spicedb-embedded-sys 0.8.0
high severity shell_command in build_script code: curl failed ({}). Check network and that release v{} exists with asset libspicedb-{}.tar.gz
45
medium
Automated verdict. Nobody reviewed it. A score is a reason to look closer, not a finding.
Evidence
| Points | Signal | Where | What |
|---|---|---|---|
| 30 | static:shell_command static · spicedb-embedded-sys | build.rs:270 | high severity shell_command in build_script code: curl failed ({}). Check network and that release v{} exists with asset libspicedb-{}.tar.gz |
| 10 | network_lookup network · spicedb-embedded-sys | github.com | The build looked up github.com. |
| 5 | exec_downloader trace · spicedb-embedded-sys | /usr/bin/curl | The build ran /usr/bin/curl. |
4 without points
| Signal | Where | What |
|---|---|---|
| static:build_script static · spicedb-embedded-sys | build.rs | low severity build_script in build_script code: build.rs |
| static:downloader_pattern static · spicedb-embedded-sys | build.rs:253 | high severity downloader_pattern in build_script code: https://github.com/borkfork/spicedb-embedded/releases/download/v{}/libspicedb-{}.tar.gz at build.rs:253 with std::process::Command::new at build.rs:154 |
| static:process_spawn static · spicedb-embedded-sys | build.rs:154 | medium severity process_spawn in build_script code (5 places): std::process::Command::new |
| static:url_literal static · spicedb-embedded-sys | build.rs:253 | low severity url_literal in build_script code: https://github.com/borkfork/spicedb-embedded/releases/download/v{}/libspicedb-{}.tar.gz |
Behavior
Profile
exec:downloader net:github.com static:downloader_pattern static:process_spawn static:shell_command
Static findings
7 groups
high downloader_pattern build_script 1
https://github.com/borkfork/spicedb-embedded/releases/download/v{}/libspicedb-{}.tar.gz at build.rs:253 with std::process::Command::new at build.rs:154build.rs:253
high shell_command build_script 1
curl failed ({}). Check network and that release v{} exists with asset libspicedb-{}.tar.gzbuild.rs:270
medium process_spawn build_script 5
std::process::Command::newbuild.rs:154 build.rs:257 build.rs:298 build.rs:390 build.rs:411
low build_script build_script 1
build.rsbuild.rs
low foreign_functions library 1
extern blocksrc/lib.rs:23
low url_literal build_script 1
https://github.com/borkfork/spicedb-embedded/releases/download/v{}/libspicedb-{}.tar.gzbuild.rs:253
info unsafe_code library 2
7 unsafe blocks, functions or implssrc/instance.rs:165 unsafe blocks, functions or implssrc/memory.rs:100
Run: check
failed- Ended
- agent reported the end
- Guest
- exit code 101
- Run time
- 50.9 s
- VM restore
- 84 ms
- Payload
- 5889 files, 90.6 MiB
- Files opened
- 12655
Processes 194
Siblings that ran the same program with the same result and the same processes below are folded into one row, with their number.
| Process | Arguments | Start | Took | Exit |
|---|---|---|---|---|
| cargo /usr/local/bin/cargo | check --locked --offline | 5 ms | 50.7 s | 25856 |
| └rustc /usr/local/bin/rustc ×18 | --crate-name build_script_build --edition=2021 /cw/vendor/proc-macro2-1.0.107/build.rs --error-format=json --json=diagnostic-rendered-ansi,artifacts,future-incompat --crate-type bin --emit=dep-info,link -C embed-bitcode=no --cfg feature="default" --cfg feature="proc-macro" --check-cfg cfg(docsrs,test) --check-cfg cfg(feature, values("default", "nightly", "proc-macro", "span-locations")) -C metadata=a3dc8fb24392fcd4 -C extra-filename=-a411f7480bd0f42c --out-dir /work/target/debug/build/proc-macro2-a411f7480bd0f42c -L dependency=/work/target/debug/deps --cap-lints allow | 237 ms | 677 ms | 0 |
