jetstreamer-utils 0.8.1
high severity shell_command in build_script code: curl https://clickhouse.com/ | sh
48
medium
Automated verdict. Nobody reviewed it. A score is a reason to look closer, not a finding.
Evidence
| Points | Signal | Where | What |
|---|---|---|---|
| 30 | static:shell_command static · jetstreamer-utils | build.rs:30 | high severity shell_command in build_script code: curl https://clickhouse.com/ | sh |
| 10 | network_lookup network · jetstreamer-utils | clickhouse.com | The build looked up clickhouse.com. |
| 5 | exec_downloader trace · jetstreamer-utils | /usr/bin/curl | The build ran /usr/bin/curl. |
| 3 | exec_shell trace · jetstreamer-utils | /usr/bin/sh | The build ran /usr/bin/sh. |
3 without points
| Signal | Where | What |
|---|---|---|
| static:build_script static · jetstreamer-utils | build.rs | low severity build_script in build_script code: build.rs |
| static:process_spawn static · jetstreamer-utils | build.rs:28 | medium severity process_spawn in build_script code (5 places): std::process::Command::new |
| static:url_literal static · jetstreamer-utils | build.rs:30 | low severity url_literal in build_script code: curl https://clickhouse.com/ | sh |
Behavior
Profile
exec:downloader exec:shell net:clickhouse.com static:process_spawn static:shell_command
Static findings
6 groups
high shell_command build_script 1
curl https://clickhouse.com/ | shbuild.rs:30
medium process_spawn build_script 1
std::process::Command::newbuild.rs:28
low process_spawn library 4
tokio::process::Command::newsrc/clickhouse.rs:50 src/clickhouse.rs:115 src/clickhouse.rs:158 src/clickhouse.rs:305
low build_script build_script 1
build.rsbuild.rs
low url_literal build_script 1
curl https://clickhouse.com/ | shbuild.rs:30
info unsafe_code library 1
1 unsafe blocks, functions or implssrc/clickhouse.rs:157
Run: check
failed- Ended
- agent reported the end
- Guest
- exit code 101
- Run time
- 19.9 s
- VM restore
- 66 ms
- Payload
- 4559 files, 70.9 MiB
- Files opened
- 6115
Processes 108
Siblings that ran the same program with the same result and the same processes below are folded into one row, with their number.
| Process | Arguments | Start | Took | Exit |
|---|---|---|---|---|
| cargo /usr/local/bin/cargo | check --locked --offline | 5 ms | 19.8 s | 25856 |
| └rustc /usr/local/bin/rustc ×10 | --crate-name build_script_build --edition=2021 /cw/vendor/libc-0.2.190/build.rs --error-format=json --json=diagnostic-rendered-ansi,artifacts,future-incompat --crate-type bin --emit=dep-info,link -C embed-bitcode=no --allow=unused_qualifications --warn=clippy::unnecessary_semicolon --allow=clippy::unnecessary_cast --warn=clippy::ptr_as_ptr --allow=clippy::non_minimal_cfg --allow=clippy::missing_safety_doc --warn=clippy::map_unwrap_or --warn=clippy::manual_assert --allow=clippy::identity_op --warn=clippy::explicit_iter_loop --cfg feature="default" --cfg feature="extra_traits" --cfg feature="std" --check-cfg cfg(docsrs,test) --check-cfg cfg(feature, values("align", "const-extern-fn", "default", "extra_traits", "rustc-dep-of-std", "rustc-std-workspace-core", "std", "use_std")) | 194 ms | 790 ms | 0 |
| └toolchain /usr/bin/cc | -m64 /work/target/debug/build/libc-ca3b81bba335f01d/rustccpMKfN/symbols.o /work/target/debug/build/libc-ca3b81bba335f01d/build_script_build-ca3b81bba335f01d.build_script_build.157d31896358aaa9-cgu.0.rcgu.o /work/target/debug/build/libc-ca3b81bba335f01d/build_script_build-ca3b81bba335f01d.build_script_build.157d31896358aaa9-cgu.1.rcgu.o /work/target/debug/build/libc-ca3b81bba335f01d/build_script_build-ca3b81bba335f01d.build_script_build.157d31896358aaa9-cgu.2.rcgu.o /work/target/debug/build/libc-ca3b81bba335f01d/build_script_build-ca3b81bba335f01d.build_script_build.157d31896358aaa9-cgu.3.rcgu.o /work/target/debug/build/libc-ca3b81bba335f01d/build_script_build-ca3b81bba335f01d.96f7rsguutkq79jywdqxpeo4c.rcgu.o -Wl,--as-needed -Wl,-Bstatic /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libstd-64f5f36fb0927694.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libpanic_unwind-549498e8b2e4d924.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libobject-7ff85ea729a864ff.rlib /usr/local/lib/rus | 835 ms | 146 ms | 0 |
