litert-lm-edge-sys 0.2.6

Done dynamic on Linux job 184677 crates.io SBOM Findings (VEX)

high severity shell_command in build_script code (6 places): curl is not runnable: {error}

medium

Automated verdict. Nobody reviewed it. A score is a reason to look closer, not a finding.

Evidence

Points	Signal	Where	What
30	static:shell_command static · litert-lm-edge-sys	build.rs:341	high severity shell_command in build_script code (6 places): curl is not runnable: {error}
10	network_lookup network · litert-lm-edge-sys	github.com	The build looked up github.com.
5	exec_downloader trace · litert-lm-edge-sys	/usr/bin/curl	The build ran /usr/bin/curl.

4 without points

Signal	Where	What
static:build_script static · litert-lm-edge-sys	build.rs	low severity build_script in build_script code: build.rs
static:downloader_pattern static · litert-lm-edge-sys	build.rs:26	high severity downloader_pattern in build_script code: https://github.com/mdddj/litert-lm-edge-rs/releases at build.rs:26 with std::process::Command::new at build.rs:330
static:process_spawn static · litert-lm-edge-sys	build.rs:330	medium severity process_spawn in build_script code (2 places): std::process::Command::new
static:url_literal static · litert-lm-edge-sys	build.rs:26	low severity url_literal in build_script code (3 places): https://github.com/mdddj/litert-lm-edge-rs/releases

Behavior

Profile

exec:downloader net:github.com static:downloader_pattern static:process_spawn static:shell_command

Static findings

high shell_command build_script 6

curl is not runnable: {error} build.rs:341
curl exited with {}: {stderr} build.rs:346
$ProgressPreference='SilentlyContinue'; Invoke-WebRequest -Uri '{}' -OutFile '{}' build.rs:351
powershell build.rs:356
powershell is not runnable: {error} build.rs:359
powershell exited with {}: {stderr} build.rs:365

high downloader_pattern build_script 1

https://github.com/mdddj/litert-lm-edge-rs/releases at build.rs:26 with std::process::Command::new at build.rs:330 build.rs:26

medium process_spawn build_script 2

std::process::Command::new build.rs:330 build.rs:356

low foreign_functions library 182

extern block src/fallback.rs:86 src/fallback.rs:91 src/fallback.rs:94 src/fallback.rs:97 src/fallback.rs:100 src/fallback.rs:106 src/fallback.rs:109 src/fallback.rs:112 src/fallback.rs:118 src/fallback.rs:124 src/fallback.rs:130 src/fallback.rs:136 src/fallback.rs:139 src/fallback.rs:145 src/fallback.rs:151 src/fallback.rs:154 src/fallback.rs:157 src/fallback.rs:163 src/fallback.rs:169 src/fallback.rs:175 src/fallback.rs:181 src/fallback.rs:184 src/fallback.rs:187 src/fallback.rs:193 src/fallback.rs:199 src/fallback.rs:202 src/fallback.rs:205 src/fallback.rs:220 src/fallback.rs:229 src/fallback.rs:236 src/fallback.rs:239 src/fallback.rs:247 src/fallback.rs:255 src/fallback.rs:258 src/fallback.rs:264 src/fallback.rs:270 src/fallback.rs:276 src/fallback.rs:282 src/fallback.rs:288 src/fallback.rs:294 src/fallback.rs:300 src/fallback.rs:306 src/fallback.rs:317 src/fallback.rs:323 src/fallback.rs:329 src/fallback.rs:335 src/fallback.rs:338 src/fallback.rs:344 src/fallback.rs:350 src/fallback.rs:356 and 132 more

low url_literal build_script 3

https://github.com/mdddj/litert-lm-edge-rs/releases build.rs:26
file:// build.rs:373
:// build.rs:376

low build_script build_script 1

build.rs build.rs

info native_link build_script 1

links = "litert_lm_c_api" Cargo.toml

Run: check

failed

Ended: agent reported the end
Guest: exit code 101
Run time: 7.8 s
VM restore: 162 ms
Payload: 2059 files, 44.1 MiB
Files opened: 2855

Processes 53

Siblings that ran the same program with the same result and the same processes below are folded into one row, with their number. Hide the 46 compiler processes (rustc, C toolchain)

