gmsh_ffi 0.2.1

Done dynamic on Linux job 127592 crates.io SBOM Findings (VEX) Compare with 0.2.0

high severity shell_command in build_script code: curl failed

high

False positive. A person reviewed this verdict and found the crate benign. The evidence below is what the analysis saw.

Evidence

Points	Signal	Where	What
30	static:shell_command static · gmsh_ffi	build.rs:196	high severity shell_command in build_script code: curl failed
10	disk_outside_build disk	/work/home/.cache	The build left /work/home/.cache (dir) and 3 entries below it.
10	network_lookup network · gmsh_ffi	gmsh.info	The build looked up gmsh.info.
5	exec_downloader trace · gmsh_ffi	/usr/bin/curl	The build ran /usr/bin/curl.

4 without points

Signal	Where	What
static:build_script static · gmsh_ffi	build.rs	low severity build_script in build_script code: build.rs
static:downloader_pattern static · gmsh_ffi	build.rs:139	high severity downloader_pattern in build_script code: https://gmsh.info/bin/Linux/gmsh-{}-Linux64-sdk.tgz at build.rs:139 with std::process::Command::new at build.rs:185
static:process_spawn static · gmsh_ffi	build.rs:185	medium severity process_spawn in build_script code (5 places): std::process::Command::new
static:url_literal static · gmsh_ffi	build.rs:139	low severity url_literal in build_script code (3 places): https://gmsh.info/bin/Linux/gmsh-{}-Linux64-sdk.tgz

Behavior

Profile

disk:outside exec:downloader net:gmsh.info static:downloader_pattern static:process_spawn static:shell_command

Static findings

high downloader_pattern build_script 1

https://gmsh.info/bin/Linux/gmsh-{}-Linux64-sdk.tgz at build.rs:139 with std::process::Command::new at build.rs:185 build.rs:139

high shell_command build_script 1

curl failed build.rs:196

medium process_spawn build_script 5

std::process::Command::new build.rs:185 build.rs:213 build.rs:250 build.rs:383 build.rs:395

low foreign_functions library 383

extern block src/bindings.rs:25 src/bindings.rs:28 src/bindings.rs:31 src/bindings.rs:40 src/bindings.rs:43 src/bindings.rs:46 src/bindings.rs:49 src/bindings.rs:52 src/bindings.rs:55 src/bindings.rs:58 src/bindings.rs:65 src/bindings.rs:72 src/bindings.rs:79 src/bindings.rs:86 src/bindings.rs:96 src/bindings.rs:106 src/bindings.rs:109 src/bindings.rs:112 src/bindings.rs:115 src/bindings.rs:122 src/bindings.rs:128 src/bindings.rs:134 src/bindings.rs:140 src/bindings.rs:146 src/bindings.rs:154 src/bindings.rs:162 src/bindings.rs:170 src/bindings.rs:176 src/bindings.rs:184 src/bindings.rs:195 src/bindings.rs:204 src/bindings.rs:212 src/bindings.rs:221 src/bindings.rs:231 src/bindings.rs:238 src/bindings.rs:246 src/bindings.rs:254 src/bindings.rs:260 src/bindings.rs:268 src/bindings.rs:280 src/bindings.rs:291 src/bindings.rs:298 src/bindings.rs:312 src/bindings.rs:325 src/bindings.rs:328 src/bindings.rs:337 src/bindings.rs:345 src/bindings.rs:353 src/bindings.rs:361 src/bindings.rs:372 and 333 more

low url_literal build_script 3

https://gmsh.info/bin/Linux/gmsh-{}-Linux64-sdk.tgz build.rs:139
https://gmsh.info/bin/Windows/gmsh-{}-Windows64-sdk.zip build.rs:147
https://gmsh.info/bin/MacOSX/gmsh-{}-{}-sdk.tgz build.rs:161

low build_script build_script 1

build.rs build.rs

info native_link build_script 1

links = "gmsh" Cargo.toml

info unsafe_code library 1

424 unsafe blocks, functions or impls src/gmsh.rs:62

Run: full

failed

The full build covers everything the earlier cargo check run did, so only the full run is shown.

