dittolive-ditto-sys 5.1.0-experimental-innovapptive-memory.2

Done dynamic on Linux job 101488 crates.io SBOM Findings (VEX)

The build looked up software.ditto.live.

medium

False positive. A person reviewed this verdict and found the crate benign. The evidence below is what the analysis saw.

Evidence

Points	Signal	Where	What
10	network_lookup network · dittolive-ditto-sys	software.ditto.live	The build looked up software.ditto.live.
10	new_high_finding diff · dittolive-ditto-sys	build/main.rs:420	New since 4.14.7: downloader_pattern
10	static:downloader_pattern static · dittolive-ditto-sys	build/main.rs:420	high severity downloader_pattern in build_script code: https://software.ditto.live/rust/Ditto/{version}/{target}/release/{libname} at build/main.rs:420 with std::process::Command::new at build/main.rs:448
10	static:process_spawn static · dittolive-ditto-sys	build/main.rs:448	medium severity process_spawn in build_script code (3 places): std::process::Command::new
5	exec_downloader trace · dittolive-ditto-sys	/usr/bin/curl	The build ran /usr/bin/curl.
1	static:build_script static · dittolive-ditto-sys	build/main.rs	low severity build_script in build_script code: build/main.rs
1	static:url_literal static · dittolive-ditto-sys	build/main.rs:420	low severity url_literal in build_script code: https://software.ditto.live/rust/Ditto/{version}/{target}/release/{libname}

Behavior

Profile

exec:downloader net:software.ditto.live static:downloader_pattern static:process_spawn

Static findings

high downloader_pattern build_script 1

https://software.ditto.live/rust/Ditto/{version}/{target}/release/{libname} at build/main.rs:420 with std::process::Command::new at build/main.rs:448 build/main.rs:420

medium process_spawn build_script 3

std::process::Command::new build/main.rs:448 build/main.rs:569 build/utils/mod.rs:58

low foreign_functions library 7

extern block dittoffi.rs:9 dittoffi.rs:38 dittoffi.rs:406 dittoffi.rs:442 dittoffi.rs:465 dittoffi.rs:492 dittoffi.rs:945

low build_script build_script 1

build/main.rs build/main.rs

low url_literal build_script 1

https://software.ditto.live/rust/Ditto/{version}/{target}/release/{libname} build/main.rs:420

info unsafe_code library 2

2 unsafe blocks, functions or impls dittoffi.rs:576
13 unsafe blocks, functions or impls ffi_utils.rs:77

info native_link build_script 1

links = "dittoffi" Cargo.toml

Run: full

failed

The full build covers everything the earlier cargo check run did, so only the full run is shown.

Ended: agent reported the end
Guest: exit code 101
Run time: 45.4 s
VM restore: 78 ms
Payload: 4367 files, 58.8 MiB
Files opened: 10636

Processes 178

Siblings that ran the same program with the same result and the same processes below are folded into one row, with their number. Hide the 164 compiler processes (rustc, C toolchain)

