deformable 0.1.0

Done dynamic on Linux job 195196 crates.io SBOM Findings (VEX)

high severity shell_command in build_script code: curl ended with {}

medium

Automated verdict. Nobody reviewed it. A score is a reason to look closer, not a finding.

Evidence

Points	Signal	Where	What
30	static:shell_command static · deformable	build/download.rs:57	high severity shell_command in build_script code: curl ended with {}
10	network_lookup network · deformable	downloads.tangerina.io	The build looked up downloads.tangerina.io.
5	exec_downloader trace · deformable	/usr/bin/curl	The build ran /usr/bin/curl.

4 without points

Signal	Where	What
static:build_script static · deformable	build.rs	low severity build_script in build_script code: build.rs
static:downloader_pattern static · deformable	build.rs:19	high severity downloader_pattern in build_script code: https://downloads.tangerina.io at build.rs:19 with std::process::Command::new at build/download.rs:32
static:process_spawn static · deformable	build/download.rs:32	medium severity process_spawn in build_script code: std::process::Command::new
static:url_literal static · deformable	build.rs:19	low severity url_literal in build_script code (5 places): https://downloads.tangerina.io

Behavior

Profile

exec:downloader net:downloads.tangerina.io static:downloader_pattern static:process_spawn static:shell_command

Static findings

high downloader_pattern build_script 1

https://downloads.tangerina.io at build.rs:19 with std::process::Command::new at build/download.rs:32 build.rs:19

high shell_command build_script 1

curl ended with {} build/download.rs:57

medium process_spawn build_script 1

std::process::Command::new build/download.rs:32

low url_literal build_script 4

https://downloads.tangerina.io build.rs:19
To build without a download, unzip the C SDK for your platform from https://tangerina.io/deformable#download-c and set DEFORMABLE_LIB_DIR to the absolute path of its lib folder. build.rs:26
file://{path} build/download.rs:109
file:///{path} build/download.rs:111

low build_script build_script 1

build.rs build.rs

low foreign_functions library 1

extern block src/native/functions.rs:26

info unsafe_code library 28

6 unsafe blocks, functions or impls src/cancel_flag.rs:29
2 unsafe blocks, functions or impls src/error.rs:272 src/simulation/output.rs:30 src/tools/extrude.rs:61 src/tools/layer_span.rs:22
1 unsafe blocks, functions or impls src/lib.rs:121 src/mesh/face_table.rs:17 src/mesh/polygon_mesh.rs:81 src/simulation/glue_pairing.rs:40 src/tools/anisotropy.rs:22 src/tools/mesh_intersection.rs:17 src/tools/mesh_verification/mesh_checks.rs:76 src/tools/surface_mesh.rs:114
5 unsafe blocks, functions or impls src/license.rs:119 src/ownership.rs:39 src/simulation/material_parameters.rs:40 src/tools/mesh_verification.rs:30 src/tools/splinter_image.rs:43 src/tools/triangulate.rs:34
4 unsafe blocks, functions or impls src/mesh/boundary_faces.rs:15 src/mesh/tetrahedral_mesh.rs:62 src/simulation/materials.rs:74 src/tools/tetrahedralize.rs:76 src/tools/triangle_surface.rs:33
27 unsafe blocks, functions or impls src/simulation.rs:62
21 unsafe blocks, functions or impls src/simulation/embedding.rs:27
3 unsafe blocks, functions or impls src/tools/autocage.rs:30 src/tools/mesh_verification/mesh_issue.rs:183

info native_link build_script 1

links = "deformable" Cargo.toml

info url_literal library 1

the linked libdeformable is version {library_version}, but the deformable crate {crate_version} needs the library of version {crate_version}: ship the one the crate's build linked (or the C SDK's of t… src/native/compatibility.rs:27

Run: check

failed

Ended: agent reported the end
Guest: exit code 101
Run time: 1.0 s
VM restore: 86 ms
Payload: 63 files, 230.6 KiB
Files opened: 277

