck uses two external LLVM libraries (llvm-mca.exe and FileCheck.exe) that we don't build. Excluding them to supporess BA2008.`
	`99`	+ $tool.Args += "`"Target < $TargetDirectory\;-:file\|$TargetDirectory\\_.pdb;-:file\|$TargetDirectory\\llvm-mca.exe;-:file\|$TargetDirectory\\FileCheck.exe`""
`99`	`100`	`}`
`100`	`101`	`$tool.Args += $BinskimAdditionalRunConfigParams`
`101`	`102`	`}`