Process	Arguments	Start	Took	Exit
cargo /usr/local/bin/cargo	build --locked --offline	5 ms	45.1 s	25856
└rustc /usr/local/bin/rustc ×22	--crate-name build_script_build --edition=2021 /cw/vendor/proc-macro2-1.0.107/build.rs --error-format=json --json=diagnostic-rendered-ansi,artifacts,future-incompat --crate-type bin --emit=dep-info,link -C embed-bitcode=no --cfg feature="default" --cfg feature="proc-macro" --check-cfg cfg(docsrs,test) --check-cfg cfg(feature, values("default", "nightly", "proc-macro", "span-locations")) -C metadata=a3dc8fb24392fcd4 -C extra-filename=-a411f7480bd0f42c --out-dir /work/target/debug/build/proc-macro2-a411f7480bd0f42c -L dependency=/work/target/debug/deps --cap-lints allow	225 ms	737 ms	0
└toolchain /usr/bin/cc	-m64 /work/target/debug/build/proc-macro2-a411f7480bd0f42c/rustcgmepSI/symbols.o /work/target/debug/build/proc-macro2-a411f7480bd0f42c/build_script_build-a411f7480bd0f42c.build_script_build.dd8d7f624ad1d48e-cgu.0.rcgu.o /work/target/debug/build/proc-macro2-a411f7480bd0f42c/build_script_build-a411f7480bd0f42c.cnca5igddme2fkrf01fktrtaw.rcgu.o -Wl,--as-needed -Wl,-Bstatic /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libstd-64f5f36fb0927694.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libpanic_unwind-549498e8b2e4d924.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libobject-7ff85ea729a864ff.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libmemchr-0e3477fb2664a277.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libaddr2line-09755979c57b7e64.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libgimli-9a1fede77fbbf2f0.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libcfg_if-360da4ba13154744.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/lib	816 ms	143 ms	0
└toolchain /usr/libexec/gcc/x86_64-linux-gnu/14/collect2	-plugin /usr/libexec/gcc/x86_64-linux-gnu/14/liblto_plugin.so -plugin-opt=/usr/libexec/gcc/x86_64-linux-gnu/14/lto-wrapper -plugin-opt=-fresolution=/tmp/ccCyQ1vj.res --build-id --eh-frame-hdr -m elf_x86_64 --hash-style=gnu --as-needed -dynamic-linker /lib64/ld-linux-x86-64.so.2 -pie -fuse-ld=lld -o /work/target/debug/build/proc-macro2-a411f7480bd0f42c/build_script_build-a411f7480bd0f42c /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/Scrt1.o /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/crti.o /usr/lib/gcc/x86_64-linux-gnu/14/crtbeginS.o -L/work/target/debug/build/proc-macro2-a411f7480bd0f42c/rustcgmepSI/raw-dylibs -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/bin/gcc-ld -L/usr/lib/gcc/x86_64-linux-gnu/14 -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../../lib -L/lib/x86_64-linux-gnu -L/lib/../lib -L/usr/lib/x86_64-linux-gnu -L	823 ms	136 ms	0
└toolchain /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/bin/rust-lld	-flavor gnu -plugin /usr/libexec/gcc/x86_64-linux-gnu/14/liblto_plugin.so -plugin-opt=/usr/libexec/gcc/x86_64-linux-gnu/14/lto-wrapper -plugin-opt=-fresolution=/tmp/ccCyQ1vj.res --build-id --eh-frame-hdr -m elf_x86_64 --hash-style=gnu --as-needed -dynamic-linker /lib64/ld-linux-x86-64.so.2 -pie -o /work/target/debug/build/proc-macro2-a411f7480bd0f42c/build_script_build-a411f7480bd0f42c /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/Scrt1.o /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/crti.o /usr/lib/gcc/x86_64-linux-gnu/14/crtbeginS.o -L/work/target/debug/build/proc-macro2-a411f7480bd0f42c/rustcgmepSI/raw-dylibs -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/bin/gcc-ld -L/usr/lib/gcc/x86_64-linux-gnu/14 -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../../lib -L/lib/x86_64-linux-gnu -L/lib/../lib -L/usr/lib/x86_6	826 ms	132 ms	0
└build_script proc-macro2		967 ms	82 ms	0
└rustc /usr/local/bin/rustc ×3	--version	968 ms	7 ms	0
└rustc /usr/local/bin/rustc	--cfg=procmacro2_build_probe --edition=2021 --crate-name=proc_macro2 --crate-type=lib --cap-lints=allow --emit=dep-info,metadata --out-dir /work/target/debug/build/proc-macro2-4f3f927bd5485a92/out/probe src/probe/proc_macro_span.rs --target x86_64-unknown-linux-gnu	976 ms	33 ms	256
└rustc /usr/local/bin/rustc ×63	--crate-name unicode_ident --edition=2021 /cw/vendor/unicode-ident-1.0.26/src/lib.rs --error-format=json --json=diagnostic-rendered-ansi,artifacts,future-incompat --crate-type lib --emit=dep-info,metadata,link -C embed-bitcode=no --check-cfg cfg(docsrs,test) --check-cfg cfg(feature, values()) -C metadata=f65c548d1bdebf35 -C extra-filename=-76fddff3086055f2 --out-dir /work/target/debug/deps -L dependency=/work/target/debug/deps --cap-lints allow	1.0 s	50 ms	0
└build_script quote		1.2 s	9 ms	0
└rustc /usr/local/bin/rustc	--version	1.2 s	8 ms	0
└build_script libc		5.2 s	9 ms	0
└rustc /usr/local/bin/rustc	--version	5.2 s	7 ms	0
└build_script syn		6.1 s	9 ms	0
└rustc /usr/local/bin/rustc	--version	6.1 s	7 ms	0
└build_script serde_core		12.1 s	10 ms	0
└rustc /usr/local/bin/rustc	--version	12.1 s	8 ms	0
└build_script parking_lot_core		12.4 s	1 ms	0
└build_script crc32fast		12.4 s	10 ms	0
└rustc /usr/local/bin/rustc	--version	12.4 s	8 ms	0
└build_script paste		15.7 s	10 ms	0
└rustc /usr/local/bin/rustc	--version	15.7 s	7 ms	0
└build_script object		20.4 s	9 ms	0
└rustc /usr/local/bin/rustc	--version	20.4 s	8 ms	0
└build_script prettyplease		21.4 s	1 ms	0
└build_script thiserror		21.9 s	30 ms	0
└rustc /usr/local/bin/rustc	--edition=2018 --crate-name=thiserror --crate-type=lib --cap-lints=allow --emit=dep-info,metadata --out-dir /work/target/debug/build/thiserror-3612222dcefb6f57/out/probe build/probe.rs --target x86_64-unknown-linux-gnu	21.9 s	19 ms	256
└rustc /usr/local/bin/rustc	--version	21.9 s	7 ms	0
└build_script dittolive-ditto-sys		45.1 s	61 ms	25856
└other /usr/bin/curl	-o /work/target/debug/build/dittolive-ditto-sys-cc55c3fc8fd277d3/out/libdittoffi.a --create-dirs --location --compressed --max-time 1024 -f https://software.ditto.live/rust/Ditto/5.1.0-experimental-innovapptive-memory.2/x86_64-unknown-linux-gnu/release/libdittoffi.a	45.1 s	59 ms	5632