| └toolchain /usr/bin/cc | -m64 /work/target/debug/build/proc-macro2-a411f7480bd0f42c/rustccVC23Q/symbols.o /work/target/debug/build/proc-macro2-a411f7480bd0f42c/build_script_build-a411f7480bd0f42c.build_script_build.dd8d7f624ad1d48e-cgu.0.rcgu.o /work/target/debug/build/proc-macro2-a411f7480bd0f42c/build_script_build-a411f7480bd0f42c.cnca5igddme2fkrf01fktrtaw.rcgu.o -Wl,--as-needed -Wl,-Bstatic /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libstd-64f5f36fb0927694.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libpanic_unwind-549498e8b2e4d924.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libobject-7ff85ea729a864ff.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libmemchr-0e3477fb2664a277.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libaddr2line-09755979c57b7e64.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libgimli-9a1fede77fbbf2f0.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libcfg_if-360da4ba13154744.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/lib | 767 ms | 143 ms | 0 |
| └toolchain /usr/libexec/gcc/x86_64-linux-gnu/14/collect2 | -plugin /usr/libexec/gcc/x86_64-linux-gnu/14/liblto_plugin.so -plugin-opt=/usr/libexec/gcc/x86_64-linux-gnu/14/lto-wrapper -plugin-opt=-fresolution=/tmp/cczEY60J.res --build-id --eh-frame-hdr -m elf_x86_64 --hash-style=gnu --as-needed -dynamic-linker /lib64/ld-linux-x86-64.so.2 -pie -fuse-ld=lld -o /work/target/debug/build/proc-macro2-a411f7480bd0f42c/build_script_build-a411f7480bd0f42c /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/Scrt1.o /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/crti.o /usr/lib/gcc/x86_64-linux-gnu/14/crtbeginS.o -L/work/target/debug/build/proc-macro2-a411f7480bd0f42c/rustccVC23Q/raw-dylibs -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/bin/gcc-ld -L/usr/lib/gcc/x86_64-linux-gnu/14 -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../../lib -L/lib/x86_64-linux-gnu -L/lib/../lib -L/usr/lib/x86_64-linux-gnu -L | 774 ms | 136 ms | 0 |
| └toolchain /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/bin/rust-lld | -flavor gnu -plugin /usr/libexec/gcc/x86_64-linux-gnu/14/liblto_plugin.so -plugin-opt=/usr/libexec/gcc/x86_64-linux-gnu/14/lto-wrapper -plugin-opt=-fresolution=/tmp/cczEY60J.res --build-id --eh-frame-hdr -m elf_x86_64 --hash-style=gnu --as-needed -dynamic-linker /lib64/ld-linux-x86-64.so.2 -pie -o /work/target/debug/build/proc-macro2-a411f7480bd0f42c/build_script_build-a411f7480bd0f42c /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/Scrt1.o /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/crti.o /usr/lib/gcc/x86_64-linux-gnu/14/crtbeginS.o -L/work/target/debug/build/proc-macro2-a411f7480bd0f42c/rustccVC23Q/raw-dylibs -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/bin/gcc-ld -L/usr/lib/gcc/x86_64-linux-gnu/14 -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../../lib -L/lib/x86_64-linux-gnu -L/lib/../lib -L/usr/lib/x86_6 | 777 ms | 131 ms | 0 |
| └build_script proc-macro2 | 918 ms | 85 ms | 0 | |
| └rustc /usr/local/bin/rustc ×3 | --version | 919 ms | 8 ms | 0 |
| └rustc /usr/local/bin/rustc | --cfg=procmacro2_build_probe --edition=2021 --crate-name=proc_macro2 --crate-type=lib --cap-lints=allow --emit=dep-info,metadata --out-dir /work/target/debug/build/proc-macro2-4f3f927bd5485a92/out/probe src/probe/proc_macro_span.rs --target x86_64-unknown-linux-gnu | 928 ms | 34 ms | 256 |