Process	Arguments	Start	Took	Exit
cargo /usr/local/bin/cargo	check --locked --offline	5 ms	7.8 s	25856
└rustc /usr/local/bin/rustc ×21	--crate-name version_check --edition=2015 /cw/vendor/version_check-0.9.5/src/lib.rs --error-format=json --json=diagnostic-rendered-ansi,artifacts,future-incompat --crate-type lib --emit=dep-info,metadata,link -C embed-bitcode=no --check-cfg cfg(docsrs,test) --check-cfg cfg(feature, values()) -C metadata=761591b74bd31af4 -C extra-filename=-4132b826e7cdd7f2 --out-dir /work/target/debug/deps -L dependency=/work/target/debug/deps --cap-lints allow	143 ms	594 ms	0
└rustc /usr/local/bin/rustc ×5	--crate-name build_script_build --edition=2015 /cw/vendor/generic-array-0.14.7/build.rs --error-format=json --json=diagnostic-rendered-ansi,artifacts,future-incompat --crate-type bin --emit=dep-info,link -C embed-bitcode=no --cfg feature="more_lengths" --check-cfg cfg(docsrs,test) --check-cfg cfg(feature, values("more_lengths", "serde", "zeroize")) -C metadata=c6193d51ea47c358 -C extra-filename=-4cac162ab79b2857 --out-dir /work/target/debug/build/generic-array-4cac162ab79b2857 -L dependency=/work/target/debug/deps --extern version_check=/work/target/debug/deps/libversion_check-4132b826e7cdd7f2.rlib --cap-lints allow	741 ms	172 ms	0
└toolchain /usr/bin/cc	-m64 /work/target/debug/build/generic-array-4cac162ab79b2857/rustcgUTNl1/symbols.o /work/target/debug/build/generic-array-4cac162ab79b2857/build_script_build-4cac162ab79b2857.build_script_build.219a34a113ead989-cgu.0.rcgu.o /work/target/debug/build/generic-array-4cac162ab79b2857/build_script_build-4cac162ab79b2857.2b97gkja43qeirmggk3az0ly6.rcgu.o -Wl,--as-needed -Wl,-Bstatic /work/target/debug/deps/libversion_check-4132b826e7cdd7f2.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libstd-64f5f36fb0927694.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libpanic_unwind-549498e8b2e4d924.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libobject-7ff85ea729a864ff.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libmemchr-0e3477fb2664a277.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libaddr2line-09755979c57b7e64.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libgimli-9a1fede77fbbf2f0.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libcfg_if-360da4ba	776 ms	136 ms	0
└toolchain /usr/libexec/gcc/x86_64-linux-gnu/14/collect2	-plugin /usr/libexec/gcc/x86_64-linux-gnu/14/liblto_plugin.so -plugin-opt=/usr/libexec/gcc/x86_64-linux-gnu/14/lto-wrapper -plugin-opt=-fresolution=/tmp/cc4PpMB5.res --build-id --eh-frame-hdr -m elf_x86_64 --hash-style=gnu --as-needed -dynamic-linker /lib64/ld-linux-x86-64.so.2 -pie -fuse-ld=lld -o /work/target/debug/build/generic-array-4cac162ab79b2857/build_script_build-4cac162ab79b2857 /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/Scrt1.o /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/crti.o /usr/lib/gcc/x86_64-linux-gnu/14/crtbeginS.o -L/work/target/debug/build/generic-array-4cac162ab79b2857/rustcgUTNl1/raw-dylibs -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/bin/gcc-ld -L/usr/lib/gcc/x86_64-linux-gnu/14 -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../../lib -L/lib/x86_64-linux-gnu -L/lib/../lib -L/usr/lib/x86_64-linux-gn	785 ms	127 ms	0
└toolchain /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/bin/rust-lld	-flavor gnu -plugin /usr/libexec/gcc/x86_64-linux-gnu/14/liblto_plugin.so -plugin-opt=/usr/libexec/gcc/x86_64-linux-gnu/14/lto-wrapper -plugin-opt=-fresolution=/tmp/cc4PpMB5.res --build-id --eh-frame-hdr -m elf_x86_64 --hash-style=gnu --as-needed -dynamic-linker /lib64/ld-linux-x86-64.so.2 -pie -o /work/target/debug/build/generic-array-4cac162ab79b2857/build_script_build-4cac162ab79b2857 /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/Scrt1.o /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/crti.o /usr/lib/gcc/x86_64-linux-gnu/14/crtbeginS.o -L/work/target/debug/build/generic-array-4cac162ab79b2857/rustcgUTNl1/raw-dylibs -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/bin/gcc-ld -L/usr/lib/gcc/x86_64-linux-gnu/14 -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../../lib -L/lib/x86_64-linux-gnu -L/lib/../lib -L/usr/lib/x	788 ms	122 ms	0
└build_script generic-array		917 ms	9 ms	0
└rustc /usr/local/bin/rustc	--verbose --version	918 ms	7 ms	0
└build_script rustix		2.3 s	42 ms	0
└rustc /usr/local/bin/rustc ×2	--crate-type=rlib --emit=metadata --target x86_64-unknown-linux-gnu -o /work/target/debug/build/rustix-91fad39b65314a2d/out/rustix_test_can_compile -	2.3 s	18 ms	0
└build_script libc		2.3 s	9 ms	0
└rustc /usr/local/bin/rustc	--version	2.3 s	7 ms	0
└build_script crc32fast		4.3 s	9 ms	0
└rustc /usr/local/bin/rustc	--version	4.3 s	7 ms	0
└build_script litert-lm-edge-sys		7.7 s	60 ms	25856
└other /usr/bin/curl	--fail --location --silent --show-error --output /work/target/litert-lm-runtime/.download-linux-x86_64-854.tar.gz https://github.com/mdddj/litert-lm-edge-rs/releases/download/v0.2.6/litert-lm-runtime-linux-x86_64.tar.gz	7.7 s	59 ms	5632

Network 2

The VM has no internet. Every name it looks up resolves to 10.0.2.1, the fake internet, which accepts every connection and records what was sent. Below, it is shown by its port alone, such as :443. The name the build wanted is in the lookups, the HTTP host and the TLS SNI.

