jetstreamer-utils 0.8.0
high severity shell_command in build_script code: curl https://clickhouse.com/ | sh
48
medium
Automated verdict. Nobody reviewed it. A score is a reason to look closer, not a finding.
Evidence
| Points | Signal | Where | What |
|---|---|---|---|
| 30 | static:shell_command static · jetstreamer-utils | build.rs:30 | high severity shell_command in build_script code: curl https://clickhouse.com/ | sh |
| 10 | network_lookup network · jetstreamer-utils | clickhouse.com | The build looked up clickhouse.com. |
| 5 | exec_downloader trace · jetstreamer-utils | /usr/bin/curl | The build ran /usr/bin/curl. |
| 3 | exec_shell trace · jetstreamer-utils | /usr/bin/sh | The build ran /usr/bin/sh. |
3 without points
| Signal | Where | What |
|---|---|---|
| static:build_script static · jetstreamer-utils | build.rs | low severity build_script in build_script code: build.rs |
| static:process_spawn static · jetstreamer-utils | build.rs:28 | medium severity process_spawn in build_script code (5 places): std::process::Command::new |
| static:url_literal static · jetstreamer-utils | build.rs:30 | low severity url_literal in build_script code: curl https://clickhouse.com/ | sh |
Behavior
Profile
exec:downloader exec:shell net:clickhouse.com static:process_spawn static:shell_command
Static findings
6 groups
high shell_command build_script 1
curl https://clickhouse.com/ | shbuild.rs:30
medium process_spawn build_script 1
std::process::Command::newbuild.rs:28
low process_spawn library 4
tokio::process::Command::newsrc/clickhouse.rs:50 src/clickhouse.rs:115 src/clickhouse.rs:158 src/clickhouse.rs:305
low build_script build_script 1
build.rsbuild.rs
low url_literal build_script 1
curl https://clickhouse.com/ | shbuild.rs:30
info unsafe_code library 1
1 unsafe blocks, functions or implssrc/clickhouse.rs:157
Run: check
failed- Ended
- agent reported the end
- Guest
- exit code 101
- Run time
- 21.7 s
- VM restore
- 65 ms
- Payload
- 4559 files, 70.9 MiB
- Files opened
- 6029
Processes 107
Siblings that ran the same program with the same result and the same processes below are folded into one row, with their number.
| Process | Arguments | Start | Took | Exit |
|---|---|---|---|---|
| cargo /usr/local/bin/cargo | check --locked --offline | 5 ms | 21.7 s | 25856 |
| └rustc /usr/local/bin/rustc ×10 | --crate-name build_script_build --edition=2021 /cw/vendor/libc-0.2.190/build.rs --error-format=json --json=diagnostic-rendered-ansi,artifacts,future-incompat --crate-type bin --emit=dep-info,link -C embed-bitcode=no --allow=unused_qualifications --warn=clippy::unnecessary_semicolon --allow=clippy::unnecessary_cast --warn=clippy::ptr_as_ptr --allow=clippy::non_minimal_cfg --allow=clippy::missing_safety_doc --warn=clippy::map_unwrap_or --warn=clippy::manual_assert --allow=clippy::identity_op --warn=clippy::explicit_iter_loop --cfg feature="default" --cfg feature="extra_traits" --cfg feature="std" --check-cfg cfg(docsrs,test) --check-cfg cfg(feature, values("align", "const-extern-fn", "default", "extra_traits", "rustc-dep-of-std", "rustc-std-workspace-core", "std", "use_std")) | 218 ms | 879 ms | 0 |
| └toolchain /usr/bin/cc | -m64 /work/target/debug/build/libc-ca3b81bba335f01d/rustcifReH9/symbols.o /work/target/debug/build/libc-ca3b81bba335f01d/build_script_build-ca3b81bba335f01d.build_script_build.157d31896358aaa9-cgu.0.rcgu.o /work/target/debug/build/libc-ca3b81bba335f01d/build_script_build-ca3b81bba335f01d.build_script_build.157d31896358aaa9-cgu.1.rcgu.o /work/target/debug/build/libc-ca3b81bba335f01d/build_script_build-ca3b81bba335f01d.build_script_build.157d31896358aaa9-cgu.2.rcgu.o /work/target/debug/build/libc-ca3b81bba335f01d/build_script_build-ca3b81bba335f01d.build_script_build.157d31896358aaa9-cgu.3.rcgu.o /work/target/debug/build/libc-ca3b81bba335f01d/build_script_build-ca3b81bba335f01d.96f7rsguutkq79jywdqxpeo4c.rcgu.o -Wl,--as-needed -Wl,-Bstatic /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libstd-64f5f36fb0927694.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libpanic_unwind-549498e8b2e4d924.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libobject-7ff85ea729a864ff.rlib /usr/local/lib/rus | 924 ms | 170 ms | 0 |