| └rustc /usr/local/bin/rustc ×93 | --crate-name unicode_ident --edition=2021 /cw/vendor/unicode-ident-1.0.27/src/lib.rs --error-format=json --json=diagnostic-rendered-ansi,artifacts,future-incompat --crate-type lib --emit=dep-info,metadata,link -C embed-bitcode=no --check-cfg cfg(docsrs,test) --check-cfg cfg(feature, values()) -C metadata=3bb98f7b2f589c61 -C extra-filename=-86dff03eb05ec8a5 --out-dir /work/target/debug/deps -L dependency=/work/target/debug/deps --cap-lints allow | 1.1 s | 49 ms | 0 |
| └build_script quote | 1.6 s | 10 ms | 0 | |
| └rustc /usr/local/bin/rustc | --version | 1.6 s | 7 ms | 0 |
| └build_script libc | 6.4 s | 10 ms | 0 | |
| └rustc /usr/local/bin/rustc | --version | 6.4 s | 8 ms | 0 |
| └build_script anyhow | 10.5 s | 35 ms | 0 | |
| └rustc /usr/local/bin/rustc | --cfg=anyhow_build_probe --edition=2018 --crate-name=anyhow --crate-type=lib --cap-lints=allow --emit=dep-info,metadata --out-dir /work/target/debug/build/anyhow-53d53971fb3aec2e/out/probe src/nightly.rs --target x86_64-unknown-linux-gnu | 10.5 s | 24 ms | 256 |
| └rustc /usr/local/bin/rustc | --version | 10.5 s | 7 ms | 0 |
| └build_script libc | 19.9 s | 9 ms | 0 | |
| └rustc /usr/local/bin/rustc | --version | 19.9 s | 7 ms | 0 |
| └build_script rustix | 21.6 s | 33 ms | 0 | |
| └rustc /usr/local/bin/rustc ×2 | --crate-type=rlib --emit=metadata --target x86_64-unknown-linux-gnu -o /work/target/debug/build/rustix-0f4e2900de2476d1/out/rustix_test_can_compile - | 21.6 s | 15 ms | 0 |
| └build_script prettyplease | 21.6 s | 1 ms | 0 | |
| └build_script httparse | 21.6 s | 8 ms | 0 | |
| └rustc /usr/local/bin/rustc | --version | 21.6 s | 6 ms | 0 |
| └build_script getrandom | 21.6 s | 1 ms | 0 | |
| └build_script pulldown-cmark | 21.6 s | 1 ms | 0 | |
| └build_script serde_core | 35.1 s | 9 ms | 0 | |
| └rustc /usr/local/bin/rustc | --version | 35.1 s | 6 ms | 0 |
| └build_script spicedb-grpc-tonic | 49.8 s | 1 ms | 0 | |
| └build_script spicedb-embedded-sys | 50.7 s | 59 ms | 25856 | |
| └unknown | 50.7 s | 0 ms | 32512 | |
| └other /usr/bin/curl | -L -f -s -o /work/target/debug/build/spicedb-embedded-sys-9bb82033b4f171b8/out/libspicedb.tar.gz https://github.com/borkfork/spicedb-embedded/releases/download/v0.8.0/libspicedb-linux-x64.tar.gz | 50.7 s | 57 ms | 5632 |
Network 2
The VM has no internet. Every name it looks up resolves to 10.0.2.1, the fake internet, which accepts every connection and records what was sent. Below, it is shown by its port alone, such as :443. The name the build wanted is in the lookups, the HTTP host and the TLS SNI.
Looked up github.com
| Destination | Protocol | What was sent | Bytes |
|---|---|---|---|
| :443 | tls | SNI github.com, inside TLS: GET /borkfork/spicedb-embedded/releases/download/v0.8.0/libspicedb-linux-x64.tar.gz, host github.com, agent curl/8.14.1 | 1.5 KiB |
Sockets in the trace 3
| When | Program | How | Address | Type |
|---|---|---|---|---|
| 50.7 s | /usr/bin/curl | connect | unix:/var/run/nscd/socket | stream |
| 50.7 s | /usr/bin/curl | connect | :53 | datagram |
| 50.7 s | /usr/bin/curl | connect | :443 | stream |
Files 0
Secrets opened
None.
Written outside the build directories
None.
Scratch disk 0
- Files
- 806
- Directories
- 182
- Size
- 335.7 MiB
- Compiled units
- 141
Nothing outside the build areas.