Network 2

The VM has no internet. Every name it looks up resolves to 10.0.2.1, the fake internet, which accepts every connection and records what was sent. Below, it is shown by its port alone, such as :443. The name the build wanted is in the lookups, the HTTP host and the TLS SNI.

Looked up software.ditto.live

Destination	Protocol	What was sent	Bytes
:443	tls	SNI software.ditto.live, inside TLS: GET /rust/Ditto/5.1.0-experimental-innovapptive-memory.2/x86_64-unknown-linux-gnu/release/libdittoffi.a, host software.ditto.live, agent curl/8.14.1	1.5 KiB

Sockets in the trace 3

When	Program	How	Address	Type
45.1 s	/usr/bin/curl	connect	unix:/var/run/nscd/socket	stream
45.1 s	/usr/bin/curl	connect	:53	datagram
45.1 s	/usr/bin/curl	connect	:443	stream

Files 0

Secrets opened

None.

Written outside the build directories

None.

Scratch disk 0

Files: 665
Directories: 151
Size: 365.7 MiB
Compiled units: 136
Scan: stopped at a limit

Nothing outside the build areas.

Output

Standard error

   Compiling proc-macro2 v1.0.107
   Compiling unicode-ident v1.0.26
   Compiling quote v1.0.47
   Compiling syn v3.0.6
   Compiling libc v0.2.190
   Compiling cfg-if v1.0.5
   Compiling syn v1.0.109
   Compiling syn v2.0.119
   Compiling serde_core v1.0.229
   Compiling futures-core v0.3.34
   Compiling pin-project-lite v0.2.17
   Compiling crc32fast v1.5.2
   Compiling parking_lot_core v0.9.12
   Compiling adler2 v2.0.1
   Compiling paste v1.0.15
   Compiling smallvec v1.16.2
   Compiling scopeguard v1.2.0
   Compiling futures-sink v0.3.34
   Compiling futures-io v0.3.34
   Compiling simd-adler32 v0.3.10
   Compiling miniz_oxide v0.9.1
   Compiling futures-channel v0.3.34
   Compiling lock_api v0.4.14
   Compiling ext-trait-proc_macros v1.0.1
   Compiling errno v0.3.14
   Compiling futures-macro v0.3.34
   Compiling thiserror v2.0.21
   Compiling memchr v2.8.3
   Compiling winnow v1.0.4
   Compiling prettyplease v0.2.37
   Compiling twox-hash v2.1.5
   Compiling object v0.37.3
   Compiling futures-task v0.3.34
   Compiling slab v0.4.12
   Compiling futures-util v0.3.34
   Compiling ruzstd v0.8.3
   Compiling toml_parser v1.1.4+spec-1.1.0
   Compiling signal-hook-registry v1.4.8
   Compiling ext-trait v1.0.1
   Compiling flate2 v1.1.10
   Compiling parking_lot v0.12.5
   Compiling toml_datetime v0.7.5+spec-1.1.0
   Compiling serde_spanned v1.1.2
   Compiling ext-trait-proc_macros v2.0.3
   Compiling socket2 v0.6.5
   Compiling mio v1.2.4
   Compiling thiserror-impl v2.0.21
   Compiling tokio-macros v2.7.2
   Compiling toml_writer v1.1.3+spec-1.1.0
   Compiling macro_rules_attribute-proc_macro v0.1.3
   Compiling bytes v1.12.1
   Compiling winnow v0.7.15
   Compiling toml v0.9.12+spec-1.1.0
   Compiling tokio v1.53.2
   Compiling macro_rules_attribute v0.1.3
   Compiling ext-trait v2.0.3
   Compiling extension-traits v1.0.1
   Compiling futures-executor v0.3.34
   Compiling with_builtin_macros-proc_macros v0.0.3
   Compiling seal-the-deal-proc_macros v0.1.2
   Compiling once_cell v1.21.4
   Compiling async-compat v0.2.6
   Compiling seal-the-deal v0.1.2
   Compiling with_builtin_macros v0.0.3
   Compiling futures v0.3.34
   Compiling safer_ffi-proc_macros v0.2.0-rc1
   Compiling uninit v0.5.1
   Compiling extension-traits v2.0.3
   Compiling dittolive-ditto-sys v5.1.0-experimental-innovapptive-memory.2
   Compiling extern-c v0.1.0
   Compiling never-say-never v6.6.666
   Compiling unwind_safe v0.1.0
   Compiling safer-ffi v0.2.0-rc1
warning: dittolive-ditto-sys@5.1.0-experimental-innovapptive-memory.2: [dittolive-ditto-sys] `libdittoffi.a` not found (build with `-vv` to debug the locations searched)
warning: dittolive-ditto-sys@5.1.0-experimental-innovapptive-memory.2: [dittolive-ditto-sys] Attempting to download https://software.ditto.live/rust/Ditto/5.1.0-experimental-innovapptive-memory.2/x86_64-unknown-linux-gnu/release/libdittoffi.a
warning: dittolive-ditto-sys@5.1.0-experimental-innovapptive-memory.2: [dittolive-ditto-sys] Failed to download Ditto SDK binary component from https://software.ditto.live/rust/Ditto/5.1.0-experimental-innovapptive-memory.2/x86_64-unknown-linux-gnu/release/libdittoffi.a
error: failed to run custom build command for `dittolive-ditto-sys v5.1.0-experimental-innovapptive-memory.2`