Ended: agent reported the end
Guest: exit code 101
Run time: 987 ms
VM restore: 63 ms
Payload: 15 files, 462.3 KiB
Files opened: 269

Processes 7

Siblings that ran the same program with the same result and the same processes below are folded into one row, with their number. Hide the 4 compiler processes (rustc, C toolchain)

Process	Arguments	Start	Took	Exit
cargo /usr/local/bin/cargo	build --locked --offline	5 ms	975 ms	25856
└rustc /usr/local/bin/rustc	--crate-name build_script_build --edition=2021 /cw/vendor/gmsh_ffi-0.2.1/build.rs --error-format=json --json=diagnostic-rendered-ansi,artifacts,future-incompat --crate-type bin --emit=dep-info,link -C embed-bitcode=no --cfg feature="default" --check-cfg cfg(docsrs,test) --check-cfg cfg(feature, values("default")) -C metadata=e9044e6878181f2e -C extra-filename=-5ebea67cb968d838 --out-dir /work/target/debug/build/gmsh_ffi-5ebea67cb968d838 -L dependency=/work/target/debug/deps --cap-lints allow	106 ms	802 ms	0
└toolchain /usr/bin/cc	-m64 /work/target/debug/build/gmsh_ffi-5ebea67cb968d838/rustcyG6Uvs/symbols.o /work/target/debug/build/gmsh_ffi-5ebea67cb968d838/build_script_build-5ebea67cb968d838.build_script_build.142a2d6c5af869f4-cgu.0.rcgu.o /work/target/debug/build/gmsh_ffi-5ebea67cb968d838/build_script_build-5ebea67cb968d838.build_script_build.142a2d6c5af869f4-cgu.1.rcgu.o /work/target/debug/build/gmsh_ffi-5ebea67cb968d838/build_script_build-5ebea67cb968d838.ds7owip78kyx3yif3yht172u9.rcgu.o -Wl,--as-needed -Wl,-Bstatic /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libstd-64f5f36fb0927694.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libpanic_unwind-549498e8b2e4d924.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libobject-7ff85ea729a864ff.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libmemchr-0e3477fb2664a277.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libaddr2line-09755979c57b7e64.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libgimli-9a1fede77fbbf2f0.rlib /usr/local/l	748 ms	156 ms	0
└toolchain /usr/libexec/gcc/x86_64-linux-gnu/14/collect2	-plugin /usr/libexec/gcc/x86_64-linux-gnu/14/liblto_plugin.so -plugin-opt=/usr/libexec/gcc/x86_64-linux-gnu/14/lto-wrapper -plugin-opt=-fresolution=/tmp/cc9T5H6r.res --build-id --eh-frame-hdr -m elf_x86_64 --hash-style=gnu --as-needed -dynamic-linker /lib64/ld-linux-x86-64.so.2 -pie -fuse-ld=lld -o /work/target/debug/build/gmsh_ffi-5ebea67cb968d838/build_script_build-5ebea67cb968d838 /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/Scrt1.o /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/crti.o /usr/lib/gcc/x86_64-linux-gnu/14/crtbeginS.o -L/work/target/debug/build/gmsh_ffi-5ebea67cb968d838/rustcyG6Uvs/raw-dylibs -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/bin/gcc-ld -L/usr/lib/gcc/x86_64-linux-gnu/14 -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../../lib -L/lib/x86_64-linux-gnu -L/lib/../lib -L/usr/lib/x86_64-linux-gnu -L/usr/l	754 ms	150 ms	0
└toolchain /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/bin/rust-lld	-flavor gnu -plugin /usr/libexec/gcc/x86_64-linux-gnu/14/liblto_plugin.so -plugin-opt=/usr/libexec/gcc/x86_64-linux-gnu/14/lto-wrapper -plugin-opt=-fresolution=/tmp/cc9T5H6r.res --build-id --eh-frame-hdr -m elf_x86_64 --hash-style=gnu --as-needed -dynamic-linker /lib64/ld-linux-x86-64.so.2 -pie -o /work/target/debug/build/gmsh_ffi-5ebea67cb968d838/build_script_build-5ebea67cb968d838 /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/Scrt1.o /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/crti.o /usr/lib/gcc/x86_64-linux-gnu/14/crtbeginS.o -L/work/target/debug/build/gmsh_ffi-5ebea67cb968d838/rustcyG6Uvs/raw-dylibs -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/bin/gcc-ld -L/usr/lib/gcc/x86_64-linux-gnu/14 -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../../lib -L/lib/x86_64-linux-gnu -L/lib/../lib -L/usr/lib/x86_64-linu	757 ms	146 ms	0
└build_script gmsh_ffi		912 ms	67 ms	25856
└other /usr/bin/curl	-L -f -A Mozilla/5.0 https://gmsh.info/bin/Linux/gmsh-4.15.2-Linux64-sdk.tgz -o /work/home/.cache/gmsh-sdk/4.15.2/linux-x86_64/gmsh-4.15.2-Linux64-sdk.tgz	913 ms	65 ms	5632