| └toolchain /usr/libexec/gcc/x86_64-linux-gnu/14/collect2 | -plugin /usr/libexec/gcc/x86_64-linux-gnu/14/liblto_plugin.so -plugin-opt=/usr/libexec/gcc/x86_64-linux-gnu/14/lto-wrapper -plugin-opt=-fresolution=/tmp/ccDhkmsj.res --build-id --eh-frame-hdr -m elf_x86_64 --hash-style=gnu --as-needed -dynamic-linker /lib64/ld-linux-x86-64.so.2 -pie -fuse-ld=lld -o /work/target/debug/build/libc-ca3b81bba335f01d/build_script_build-ca3b81bba335f01d /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/Scrt1.o /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/crti.o /usr/lib/gcc/x86_64-linux-gnu/14/crtbeginS.o -L/work/target/debug/build/libc-ca3b81bba335f01d/rustcifReH9/raw-dylibs -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/bin/gcc-ld -L/usr/lib/gcc/x86_64-linux-gnu/14 -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../../lib -L/lib/x86_64-linux-gnu -L/lib/../lib -L/usr/lib/x86_64-linux-gnu -L/usr/lib/../li | 951 ms | 143 ms | 0 |
| └toolchain /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/bin/rust-lld | -flavor gnu -plugin /usr/libexec/gcc/x86_64-linux-gnu/14/liblto_plugin.so -plugin-opt=/usr/libexec/gcc/x86_64-linux-gnu/14/lto-wrapper -plugin-opt=-fresolution=/tmp/ccDhkmsj.res --build-id --eh-frame-hdr -m elf_x86_64 --hash-style=gnu --as-needed -dynamic-linker /lib64/ld-linux-x86-64.so.2 -pie -o /work/target/debug/build/libc-ca3b81bba335f01d/build_script_build-ca3b81bba335f01d /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/Scrt1.o /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/crti.o /usr/lib/gcc/x86_64-linux-gnu/14/crtbeginS.o -L/work/target/debug/build/libc-ca3b81bba335f01d/rustcifReH9/raw-dylibs -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/bin/gcc-ld -L/usr/lib/gcc/x86_64-linux-gnu/14 -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../../lib -L/lib/x86_64-linux-gnu -L/lib/../lib -L/usr/lib/x86_64-linux-gnu -L | 960 ms | 133 ms | 0 |
| └build_script libc | 1.1 s | 10 ms | 0 | |
| └rustc /usr/local/bin/rustc | --version | 1.1 s | 7 ms | 0 |
| └rustc /usr/local/bin/rustc ×46 | --crate-name libc --edition=2021 /cw/vendor/libc-0.2.190/src/lib.rs --error-format=json --json=diagnostic-rendered-ansi,artifacts,future-incompat --crate-type lib --emit=dep-info,metadata -C embed-bitcode=no -C debuginfo=2 --allow=unused_qualifications --warn=clippy::unnecessary_semicolon --allow=clippy::unnecessary_cast --warn=clippy::ptr_as_ptr --allow=clippy::non_minimal_cfg --allow=clippy::missing_safety_doc --warn=clippy::map_unwrap_or --warn=clippy::manual_assert --allow=clippy::identity_op --warn=clippy::explicit_iter_loop --cfg feature="default" --cfg feature="extra_traits" --cfg feature="std" --check-cfg cfg(docsrs,test) | 1.1 s | 1.6 s | 0 |
| └build_script proc-macro2 | 3.2 s | 92 ms | 0 | |
| └rustc /usr/local/bin/rustc ×3 | --version | 3.2 s | 8 ms | 0 |
| └rustc /usr/local/bin/rustc | --cfg=procmacro2_build_probe --edition=2021 --crate-name=proc_macro2 --crate-type=lib --cap-lints=allow --emit=dep-info,metadata --out-dir /work/target/debug/build/proc-macro2-4f3f927bd5485a92/out/probe src/probe/proc_macro_span.rs --target x86_64-unknown-linux-gnu | 3.2 s | 30 ms | 256 |
| └build_script quote | 6.5 s | 9 ms | 0 | |
| └rustc /usr/local/bin/rustc | --version | 6.5 s | 8 ms | 0 |
| └build_script parking_lot_core | 6.8 s | 2 ms | 0 | |
| └build_script getrandom | 9.0 s | 1 ms | 0 | |
| └build_script rustix | 10.9 s | 47 ms | 0 | |
| └rustc /usr/local/bin/rustc ×2 | --crate-type=rlib --emit=metadata --target x86_64-unknown-linux-gnu -o /work/target/debug/build/rustix-de87e437a93e79e6/out/rustix_test_can_compile - | 10.9 s | 26 ms | 0 |
| └build_script signal-hook | 11.0 s | 1 ms | 0 | |
| └build_script nix | 14.2 s | 2 ms | 0 | |
| └build_script jetstreamer-utils | 21.6 s | 76 ms | 25856 | |
| └other /usr/bin/sh | -c curl https://clickhouse.com/ | sh | 21.6 s | 75 ms | 0 |
| └other /usr/bin/sh | 21.6 s | 74 ms | 0 | |
| └other /usr/bin/curl | https://clickhouse.com/ | 21.6 s | 74 ms | 0 |
Network 2
The VM has no internet. Every name it looks up resolves to 10.0.2.1, the fake internet, which accepts every connection and records what was sent. Below, it is shown by its port alone, such as :443. The name the build wanted is in the lookups, the HTTP host and the TLS SNI.