Processes 7

Siblings that ran the same program with the same result and the same processes below are folded into one row, with their number. Hide the 4 compiler processes (rustc, C toolchain)

Process	Arguments	Start	Took	Exit
cargo /usr/local/bin/cargo	check --locked --offline	5 ms	990 ms	25856
└rustc /usr/local/bin/rustc	--crate-name build_script_build --edition=2024 /cw/vendor/deformable-0.1.0/build.rs --error-format=json --json=diagnostic-rendered-ansi,artifacts,future-incompat --crate-type bin --emit=dep-info,link -C embed-bitcode=no --deny=unsafe_op_in_unsafe_fn --warn=unreachable_pub --warn=clippy::undocumented_unsafe_blocks --warn=missing_docs --check-cfg cfg(docsrs,test) --check-cfg cfg(feature, values()) -C metadata=bda6e8f2cf42b83b -C extra-filename=-0040fdcef8f5e20e --out-dir /work/target/debug/build/deformable-0040fdcef8f5e20e -L dependency=/work/target/debug/deps --cap-lints allow	110 ms	817 ms	0
└toolchain /usr/bin/cc	-m64 /work/target/debug/build/deformable-0040fdcef8f5e20e/rustcnMN1g2/symbols.o /work/target/debug/build/deformable-0040fdcef8f5e20e/build_script_build-0040fdcef8f5e20e.build_script_build.9b8133eb9faf874b-cgu.0.rcgu.o /work/target/debug/build/deformable-0040fdcef8f5e20e/build_script_build-0040fdcef8f5e20e.build_script_build.9b8133eb9faf874b-cgu.1.rcgu.o /work/target/debug/build/deformable-0040fdcef8f5e20e/build_script_build-0040fdcef8f5e20e.build_script_build.9b8133eb9faf874b-cgu.2.rcgu.o /work/target/debug/build/deformable-0040fdcef8f5e20e/build_script_build-0040fdcef8f5e20e.build_script_build.9b8133eb9faf874b-cgu.3.rcgu.o /work/target/debug/build/deformable-0040fdcef8f5e20e/build_script_build-0040fdcef8f5e20e.a29ty8ml6c8ccx4myicfbdgty.rcgu.o -Wl,--as-needed -Wl,-Bstatic /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libstd-64f5f36fb0927694.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libpanic_unwind-549498e8b2e4d924.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libobject-7ff8	782 ms	141 ms	0
└toolchain /usr/libexec/gcc/x86_64-linux-gnu/14/collect2	-plugin /usr/libexec/gcc/x86_64-linux-gnu/14/liblto_plugin.so -plugin-opt=/usr/libexec/gcc/x86_64-linux-gnu/14/lto-wrapper -plugin-opt=-fresolution=/tmp/ccMEZKxl.res --build-id --eh-frame-hdr -m elf_x86_64 --hash-style=gnu --as-needed -dynamic-linker /lib64/ld-linux-x86-64.so.2 -pie -fuse-ld=lld -o /work/target/debug/build/deformable-0040fdcef8f5e20e/build_script_build-0040fdcef8f5e20e /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/Scrt1.o /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/crti.o /usr/lib/gcc/x86_64-linux-gnu/14/crtbeginS.o -L/work/target/debug/build/deformable-0040fdcef8f5e20e/rustcnMN1g2/raw-dylibs -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/bin/gcc-ld -L/usr/lib/gcc/x86_64-linux-gnu/14 -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../../lib -L/lib/x86_64-linux-gnu -L/lib/../lib -L/usr/lib/x86_64-linux-gnu -L/u	791 ms	132 ms	0
└toolchain /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/bin/rust-lld	-flavor gnu -plugin /usr/libexec/gcc/x86_64-linux-gnu/14/liblto_plugin.so -plugin-opt=/usr/libexec/gcc/x86_64-linux-gnu/14/lto-wrapper -plugin-opt=-fresolution=/tmp/ccMEZKxl.res --build-id --eh-frame-hdr -m elf_x86_64 --hash-style=gnu --as-needed -dynamic-linker /lib64/ld-linux-x86-64.so.2 -pie -o /work/target/debug/build/deformable-0040fdcef8f5e20e/build_script_build-0040fdcef8f5e20e /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/Scrt1.o /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/crti.o /usr/lib/gcc/x86_64-linux-gnu/14/crtbeginS.o -L/work/target/debug/build/deformable-0040fdcef8f5e20e/rustcnMN1g2/raw-dylibs -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/bin/gcc-ld -L/usr/lib/gcc/x86_64-linux-gnu/14 -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../../lib -L/lib/x86_64-linux-gnu -L/lib/../lib -L/usr/lib/x86_64-	794 ms	128 ms	0
└build_script deformable		931 ms	62 ms	256
└other /usr/bin/curl	--fail --location --silent --show-error --output /work/target/debug/build/deformable-8b89f53b38ff22ee/out/library/libdeformable.so.partial https://downloads.tangerina.io/deformable/0.1.0/linux-x64/libdeformable.so	932 ms	60 ms	5632