Network 2

The VM has no internet. Every name it looks up resolves to 10.0.2.1, the fake internet, which accepts every connection and records what was sent. Below, it is shown by its port alone, such as :443. The name the build wanted is in the lookups, the HTTP host and the TLS SNI.

Looked up gmsh.info

Destination	Protocol	What was sent	Bytes
:443	tls	SNI gmsh.info, inside TLS: GET /bin/Linux/gmsh-4.15.2-Linux64-sdk.tgz, host gmsh.info, agent Mozilla/5.0	1.5 KiB

Sockets in the trace 3

When	Program	How	Address	Type
950 ms	/usr/bin/curl	connect	unix:/var/run/nscd/socket	stream
952 ms	/usr/bin/curl	connect	:53	datagram
953 ms	/usr/bin/curl	connect	:443	stream

Files 0

Secrets opened

None.

Written outside the build directories

None.

Scratch disk 4

Files: 19
Directories: 26
Size: 9.2 MiB
Compiled units: 0

Why	Path	Kind	Size	Mode
outside the build areas	/work/home/.cache	dir	4.0 KiB	755
outside the build areas	/work/home/.cache/gmsh-sdk	dir	4.0 KiB	755
outside the build areas	/work/home/.cache/gmsh-sdk/4.15.2	dir	4.0 KiB	755
outside the build areas	/work/home/.cache/gmsh-sdk/4.15.2/linux-x86_64	dir	4.0 KiB	755

Output

Standard error

   Compiling gmsh_ffi v0.2.1
warning: gmsh_ffi@0.2.1: Downloading Gmsh SDK from https://gmsh.info/bin/Linux/gmsh-4.15.2-Linux64-sdk.tgz...
error: failed to run custom build command for `gmsh_ffi v0.2.1`

Caused by:
  process didn't exit successfully: `/work/target/debug/build/gmsh_ffi-5ebea67cb968d838/build-script-build` (exit status: 101)
  --- stdout
  cargo:rerun-if-changed=build.rs
  cargo:warning=Downloading Gmsh SDK from https://gmsh.info/bin/Linux/gmsh-4.15.2-Linux64-sdk.tgz...

  --- stderr
    % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                   Dload  Upload   Total   Spent    Left  Speed
  
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
  curl: (22) The requested URL returned error: 404

  thread 'main' (592) panicked at /cw/vendor/gmsh_ffi-0.2.1/build.rs:198:13:
  Download failed
  note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace

Timeline

When	From	To	Event	Worker
2026-10-11 03:06 UTC	Discovered	Fetched	fetched	fetcher-1896447
2026-10-11 03:06 UTC	Fetched	ReadyForSandbox	static_analysis_completed	static-1896495
2026-10-11 03:06 UTC	ReadyForSandbox	Running	sandbox_started	orchestrator-1898673-slot2
2026-10-11 03:06 UTC	Running	DynamicallyAnalyzed	sandbox_completed	orchestrator-1898673-slot2
2026-10-11 03:06 UTC	DynamicallyAnalyzed	ReadyForSandbox	scored	analyzer-1898703
2026-10-11 03:06 UTC	ReadyForSandbox	Running	sandbox_started	orchestrator-1898673-slot1
2026-10-11 03:06 UTC	Running	DynamicallyAnalyzed	sandbox_completed	orchestrator-1898673-slot1
2026-10-11 03:06 UTC	DynamicallyAnalyzed	Scored	scored	analyzer-1898703
2026-10-11 03:06 UTC	Scored	Done	finalized	analyzer-1898703