Looked up clickhouse.com
| Destination | Protocol | What was sent | Bytes |
|---|---|---|---|
| :443 | tls | SNI clickhouse.com, inside TLS: GET /, host clickhouse.com, agent curl/8.14.1 | 1.5 KiB |
Sockets in the trace 3
| When | Program | How | Address | Type |
|---|---|---|---|---|
| 21.7 s | /usr/bin/curl | connect | unix:/var/run/nscd/socket | stream |
| 21.7 s | /usr/bin/curl | connect | :53 | datagram |
| 21.7 s | /usr/bin/curl | connect | :443 | stream |
Files 0
Secrets opened
None.
Written outside the build directories
None.
Scratch disk 0
- Files
- 409
- Directories
- 112
- Size
- 133.4 MiB
- Compiled units
- 52
Nothing outside the build areas.
Output
Standard error
Compiling libc v0.2.190
Checking cfg-if v1.0.5
Checking memchr v2.8.3
Compiling proc-macro2 v1.0.107
Checking aho-corasick v1.1.5
Compiling quote v1.0.47
Compiling unicode-ident v1.0.26
Checking regex-syntax v0.8.11
Checking regex-automata v0.4.18
Checking errno v0.3.14
Compiling cfg_aliases v0.2.2
Compiling parking_lot_core v0.9.12
Checking bitflags v2.13.2
Checking utf8parse v0.2.2
Checking anstyle-parse v1.0.0
Compiling nix v0.31.3
Checking signal-hook-registry v1.4.8
Checking regex v1.13.1
Compiling signal-hook v0.3.18
Compiling rustix v1.1.5
Checking log v0.4.34
Checking jiff-core v0.1.1
Checking is_terminal_polyfill v1.70.2
Checking smallvec v1.16.2
Checking colorchoice v1.0.5
Compiling getrandom v0.4.3
Checking scopeguard v1.2.0
Checking anstyle v1.0.14
Checking anstyle-query v1.1.5
Checking anstream v1.0.0
Checking lock_api v0.4.14
Checking jiff v0.2.38
Checking env_filter v2.0.0
Compiling syn v3.0.6
Checking linux-raw-sys v0.12.1
Compiling tokio-macros v2.7.2
Checking env_logger v0.11.11
Checking parking_lot v0.12.5
Checking socket2 v0.6.5
Checking mio v1.2.4
Checking once_cell v1.21.4
Checking bytes v1.12.1
Checking lazy_static v1.5.1
Compiling jetstreamer-utils v0.8.0
Checking fastrand v2.5.0
Checking pin-project-lite v0.2.17
Checking tokio v1.53.2
Checking tempfile v3.27.0
error: failed to run custom build command for `jetstreamer-utils v0.8.0`
Caused by:
process didn't exit successfully: `/work/target/debug/build/jetstreamer-utils-67483a64e47d8520/build-script-build` (exit status: 101)
--- stdout
ClickHouse binary not found. Downloading ClickHouse...
--- stderr
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0
0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0
thread 'main' (1014) panicked at /cw/vendor/jetstreamer-utils-0.8.0/build.rs:49:13:
ClickHouse binary was not downloaded correctly.
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace
Timeline
6
| When | From | To | Event | Worker |
|---|---|---|---|---|
| 2026-10-09 14:10 UTC | Discovered | Fetched | fetched | fetcher-1896447 |
| 2026-10-09 14:10 UTC | Fetched | ReadyForSandbox | static_analysis_completed | static-1896495 |
| 2026-10-09 18:36 UTC | ReadyForSandbox | Running | sandbox_started | orchestrator-1898673-slot2 |
| 2026-10-09 18:36 UTC | Running | DynamicallyAnalyzed | sandbox_completed | orchestrator-1898673-slot2 |
| 2026-10-09 18:36 UTC | DynamicallyAnalyzed | Scored | scored | analyzer-1898703 |
| 2026-10-09 18:36 UTC | Scored | Done | finalized | analyzer-1898703 |