tickloop 0.2.6

Done dynamic on Linux job 190330 crates.io SBOM Findings (VEX)

high severity downloader_pattern in build_script code: https://github.com/tickloopai/homebrew-tap/releases/download at build.rs:6 with std::process::Command::new at build.rs:65

high

False positive. A person reviewed this verdict and found the crate benign. The evidence below is what the analysis saw.

Evidence

Points	Signal	Where	What
30	static:downloader_pattern static · tickloop	build.rs:6	high severity downloader_pattern in build_script code: https://github.com/tickloopai/homebrew-tap/releases/download at build.rs:6 with std::process::Command::new at build.rs:65
10	build_script_added diff · tickloop		A build script was added since 0.2.5.
10	new_high_finding diff · tickloop	build.rs:6	New since 0.2.5: downloader_pattern

3 without points

Signal	Where	What
static:build_script static · tickloop	build.rs	low severity build_script in build_script code: build.rs
static:process_spawn static · tickloop	build.rs:65	medium severity process_spawn in build_script code (12 places): std::process::Command::new
static:url_literal static · tickloop	build.rs:6	low severity url_literal in build_script code: https://github.com/tickloopai/homebrew-tap/releases/download

Behavior

New since the previous version

static:downloader_pattern static:process_spawn

Profile

static:downloader_pattern static:process_spawn

Static findings

high downloader_pattern build_script 1

https://github.com/tickloopai/homebrew-tap/releases/download at build.rs:6 with std::process::Command::new at build.rs:65 build.rs:6

medium process_spawn build_script 1

std::process::Command::new build.rs:65

low process_spawn library 11

std::process::Command::new bundle.rs:19 bundle.rs:30 bundle.rs:36 bundle.rs:40 src/lib.rs:87 src/lib.rs:149 src/lib.rs:189 src/lib.rs:193 src/lib.rs:317 src/lib.rs:329
std::process::Command bundle.rs:54

low build_script build_script 1

build.rs build.rs

low foreign_functions library 1

extern block src/lib.rs:36

low url_literal build_script 1

https://github.com/tickloopai/homebrew-tap/releases/download build.rs:6

info unsafe_code library 1

1 unsafe blocks, functions or impls src/lib.rs:99

Run: full

failed

The full build covers everything the earlier cargo check run did, so only the full run is shown.

Ended: agent reported the end
Guest: exit code 101
Run time: 909 ms
VM restore: 71 ms
Payload: 18 files, 23.7 KiB
Files opened: 213

Processes 6

Siblings that ran the same program with the same result and the same processes below are folded into one row, with their number. Hide the 4 compiler processes (rustc, C toolchain)

