naui-winui3 0.10.0

Done dynamic on Linux job 180418 crates.io SBOM Findings (VEX)

high severity downloader_pattern in build_script code: https://api.nuget.org/v3-flatcontainer/{id}/{version}/{name} at build.rs:391 with std::process::Command::new at build.rs:396

high

False positive. A person reviewed this verdict and found the crate benign. The evidence below is what the analysis saw.

Evidence

Points	Signal	Where	What
30	static:downloader_pattern static · naui-winui3	build.rs:391	high severity downloader_pattern in build_script code: https://api.nuget.org/v3-flatcontainer/{id}/{version}/{name} at build.rs:391 with std::process::Command::new at build.rs:396
10	build_script_added diff · naui-winui3		A build script was added since 0.9.1.
10	new_high_finding diff · naui-winui3	build.rs:391	New since 0.9.1: downloader_pattern

5 without points

Signal	Where	What
new_high_finding diff · naui-winui3	build.rs:402	New since 0.9.1: shell_command
static:build_script static · naui-winui3	build.rs	low severity build_script in build_script code: build.rs
static:process_spawn static · naui-winui3	build.rs:396	medium severity process_spawn in build_script code: std::process::Command::new
static:shell_command static · naui-winui3	build.rs:402	high severity shell_command in build_script code: curl を起動できません ({e})。{PACKAGES_ENV} に .nupkg の置き場を指定すれば取得せずに済みます
static:url_literal static · naui-winui3	build.rs:391	low severity url_literal in build_script code (3 places): https://api.nuget.org/v3-flatcontainer/{id}/{version}/{name}

Behavior

New since the previous version

static:downloader_pattern static:process_spawn static:shell_command

Profile

static:downloader_pattern static:process_spawn static:shell_command

Static findings

high downloader_pattern build_script 1

https://api.nuget.org/v3-flatcontainer/{id}/{version}/{name} at build.rs:391 with std::process::Command::new at build.rs:396 build.rs:391

high shell_command build_script 1

curl を起動できません ({e})。{PACKAGES_ENV} に .nupkg の置き場を指定すれば取得せずに済みます build.rs:402

medium process_spawn build_script 1

std::process::Command::new build.rs:396

low url_literal build_script 2

https://api.nuget.org/v3-flatcontainer/{id}/{version}/{name} build.rs:391
http://schemas.microsoft.com/appx/manifest/foundation/windows10 build/manifest.rs:13

low build_script build_script 1

build.rs build.rs

info unsafe_code library 5

17 unsafe blocks, functions or impls src/bootstrap.rs:138
10 unsafe blocks, functions or impls src/compose.rs:91
1 unsafe blocks, functions or impls src/lib.rs:63 src/native.rs:27
9 unsafe blocks, functions or impls src/self_contained.rs:111

info url_literal library 1

<?xml version="1.0" encoding="utf-8"?>\u{a}<Fragment xmlns="http://schemas.microsoft.com/appx/manifest/foundation/windows10">\u{a} <Extensions>\u{a} <Extension Category="windows.activatableClass.i… src/self_contained.rs:272

Run: full

succeeded

The full build covers everything the earlier cargo check run did, so only the full run is shown.

Ended: agent reported the end
Guest: exit code 0
Run time: 2.1 s
VM restore: 180 ms
Payload: 1094 files, 127.6 MiB
Files opened: 383

Processes 8

Siblings that ran the same program with the same result and the same processes below are folded into one row, with their number. Hide the 6 compiler processes (rustc, C toolchain)