Network 2

The VM has no internet. Every name it looks up resolves to 10.0.2.1, the fake internet, which accepts every connection and records what was sent. Below, it is shown by its port alone, such as :443. The name the build wanted is in the lookups, the HTTP host and the TLS SNI.

Looked up downloads.tangerina.io

Destination	Protocol	What was sent	Bytes
:443	tls	SNI downloads.tangerina.io, inside TLS: GET /deformable/0.1.0/linux-x64/libdeformable.so, host downloads.tangerina.io, agent curl/8.14.1	1.5 KiB

Sockets in the trace 3

When	Program	How	Address	Type
970 ms	/usr/bin/curl	connect	unix:/var/run/nscd/socket	stream
971 ms	/usr/bin/curl	connect	:53	datagram
972 ms	/usr/bin/curl	connect	:443	stream

Files 0

Secrets opened

None.

Written outside the build directories

None.

Scratch disk 0

Files: 18
Directories: 23
Size: 9.2 MiB
Compiled units: 0

Nothing outside the build areas.

Output

Standard error

   Compiling deformable v0.1.0
error: failed to run custom build command for `deformable v0.1.0`

Caused by:
  process didn't exit successfully: `/work/target/debug/build/deformable-0040fdcef8f5e20e/build-script-build` (exit status: 1)
  --- stdout
  cargo:rerun-if-env-changed=DOCS_RS
  cargo:rerun-if-env-changed=DEFORMABLE_LIB_DIR
  cargo:rerun-if-env-changed=DEFORMABLE_DOWNLOAD_URL

  --- stderr
  error: downloading libdeformable from https://downloads.tangerina.io/deformable/0.1.0/linux-x64/libdeformable.so failed: curl: (22) The requested URL returned error: 404. To build without a download, unzip the C SDK for your platform from https://tangerina.io/deformable#download-c and set DEFORMABLE_LIB_DIR to the absolute path of its lib folder.

Timeline

When	From	To	Event	Worker
2026-10-18 08:14 UTC	Discovered	Fetched	fetched	fetcher-12688
2026-10-18 08:14 UTC	Fetched	ReadyForSandbox	static_analysis_completed	static-12726
2026-10-18 08:16 UTC	ReadyForSandbox	Running	sandbox_started	orchestrator-12760-slot0
2026-10-18 08:16 UTC	Running	DynamicallyAnalyzed	sandbox_completed	orchestrator-12760-slot0
2026-10-18 08:16 UTC	DynamicallyAnalyzed	Scored	scored	analyzer-12816
2026-10-18 08:16 UTC	Scored	Done	finalized	analyzer-12816