Process	Arguments	Start	Took	Exit
cargo /usr/local/bin/cargo	build --locked --offline	5 ms	893 ms	25856
└rustc /usr/local/bin/rustc	--crate-name build_script_build --edition=2024 /cw/vendor/tickloop-0.2.6/build.rs --error-format=json --json=diagnostic-rendered-ansi,artifacts,future-incompat --crate-type bin --emit=dep-info,link -C embed-bitcode=no --check-cfg cfg(docsrs,test) --check-cfg cfg(feature, values()) -C metadata=74a99fedf35875b0 -C extra-filename=-298c4a42d128b909 --out-dir /work/target/debug/build/tickloop-298c4a42d128b909 -L dependency=/work/target/debug/deps --cap-lints allow	126 ms	765 ms	0
└toolchain /usr/bin/cc	-m64 /work/target/debug/build/tickloop-298c4a42d128b909/rustcni22bm/symbols.o /work/target/debug/build/tickloop-298c4a42d128b909/build_script_build-298c4a42d128b909.build_script_build.2ec9b3ef6941c853-cgu.0.rcgu.o /work/target/debug/build/tickloop-298c4a42d128b909/build_script_build-298c4a42d128b909.build_script_build.2ec9b3ef6941c853-cgu.1.rcgu.o /work/target/debug/build/tickloop-298c4a42d128b909/build_script_build-298c4a42d128b909.9qxjt8fjeglmwxj3ii61rhcbd.rcgu.o -Wl,--as-needed -Wl,-Bstatic /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libstd-64f5f36fb0927694.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libpanic_unwind-549498e8b2e4d924.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libobject-7ff85ea729a864ff.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libmemchr-0e3477fb2664a277.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libaddr2line-09755979c57b7e64.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libgimli-9a1fede77fbbf2f0.rlib /usr/local/l	746 ms	141 ms	0
└toolchain /usr/libexec/gcc/x86_64-linux-gnu/14/collect2	-plugin /usr/libexec/gcc/x86_64-linux-gnu/14/liblto_plugin.so -plugin-opt=/usr/libexec/gcc/x86_64-linux-gnu/14/lto-wrapper -plugin-opt=-fresolution=/tmp/ccrdcQN0.res --build-id --eh-frame-hdr -m elf_x86_64 --hash-style=gnu --as-needed -dynamic-linker /lib64/ld-linux-x86-64.so.2 -pie -fuse-ld=lld -o /work/target/debug/build/tickloop-298c4a42d128b909/build_script_build-298c4a42d128b909 /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/Scrt1.o /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/crti.o /usr/lib/gcc/x86_64-linux-gnu/14/crtbeginS.o -L/work/target/debug/build/tickloop-298c4a42d128b909/rustcni22bm/raw-dylibs -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/bin/gcc-ld -L/usr/lib/gcc/x86_64-linux-gnu/14 -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../../lib -L/lib/x86_64-linux-gnu -L/lib/../lib -L/usr/lib/x86_64-linux-gnu -L/usr/l	753 ms	134 ms	0
└toolchain /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/bin/rust-lld	-flavor gnu -plugin /usr/libexec/gcc/x86_64-linux-gnu/14/liblto_plugin.so -plugin-opt=/usr/libexec/gcc/x86_64-linux-gnu/14/lto-wrapper -plugin-opt=-fresolution=/tmp/ccrdcQN0.res --build-id --eh-frame-hdr -m elf_x86_64 --hash-style=gnu --as-needed -dynamic-linker /lib64/ld-linux-x86-64.so.2 -pie -o /work/target/debug/build/tickloop-298c4a42d128b909/build_script_build-298c4a42d128b909 /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/Scrt1.o /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/crti.o /usr/lib/gcc/x86_64-linux-gnu/14/crtbeginS.o -L/work/target/debug/build/tickloop-298c4a42d128b909/rustcni22bm/raw-dylibs -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/bin/gcc-ld -L/usr/lib/gcc/x86_64-linux-gnu/14 -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../../lib -L/lib/x86_64-linux-gnu -L/lib/../lib -L/usr/lib/x86_64-linu	755 ms	131 ms	0
└build_script tickloop		895 ms	1 ms	25856

Network 0

No network activity.

Files 0

Secrets opened

None.

Written outside the build directories

None.

Scratch disk 0

Files: 19
Directories: 22
Size: 9.1 MiB
Compiled units: 0

Nothing outside the build areas.

Output

Standard error

   Compiling tickloop v0.2.6
error: failed to run custom build command for `tickloop v0.2.6`

Caused by:
  process didn't exit successfully: `/work/target/debug/build/tickloop-298c4a42d128b909/build-script-build` (exit status: 101)
  --- stdout
  cargo:rerun-if-changed=build.rs
  cargo:rerun-if-changed=bundle.rs
  cargo:rerun-if-changed=Cargo.toml

  --- stderr

  thread 'main' (592) panicked at /cw/vendor/tickloop-0.2.6/build.rs:17:9:
  Cannot prepare the complete Tickloop installation: Tickloop supports macOS Apple Silicon and Intel only.
  note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace

Timeline

When	From	To	Event	Worker
2026-10-17 17:20 UTC	Discovered	Fetched	fetched	fetcher-12688
2026-10-17 17:20 UTC	Fetched	ReadyForSandbox	static_analysis_completed	static-12726
2026-10-17 17:20 UTC	ReadyForSandbox	Running	sandbox_started	orchestrator-12760-slot0
2026-10-17 17:20 UTC	Running	DynamicallyAnalyzed	sandbox_completed	orchestrator-12760-slot0
2026-10-17 17:20 UTC	DynamicallyAnalyzed	ReadyForSandbox	scored	analyzer-12816
2026-10-17 17:20 UTC	ReadyForSandbox	Running	sandbox_started	orchestrator-12760-slot0
2026-10-17 17:20 UTC	Running	DynamicallyAnalyzed	sandbox_completed	orchestrator-12760-slot0
2026-10-17 17:20 UTC	DynamicallyAnalyzed	Scored	scored	analyzer-12816
2026-10-17 17:20 UTC	Scored	Done	finalized	analyzer-12816