Caused by:
  process didn't exit successfully: `/work/target/debug/build/dittolive-ditto-sys-2ac2c77ec149f1f3/build-script-main` (exit status: 101)
  --- stdout
  cargo:rerun-if-env-changed=DITTOFFI_SEARCH_PATH
  cargo:rerun-if-env-changed=LIBDITTO_STATIC
  cargo:rerun-if-env-changed=CARGO_FEATURE_DOWNLOAD
  cargo:rerun-if-env-changed=DITTO_LOCAL_BUILD
  cargo:rerun-if-env-changed=LIBDITTO_STATIC_AMEND_WITH
  cargo:rerun-if-env-changed=CARGO_TARGET_DIR
  cargo:rerun-if-env-changed=X86_64_UNKNOWN_LINUX_GNU_OUT_DIR
  cargo:rerun-if-env-changed=OUT_DIR
  cargo:warning=[dittolive-ditto-sys] `libdittoffi.a` not found (build with `-vv` to debug the locations searched)
  cargo:warning=[dittolive-ditto-sys] Attempting to download https://software.ditto.live/rust/Ditto/5.1.0-experimental-innovapptive-memory.2/x86_64-unknown-linux-gnu/release/libdittoffi.a
  cargo:warning=[dittolive-ditto-sys] Failed to download Ditto SDK binary component from https://software.ditto.live/rust/Ditto/5.1.0-experimental-innovapptive-memory.2/x86_64-unknown-linux-gnu/release/libdittoffi.a

  --- stderr
  `LIBDITTO_STATIC` not set, defaulting to `static`
  TARGET_DIR may be /work/target/debug
  X86_64_UNKNOWN_LINUX_GNU_OUT_DIR unset
  OUT_DIR = /work/target/debug/build/dittolive-ditto-sys-cc55c3fc8fd277d3/out
  Checking for /work/target/debug/libdittoffi.a
  Checking for /work/target/debug/deps/libdittoffi.a
  Checking for /work/target/debug/build/dittolive-ditto-sys-cc55c3fc8fd277d3/out/libdittoffi.a
    % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                   Dload  Upload   Total   Spent    Left  Speed
  
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
  curl: (22) The requested URL returned error: 404

  thread 'main' (1564) panicked at /cw/vendor/dittolive-ditto-sys-5.1.0-experimental-innovapptive-memory.2/build/main.rs:464:17:
  Failed to download Ditto SDK binary component
  note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace

Timeline

When	From	To	Event	Worker
2026-10-08 11:04 UTC	Discovered	Fetched	fetched	fetcher-799714
2026-10-08 11:04 UTC	Fetched	ReadyForSandbox	static_analysis_completed	static-799757
2026-10-08 11:09 UTC	ReadyForSandbox	Running	sandbox_started	orchestrator-800051-slot1
2026-10-08 11:09 UTC	Running	DynamicallyAnalyzed	sandbox_completed	orchestrator-800051-slot1
2026-10-08 11:09 UTC	DynamicallyAnalyzed	ReadyForSandbox	scored	analyzer-800083
2026-10-08 11:10 UTC	ReadyForSandbox	Running	sandbox_started	orchestrator-800051-slot0
2026-10-08 11:11 UTC	Running	DynamicallyAnalyzed	sandbox_completed	orchestrator-800051-slot0
2026-10-08 11:11 UTC	DynamicallyAnalyzed	Scored	scored	analyzer-800083
2026-10-08 11:11 UTC	Scored	Done	finalized	analyzer-800083