| └toolchain /usr/libexec/gcc/x86_64-linux-gnu/14/collect2 | -plugin /usr/libexec/gcc/x86_64-linux-gnu/14/liblto_plugin.so -plugin-opt=/usr/libexec/gcc/x86_64-linux-gnu/14/lto-wrapper -plugin-opt=-fresolution=/tmp/ccKa5Ux7.res --build-id --eh-frame-hdr -m elf_x86_64 --hash-style=gnu --as-needed -dynamic-linker /lib64/ld-linux-x86-64.so.2 -pie -fuse-ld=lld -o /work/target/debug/build/libc-ca3b81bba335f01d/build_script_build-ca3b81bba335f01d /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/Scrt1.o /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/crti.o /usr/lib/gcc/x86_64-linux-gnu/14/crtbeginS.o -L/work/target/debug/build/libc-ca3b81bba335f01d/rustccpMKfN/raw-dylibs -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/bin/gcc-ld -L/usr/lib/gcc/x86_64-linux-gnu/14 -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../../lib -L/lib/x86_64-linux-gnu -L/lib/../lib -L/usr/lib/x86_64-linux-gnu -L/usr/lib/../li | 842 ms | 139 ms | 0 |
| └toolchain /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/bin/rust-lld | -flavor gnu -plugin /usr/libexec/gcc/x86_64-linux-gnu/14/liblto_plugin.so -plugin-opt=/usr/libexec/gcc/x86_64-linux-gnu/14/lto-wrapper -plugin-opt=-fresolution=/tmp/ccKa5Ux7.res --build-id --eh-frame-hdr -m elf_x86_64 --hash-style=gnu --as-needed -dynamic-linker /lib64/ld-linux-x86-64.so.2 -pie -o /work/target/debug/build/libc-ca3b81bba335f01d/build_script_build-ca3b81bba335f01d /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/Scrt1.o /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/crti.o /usr/lib/gcc/x86_64-linux-gnu/14/crtbeginS.o -L/work/target/debug/build/libc-ca3b81bba335f01d/rustccpMKfN/raw-dylibs -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/bin/gcc-ld -L/usr/lib/gcc/x86_64-linux-gnu/14 -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../../lib -L/lib/x86_64-linux-gnu -L/lib/../lib -L/usr/lib/x86_64-linux-gnu -L | 844 ms | 136 ms | 0 |
| └build_script libc | 988 ms | 9 ms | 0 | |
| └rustc /usr/local/bin/rustc | --version | 990 ms | 6 ms | 0 |
| └rustc /usr/local/bin/rustc ×47 | --crate-name libc --edition=2021 /cw/vendor/libc-0.2.190/src/lib.rs --error-format=json --json=diagnostic-rendered-ansi,artifacts,future-incompat --crate-type lib --emit=dep-info,metadata -C embed-bitcode=no -C debuginfo=2 --allow=unused_qualifications --warn=clippy::unnecessary_semicolon --allow=clippy::unnecessary_cast --warn=clippy::ptr_as_ptr --allow=clippy::non_minimal_cfg --allow=clippy::missing_safety_doc --warn=clippy::map_unwrap_or --warn=clippy::manual_assert --allow=clippy::identity_op --warn=clippy::explicit_iter_loop --cfg feature="default" --cfg feature="extra_traits" --cfg feature="std" --check-cfg cfg(docsrs,test) | 998 ms | 1.2 s | 0 |
| └build_script proc-macro2 | 2.7 s | 75 ms | 0 | |
| └rustc /usr/local/bin/rustc ×3 | --version | 2.7 s | 6 ms | 0 |
| └rustc /usr/local/bin/rustc | --cfg=procmacro2_build_probe --edition=2021 --crate-name=proc_macro2 --crate-type=lib --cap-lints=allow --emit=dep-info,metadata --out-dir /work/target/debug/build/proc-macro2-4f3f927bd5485a92/out/probe src/probe/proc_macro_span.rs --target x86_64-unknown-linux-gnu | 2.7 s | 28 ms | 256 |
| └build_script quote | 5.3 s | 9 ms | 0 | |
| └rustc /usr/local/bin/rustc | --version | 5.3 s | 7 ms | 0 |
| └build_script parking_lot_core | 6.1 s | 1 ms | 0 | |
| └build_script rustix | 8.2 s | 34 ms | 0 | |
| └rustc /usr/local/bin/rustc ×2 | --crate-type=rlib --emit=metadata --target x86_64-unknown-linux-gnu -o /work/target/debug/build/rustix-de87e437a93e79e6/out/rustix_test_can_compile - | 8.2 s | 15 ms | 0 |
| └build_script getrandom | 9.9 s | 1 ms | 0 | |
| └build_script signal-hook | 9.9 s | 2 ms | 0 | |
| └build_script nix | 12.8 s | 2 ms | 0 | |
| └build_script jetstreamer-utils | 19.7 s | 65 ms | 25856 | |
| └other /usr/bin/sh | -c curl https://clickhouse.com/ | sh | 19.7 s | 64 ms | 0 |
| └other /usr/bin/sh | 19.7 s | 63 ms | 0 | |
| └other /usr/bin/curl | https://clickhouse.com/ | 19.7 s | 62 ms | 0 |
Network 2
The VM has no internet. Every name it looks up resolves to 10.0.2.1, the fake internet, which accepts every connection and records what was sent. Below, it is shown by its port alone, such as :443. The name the build wanted is in the lookups, the HTTP host and the TLS SNI.
