Add a comment on why external libraries are excluded from binskim scanning.

JulieLeeMSFT · JulieLeeMSFT · commit 5280e741c6a8 · 2025-09-05T13:44:39.000-07:00
diff --git a/eng/common/sdl/configure-sdl-tool.ps1 b/eng/common/sdl/configure-sdl-tool.ps1
@@ -95,6 +95,7 @@ try {
         if ($targetDirectory) {
           # Binskim crashes due to specific PDBs. GitHub issue: https://github.com/microsoft/binskim/issues/924.
           # We are excluding all `_.pdb` files from the scan.
+		  # SuperfileCheck uses two external LLVM libraries (llvm-mca.exe and FileCheck.exe) that we don't build. Excluding them to supporess BA2008. 
           $tool.Args += "`"Target < $TargetDirectory\**;-:file|$TargetDirectory\**\_.pdb;-:file|$TargetDirectory\**\llvm-mca.exe;-:file|$TargetDirectory\**\FileCheck.exe`""
         }
         $tool.Args += $BinskimAdditionalRunConfigParams

Original file line number	Diff line number	Diff line change
`@@ -95,6 +95,7 @@ try {`
`95`	`95`	`if ($targetDirectory) {`
`96`	`96`	`# Binskim crashes due to specific PDBs. GitHub issue: https://github.com/microsoft/binskim/issues/924.`
`97`	`97`	# We are excluding all `_.pdb` files from the scan.
	`98`	`+ # SuperfileCheck uses two external LLVM libraries (llvm-mca.exe and FileCheck.exe) that we don't build. Excluding them to supporess BA2008.`
`98`	`99`	$tool.Args += "`"Target < $TargetDirectory\;-:file\|$TargetDirectory\\_.pdb;-:file\|$TargetDirectory\\llvm-mca.exe;-:file\|$TargetDirectory\\FileCheck.exe`""
`99`	`100`	`}`
`100`	`101`	`$tool.Args += $BinskimAdditionalRunConfigParams`