Looked up github.com

Destination	Protocol	What was sent	Bytes
:443	tls	SNI github.com, inside TLS: GET /mdddj/litert-lm-edge-rs/releases/download/v0.2.6/litert-lm-runtime-linux-x86_64.tar.gz, host github.com, agent curl/8.14.1	1.5 KiB

Sockets in the trace 3

When	Program	How	Address	Type
7.7 s	/usr/bin/curl	connect	unix:/var/run/nscd/socket	stream
7.7 s	/usr/bin/curl	connect	:53	datagram
7.7 s	/usr/bin/curl	connect	:443	stream

Files 0

Secrets opened

None.

Written outside the build directories

None.

Scratch disk 0

Files: 217
Directories: 65
Size: 82.6 MiB
Compiled units: 42

Nothing outside the build areas.

Output

Standard error

   Compiling version_check v0.9.5
   Compiling generic-array v0.14.7
   Compiling cfg-if v1.0.5
   Compiling typenum v1.20.1
   Compiling libc v0.2.191
   Compiling rustix v1.1.5
   Compiling crc32fast v1.5.2
   Compiling linux-raw-sys v0.12.1
   Compiling bitflags v2.13.2
   Compiling block-buffer v0.10.4
   Compiling crypto-common v0.1.7
   Compiling simd-adler32 v0.3.10
   Compiling adler2 v2.0.1
   Compiling miniz_oxide v0.9.1
   Compiling digest v0.10.7
   Compiling filetime v0.2.29
   Compiling xattr v1.6.1
   Compiling cpufeatures v0.2.17
   Compiling sha2 v0.10.9
   Compiling tar v0.4.46
   Compiling flate2 v1.1.10
   Compiling litert-lm-edge-sys v0.2.6
warning: litert-lm-edge-sys@0.2.6: fetching LiteRT-LM runtime for linux-x86_64 from https://github.com/mdddj/litert-lm-edge-rs/releases/download/v0.2.6/litert-lm-runtime-linux-x86_64.tar.gz
error: failed to run custom build command for `litert-lm-edge-sys v0.2.6`

Caused by:
  process didn't exit successfully: `/work/target/debug/build/litert-lm-edge-sys-dfbd4638f059d937/build-script-build` (exit status: 101)
  --- stdout
  cargo:rerun-if-env-changed=LITERT_LM_ROOT
  cargo:rerun-if-env-changed=LITERT_LM_LIB_DIR
  cargo:rerun-if-env-changed=LITERT_LM_LINK_LIB
  cargo:rerun-if-env-changed=LITERT_LM_LINK_KIND
  cargo:rerun-if-env-changed=LITERT_LM_RUNTIME_BASE_URL
  cargo:rerun-if-env-changed=LITERT_LM_RUNTIME_CACHE_DIR
  cargo:rerun-if-env-changed=LITERT_LM_RUNTIME_OFFLINE
  cargo:rerun-if-changed=/cw/vendor/litert-lm-edge-sys-0.2.6/runtime-checksums.txt
  cargo:warning=fetching LiteRT-LM runtime for linux-x86_64 from https://github.com/mdddj/litert-lm-edge-rs/releases/download/v0.2.6/litert-lm-runtime-linux-x86_64.tar.gz

  --- stderr

  thread 'main' (854) panicked at /cw/vendor/litert-lm-edge-sys-0.2.6/build.rs:321:23:
  failed to download the LiteRT-LM runtime from https://github.com/mdddj/litert-lm-edge-rs/releases/download/v0.2.6/litert-lm-runtime-linux-x86_64.tar.gz: curl exited with exit status: 22: curl: (22) The requested URL returned error: 404
  Install `curl`, set LITERT_LM_RUNTIME_BASE_URL to a reachable mirror, or populate vendor/linux-x86_64 from a local build
  note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace

Timeline

When	From	To	Event	Worker
2026-10-17 01:58 UTC	Discovered	Fetched	fetched	fetcher-12688
2026-10-17 01:58 UTC	Fetched	ReadyForSandbox	static_analysis_completed	static-12726
2026-10-17 01:58 UTC	ReadyForSandbox	Running	sandbox_started	orchestrator-12760-slot1
2026-10-17 01:58 UTC	Running	DynamicallyAnalyzed	sandbox_completed	orchestrator-12760-slot1
2026-10-17 01:58 UTC	DynamicallyAnalyzed	Scored	scored	analyzer-12816
2026-10-17 01:58 UTC	Scored	Done	finalized	analyzer-12816