Process	Arguments	Start	Took
cargo /usr/local/bin/cargo	build --locked --offline	13 ms	2.1 s
└rustc /usr/local/bin/rustc	--crate-name build_script_build --edition=2021 /cw/vendor/naui-winui3-0.10.0/build.rs --error-format=json --json=diagnostic-rendered-ansi,artifacts,future-incompat --crate-type bin --emit=dep-info,link -C embed-bitcode=no --check-cfg cfg(docsrs,test) --check-cfg cfg(feature, values("self-contained")) -C metadata=eee1dbdb43d007a1 -C extra-filename=-c938206e676ca616 --out-dir /work/target/debug/build/naui-winui3-c938206e676ca616 -L dependency=/work/target/debug/deps --cap-lints allow	332 ms	1.6 s
└toolchain /usr/bin/cc	-m64 /work/target/debug/build/naui-winui3-c938206e676ca616/rustcgwiawq/symbols.o /work/target/debug/build/naui-winui3-c938206e676ca616/build_script_build-c938206e676ca616.build_script_build.6b43a9336a0369a4-cgu.0.rcgu.o /work/target/debug/build/naui-winui3-c938206e676ca616/build_script_build-c938206e676ca616.2ciphdzr4ib02ui6bbi7lxodi.rcgu.o -Wl,--as-needed -Wl,-Bstatic /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libstd-64f5f36fb0927694.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libpanic_unwind-549498e8b2e4d924.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libobject-7ff85ea729a864ff.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libmemchr-0e3477fb2664a277.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libaddr2line-09755979c57b7e64.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libgimli-9a1fede77fbbf2f0.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libcfg_if-360da4ba13154744.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/lib	1.4 s	512 ms
└toolchain /usr/libexec/gcc/x86_64-linux-gnu/14/collect2	-plugin /usr/libexec/gcc/x86_64-linux-gnu/14/liblto_plugin.so -plugin-opt=/usr/libexec/gcc/x86_64-linux-gnu/14/lto-wrapper -plugin-opt=-fresolution=/tmp/ccSSpIJB.res --build-id --eh-frame-hdr -m elf_x86_64 --hash-style=gnu --as-needed -dynamic-linker /lib64/ld-linux-x86-64.so.2 -pie -fuse-ld=lld -o /work/target/debug/build/naui-winui3-c938206e676ca616/build_script_build-c938206e676ca616 /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/Scrt1.o /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/crti.o /usr/lib/gcc/x86_64-linux-gnu/14/crtbeginS.o -L/work/target/debug/build/naui-winui3-c938206e676ca616/rustcgwiawq/raw-dylibs -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/bin/gcc-ld -L/usr/lib/gcc/x86_64-linux-gnu/14 -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../../lib -L/lib/x86_64-linux-gnu -L/lib/../lib -L/usr/lib/x86_64-linux-gnu -L	1.4 s	502 ms
└toolchain /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/bin/rust-lld	-flavor gnu -plugin /usr/libexec/gcc/x86_64-linux-gnu/14/liblto_plugin.so -plugin-opt=/usr/libexec/gcc/x86_64-linux-gnu/14/lto-wrapper -plugin-opt=-fresolution=/tmp/ccSSpIJB.res --build-id --eh-frame-hdr -m elf_x86_64 --hash-style=gnu --as-needed -dynamic-linker /lib64/ld-linux-x86-64.so.2 -pie -o /work/target/debug/build/naui-winui3-c938206e676ca616/build_script_build-c938206e676ca616 /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/Scrt1.o /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/crti.o /usr/lib/gcc/x86_64-linux-gnu/14/crtbeginS.o -L/work/target/debug/build/naui-winui3-c938206e676ca616/rustcgwiawq/raw-dylibs -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/bin/gcc-ld -L/usr/lib/gcc/x86_64-linux-gnu/14 -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../../lib -L/lib/x86_64-linux-gnu -L/lib/../lib -L/usr/lib/x86_6	1.4 s	480 ms
└build_script naui-winui3		1.9 s	3 ms
└rustc /usr/local/bin/rustc ×2	--crate-name naui_winui3 --edition=2021 /cw/vendor/naui-winui3-0.10.0/src/lib.rs --error-format=json --json=diagnostic-rendered-ansi,artifacts,future-incompat --crate-type lib --emit=dep-info,metadata,link -C embed-bitcode=no -C debuginfo=2 --check-cfg cfg(docsrs,test) --check-cfg cfg(feature, values("self-contained")) -C metadata=dc54986e862f9e3d -C extra-filename=-15ff7f332e62c3b1 --out-dir /work/target/debug/deps -L dependency=/work/target/debug/deps --cap-lints allow	1.9 s	68 ms

Network 0

No network activity.

Files 0

Secrets opened

None.

Written outside the build directories

None.

Scratch disk 0

Files: 46
Directories: 26
Size: 8.7 MiB
Compiled units: 4

Nothing outside the build areas.

Output

Standard error

   Compiling naui-winui3 v0.10.0
   Compiling crateward-probe v0.0.0 (/cw/probe)
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 2.05s

Timeline

When	From	To	Event	Worker
2026-10-16 15:09 UTC	Discovered	Fetched	fetched	fetcher-286769
2026-10-16 15:09 UTC	Fetched	ReadyForSandbox	static_analysis_completed	static-286807
2026-10-16 15:12 UTC	ReadyForSandbox	Running	sandbox_started	orchestrator-289279-slot1
2026-10-16 15:12 UTC	Running	DynamicallyAnalyzed	sandbox_completed	orchestrator-289279-slot1
2026-10-16 15:12 UTC	DynamicallyAnalyzed	ReadyForSandbox	scored	analyzer-289309
2026-10-16 15:12 UTC	ReadyForSandbox	Running	sandbox_started	orchestrator-289279-slot2
2026-10-16 15:12 UTC	Running	DynamicallyAnalyzed	sandbox_completed	orchestrator-289279-slot2
2026-10-16 15:12 UTC	DynamicallyAnalyzed	Scored	scored	analyzer-289309
2026-10-16 15:12 UTC	Scored	Done	finalized	analyzer-289309