Output
Standard error
Compiling proc-macro2 v1.0.107
Compiling quote v1.0.47
Compiling unicode-ident v1.0.27
Compiling syn v2.0.119
Checking pin-project-lite v0.2.17
Compiling libc v0.2.191
Compiling syn v3.0.9
Compiling anyhow v1.0.104
Compiling tokio-macros v2.7.2
Checking mio v1.2.4
Checking socket2 v0.6.5
Checking itoa v1.0.18
Compiling either v1.19.0
Compiling itertools v0.14.0
Checking http v1.5.0
Checking tokio v1.53.3
Checking once_cell v1.21.4
Checking tracing-core v0.1.36
Compiling prost-derive v0.14.4
Compiling tracing-attributes v0.1.31
Checking futures-sink v0.3.34
Checking equivalent v1.0.3
Checking hashbrown v0.17.1
Checking slab v0.4.12
Checking indexmap v2.14.2
Checking tokio-util v0.7.20
Checking tracing v0.1.44
Checking http-body v1.1.0
Compiling bitflags v2.13.2
Compiling pulldown-cmark v0.13.4
Compiling getrandom v0.4.3
Compiling httparse v1.10.1
Compiling prettyplease v0.2.37
Compiling rustix v1.1.5
Checking futures-task v0.3.34
Checking tower-service v0.3.3
Checking futures-util v0.3.34
Compiling linux-raw-sys v0.12.1
Compiling unicase v2.10.0
Checking fnv v1.0.7
Compiling memchr v2.8.3
Compiling cfg-if v1.0.5
Checking try-lock v0.2.5
Checking atomic-waker v1.1.2
Compiling bytes v1.12.1
Compiling regex-syntax v0.8.11
Compiling foldhash v0.1.5
Compiling hashbrown v0.15.5
Compiling regex-automata v0.4.18
Compiling prost v0.14.4
Checking h2 v0.4.20
Checking want v0.3.2
Checking futures-channel v0.3.34
Compiling fastrand v2.5.0
Compiling fixedbitset v0.5.7
Checking sync_wrapper v1.0.2
Checking httpdate v1.0.3
Checking tower-layer v0.3.3
Compiling serde_core v1.0.229
Checking smallvec v1.16.3
Checking hyper v1.12.0
Compiling tempfile v3.27.0
Compiling petgraph v0.8.3
Compiling pulldown-cmark-to-cmark v22.0.3
Compiling prost-types v0.14.4
Compiling regex v1.13.1
Checking http-body-util v0.1.5
Compiling multimap v0.10.1
Compiling heck v0.5.0
Compiling log v0.4.34
Checking mime v0.3.17
Checking axum-core v0.5.6
Compiling prost-build v0.14.4
Checking hyper-util v0.1.21
Checking tower v0.5.3
Compiling tonic-build v0.14.6
Compiling pin-project-internal v1.1.13
Checking percent-encoding v2.3.2
Compiling same-file v1.0.6
Checking matchit v0.8.4
Checking axum v0.8.9
Compiling walkdir v2.5.0
Checking pin-project v1.1.13
Compiling tonic-prost-build v0.14.6
Checking hyper-timeout v0.5.2
Checking tokio-stream v0.1.19
Compiling async-trait v0.1.92
Checking base64 v0.22.1
Checking tonic v0.14.6
Compiling spicedb-grpc-tonic v1.0.0
Checking tonic-prost v0.14.6
Compiling spicedb-embedded-sys v0.8.0
warning: spicedb-embedded-sys@0.8.0: spicedb-embedded-sys: go build failed to run: No such file or directory (os error 2)
error: failed to run custom build command for `spicedb-embedded-sys v0.8.0`
Caused by:
process didn't exit successfully: `/work/target/debug/build/spicedb-embedded-sys-ff8ff51651503787/build-script-build` (exit status: 101)
--- stdout
cargo:rerun-if-env-changed=DOCS_RS
cargo:warning=spicedb-embedded-sys: go build failed to run: No such file or directory (os error 2)
--- stderr
thread 'main' (1610) panicked at /cw/vendor/spicedb-embedded-sys-0.8.0/build.rs:269:9:
curl failed (exit status: 22). Check network and that release v0.8.0 exists with asset libspicedb-linux-x64.tar.gz
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace
Timeline
6
| When | From | To | Event | Worker |
|---|---|---|---|---|
| 2026-10-17 23:19 UTC | Discovered | Fetched | fetched | fetcher-12688 |
| 2026-10-17 23:19 UTC | Fetched | ReadyForSandbox | static_analysis_completed | static-12726 |
| 2026-10-17 23:20 UTC | ReadyForSandbox | Running | sandbox_started | orchestrator-12760-slot1 |
| 2026-10-17 23:21 UTC | Running | DynamicallyAnalyzed | sandbox_completed | orchestrator-12760-slot1 |
| 2026-10-17 23:21 UTC | DynamicallyAnalyzed | Scored | scored | analyzer-12816 |
| 2026-10-17 23:21 UTC | Scored | Done | finalized | analyzer-12816 |