From 80a3f880a5be0f01b59a9865c9e681aa328887d5 Mon Sep 17 00:00:00 2001
From: Brett Nicholas <7547222+bigbrett@users.noreply.github.com>
Date: Wed, 29 Oct 2025 13:26:12 -0600
Subject: [PATCH 1/2] limit default scan-build target to only testsuite

---
 Makefile | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/Makefile b/Makefile
index 19ddd4708..044d3b889 100644
--- a/Makefile
+++ b/Makefile
@@ -44,10 +44,7 @@ scan:
 	@rm -rf $(SCAN_DIR)
 	@mkdir -p $(SCAN_DIR)
 	@make clean
-	-@make SCAN=1 -C test scan
-	-@make SCAN=1 -C benchmark scan
-	-@make NOCRYPTO=1 SCAN=1 -C tools/whnvmtool scan
-	-@make NOCRYPTO=1 SCAN=1 -C examples
+	-@make -j SCAN=1 -C test scan
 	@$(MAKE) scan_result_check
 
 clean:

From 88197d28d505cb2f9d3873b1f1e371624037a6e6 Mon Sep 17 00:00:00 2001
From: Brett Nicholas <7547222+bigbrett@users.noreply.github.com>
Date: Wed, 29 Oct 2025 13:49:07 -0600
Subject: [PATCH 2/2] omit wolfCrypt and wolfSSL from scan-build analysis

---
 benchmark/Makefile                      | 4 +++-
 examples/posix/wh_posix_client/Makefile | 4 +++-
 examples/posix/wh_posix_server/Makefile | 4 +++-
 test/Makefile                           | 4 +++-
 tools/whnvmtool/Makefile                | 4 +++-
 5 files changed, 15 insertions(+), 5 deletions(-)

diff --git a/benchmark/Makefile b/benchmark/Makefile
index 45273ed9b..c54e1fa17 100644
--- a/benchmark/Makefile
+++ b/benchmark/Makefile
@@ -172,7 +172,9 @@ analyze: $(OBJS_ASM) $(OBJS_C)
 scan:$(BUILD_DIR)
 	@echo "Running scan-build static analysis"
 	@mkdir -p $(WOLFHSM_DIR)/scan_out/
-	@scan-build --status-bugs $(MAKE) analyze 2> $(WOLFHSM_DIR)/scan_out/$(SCAN_LOG)
+	@scan-build --exclude $(WOLFSSL_DIR)/wolfcrypt \
+	            --exclude $(WOLFSSL_DIR)/src \
+	            --status-bugs $(MAKE) analyze 2> $(WOLFHSM_DIR)/scan_out/$(SCAN_LOG)
 
 $(BUILD_DIR):
 	$(CMD_ECHO) mkdir -p $(BUILD_DIR)
diff --git a/examples/posix/wh_posix_client/Makefile b/examples/posix/wh_posix_client/Makefile
index d053deb6e..904a26989 100644
--- a/examples/posix/wh_posix_client/Makefile
+++ b/examples/posix/wh_posix_client/Makefile
@@ -186,7 +186,9 @@ analyze: $(OBJS_ASM) $(OBJS_C)
 scan:$(BUILD_DIR)
 	@echo "Running scan-build static analysis"
 	@mkdir -p $(WOLFHSM_DIR)/scan_out/
-	@scan-build --status-bugs $(MAKE) analyze 2> $(WOLFHSM_DIR)/scan_out/$(SCAN_LOG)
+	@scan-build --exclude $(WOLFSSL_DIR)/wolfcrypt \
+	            --exclude $(WOLFSSL_DIR)/src \
+	            --status-bugs $(MAKE) analyze 2> $(WOLFHSM_DIR)/scan_out/$(SCAN_LOG)
 
 clean:
 	@echo "Cleaning build files"
diff --git a/examples/posix/wh_posix_server/Makefile b/examples/posix/wh_posix_server/Makefile
index 677edcb6d..b9f7ad1d3 100644
--- a/examples/posix/wh_posix_server/Makefile
+++ b/examples/posix/wh_posix_server/Makefile
@@ -139,7 +139,9 @@ analyze: $(OBJS_ASM) $(OBJS_C)
 scan:$(BUILD_DIR)
 	@echo "Running scan-build static analysis"
 	@mkdir -p $(WOLFHSM_DIR)/scan_out/
-	@scan-build --status-bugs $(MAKE) analyze 2> $(WOLFHSM_DIR)/scan_out/$(SCAN_LOG)
+	@scan-build --exclude $(WOLFSSL_DIR)/wolfcrypt \
+	            --exclude $(WOLFSSL_DIR)/src \
+	            --status-bugs $(MAKE) analyze 2> $(WOLFHSM_DIR)/scan_out/$(SCAN_LOG)
 
 $(BUILD_DIR):
 	$(CMD_ECHO) mkdir -p $(BUILD_DIR)
diff --git a/test/Makefile b/test/Makefile
index 987564c28..540a0410d 100644
--- a/test/Makefile
+++ b/test/Makefile
@@ -221,7 +221,9 @@ analyze:$(OBJS_ASM) $(OBJS_C)
 scan:$(BUILD_DIR)
 	@echo "Running scan-build static analysis"
 	@mkdir -p $(WOLFHSM_DIR)/scan_out/
-	@scan-build --status-bugs $(MAKE) analyze 2> $(WOLFHSM_DIR)/scan_out/$(SCAN_LOG)
+	@scan-build --exclude $(WOLFSSL_DIR)/wolfcrypt \
+	            --exclude $(WOLFSSL_DIR)/src \
+	            --status-bugs $(MAKE) analyze 2> $(WOLFHSM_DIR)/scan_out/$(SCAN_LOG)
 
 $(BUILD_DIR):
 	$(CMD_ECHO) mkdir -p $(BUILD_DIR)
diff --git a/tools/whnvmtool/Makefile b/tools/whnvmtool/Makefile
index 37c7f6f2d..d83010cd3 100644
--- a/tools/whnvmtool/Makefile
+++ b/tools/whnvmtool/Makefile
@@ -104,7 +104,9 @@ analyze: $(SRC)
 scan:
 	@echo "Running scan-build static analysis"
 	@mkdir -p $(WOLFHSM_DIR)/scan_out/
-	@scan-build --status-bugs $(MAKE) analyze 2> $(WOLFHSM_DIR)/scan_out/$(SCAN_LOG)
+	@scan-build --exclude $(WOLFSSL_DIR)/wolfcrypt \
+	            --exclude $(WOLFSSL_DIR)/src \
+	            --status-bugs $(MAKE) analyze 2> $(WOLFHSM_DIR)/scan_out/$(SCAN_LOG)
 
 clean: clean-test
 	rm -f whNvmImage.bin whNvmImage.hex