On 02/10/2017 01:55 PM, Michael Stahl wrote: > i wonder why they even show up, i thought workdir/UnpackedTarball was > excluded from the scan? Probably more like Coverity not looking into external/*/ExternalProject_*.mk builds. Note that pdfium is always built with gbuild, via external/pdfium/Library_pdfium.mk.