Looked up clickhouse.com
| Destination | Protocol | What was sent | Bytes |
|---|---|---|---|
| :443 | tls | SNI clickhouse.com, inside TLS: GET /, host clickhouse.com, agent curl/8.14.1 | 1.5 KiB |
Sockets in the trace 3
| When | Program | How | Address | Type |
|---|---|---|---|---|
| 19.8 s | /usr/bin/curl | connect | unix:/var/run/nscd/socket | stream |
| 19.8 s | /usr/bin/curl | connect | :53 | datagram |
| 19.8 s | /usr/bin/curl | connect | :443 | stream |
Files 0
Secrets opened
None.
Written outside the build directories
None.
Scratch disk 0
- Files
- 415
- Directories
- 112
- Size
- 133.4 MiB
- Compiled units
- 53
Nothing outside the build areas.
Output
Standard error
Compiling libc v0.2.190
Checking cfg-if v1.0.5
Checking memchr v2.8.3
Compiling proc-macro2 v1.0.107
Checking aho-corasick v1.1.5
Compiling unicode-ident v1.0.26
Compiling quote v1.0.47
Checking regex-syntax v0.8.11
Checking regex-automata v0.4.18
Checking errno v0.3.14
Checking utf8parse v0.2.2
Checking bitflags v2.13.2
Compiling cfg_aliases v0.2.2
Compiling parking_lot_core v0.9.12
Compiling nix v0.31.3
Checking anstyle-parse v1.0.0
Checking signal-hook-registry v1.4.8
Checking regex v1.13.1
Checking is_terminal_polyfill v1.70.2
Checking scopeguard v1.2.0
Compiling signal-hook v0.3.18
Compiling getrandom v0.4.3
Checking smallvec v1.16.2
Checking anstyle v1.0.14
Checking colorchoice v1.0.5
Checking jiff-core v0.1.1
Checking log v0.4.34
Compiling rustix v1.1.5
Checking anstyle-query v1.1.5
Checking anstream v1.0.0
Checking env_filter v2.0.0
Checking jiff v0.2.38
Checking lock_api v0.4.14
Compiling syn v3.0.6
Checking linux-raw-sys v0.12.1
Compiling tokio-macros v2.7.2
Checking parking_lot v0.12.5
Checking env_logger v0.11.11
Checking mio v1.2.4
Checking socket2 v0.6.5
Checking fastrand v2.5.0
Compiling jetstreamer-utils v0.8.1
Checking bytes v1.12.1
Checking once_cell v1.21.4
Checking lazy_static v1.5.1
Checking pin-project-lite v0.2.17
Checking tokio v1.53.2
Checking solana-logger v3.0.0
Checking tempfile v3.27.0
error: failed to run custom build command for `jetstreamer-utils v0.8.1`
Caused by:
process didn't exit successfully: `/work/target/debug/build/jetstreamer-utils-5fdcfbed38505f14/build-script-build` (exit status: 101)
--- stdout
ClickHouse binary not found. Downloading ClickHouse...
--- stderr
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0
0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0
thread 'main' (1019) panicked at /cw/vendor/jetstreamer-utils-0.8.1/build.rs:49:13:
ClickHouse binary was not downloaded correctly.
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace
Timeline
6
| When | From | To | Event | Worker |
|---|---|---|---|---|
| 2026-10-09 16:57 UTC | Discovered | Fetched | fetched | fetcher-1896447 |
| 2026-10-09 16:57 UTC | Fetched | ReadyForSandbox | static_analysis_completed | static-1896495 |
| 2026-10-09 20:57 UTC | ReadyForSandbox | Running | sandbox_started | orchestrator-1898673-slot2 |
| 2026-10-09 20:58 UTC | Running | DynamicallyAnalyzed | sandbox_completed | orchestrator-1898673-slot2 |
| 2026-10-09 20:58 UTC | DynamicallyAnalyzed | Scored | scored | analyzer-1898703 |
| 2026-10-09 20:58 UTC | Scored | Done | finalized | analyzer-1898703 |