utoipa-swagger-ui 10.0.2

Done dynamic on Linux job 218227 crates.io SBOM Findings (VEX)

high severity shell_command in build_script code: curl download file exited with error status: {status}

medium

Automated verdict. Nobody reviewed it. A score is a reason to look closer, not a finding.

Evidence

Points	Signal	Where	What
30	static:shell_command static · utoipa-swagger-ui	build.rs:493	high severity shell_command in build_script code: curl download file exited with error status: {status}
10	network_lookup network · utoipa-swagger-ui	github.com	The build looked up github.com.
5	exec_downloader trace · utoipa-swagger-ui	/usr/bin/curl	The build ran /usr/bin/curl.

5 without points

Signal	Where	What
static:build_script static · utoipa-swagger-ui	build.rs	low severity build_script in build_script code: build.rs
static:downloader_pattern static · utoipa-swagger-ui	build.rs:23	high severity downloader_pattern in build_script code: https://github.com/swagger-api/swagger-ui/archive/refs/tags/v5.32.6.zip at build.rs:23 with std::process::Command::new at build.rs:482
static:network_access static · utoipa-swagger-ui	build.rs:419	medium severity network_access in build_script code (3 places): reqwest::blocking::Client::builder
static:process_spawn static · utoipa-swagger-ui	build.rs:482	medium severity process_spawn in build_script code: std::process::Command::new
static:url_literal static · utoipa-swagger-ui	build.rs:23	low severity url_literal in build_script code (6 places): https://github.com/swagger-api/swagger-ui/archive/refs/tags/v5.32.6.zip

Behavior

Profile

exec:downloader net:github.com static:downloader_pattern static:network_access static:process_spawn static:shell_command

Static findings

high downloader_pattern build_script 1

https://github.com/swagger-api/swagger-ui/archive/refs/tags/v5.32.6.zip at build.rs:23 with std::process::Command::new at build.rs:482 build.rs:23

high shell_command build_script 1

curl download file exited with error status: {status} build.rs:493

medium network_access build_script 3

reqwest::blocking::Client::builder build.rs:419
reqwest::Certificate build.rs:439
reqwest::Certificate::from_pem build.rs:443

medium process_spawn build_script 1

std::process::Command::new build.rs:482

low url_literal build_script 4

https://github.com/swagger-api/swagger-ui/archive/refs/tags/v5.32.6.zip build.rs:23
http:// build.rs:206
https:// build.rs:206
`vendored` feature not enabled and invalid {SWAGGER_UI_DOWNLOAD_URL}: {url} -> must start with http:// | https:// | file: build.rs:241

low build_script build_script 1

build.rs build.rs

info url_literal library 2

http://auth src/lib.rs:1749
\u{a}window.ui = SwaggerUIBundle({\u{a} "dom_id": "#another-el",\u{a} "url": "/api-docs/openapi1.json",\u{a} "queryConfigEnabled": true,\u{a} "deepLinking": false,\u{a} "displayOperationId": tr… src/lib.rs:1766

Run: check

failed

Ended: agent reported the end
Guest: exit code 101
Run time: 43.4 s
VM restore: 74 ms
Payload: 2882 files, 35.2 MiB
Files opened: 9162

Processes 149

Siblings that ran the same program with the same result and the same processes below are folded into one row, with their number. Hide the 136 compiler processes (rustc, C toolchain)

Process	Arguments	Start	Took	Exit
cargo /usr/local/bin/cargo	check --locked --offline	5 ms	43.3 s	25856
└rustc /usr/local/bin/rustc ×17	--crate-name build_script_build --edition=2021 /cw/vendor/proc-macro2-1.0.107/build.rs --error-format=json --json=diagnostic-rendered-ansi,artifacts,future-incompat --crate-type bin --emit=dep-info,link -C embed-bitcode=no --cfg feature="default" --cfg feature="proc-macro" --check-cfg cfg(docsrs,test) --check-cfg cfg(feature, values("default", "nightly", "proc-macro", "span-locations")) -C metadata=a3dc8fb24392fcd4 -C extra-filename=-a411f7480bd0f42c --out-dir /work/target/debug/build/proc-macro2-a411f7480bd0f42c -L dependency=/work/target/debug/deps --cap-lints allow	182 ms	646 ms	0
└toolchain /usr/bin/cc	-m64 /work/target/debug/build/proc-macro2-a411f7480bd0f42c/rustcIezSao/symbols.o /work/target/debug/build/proc-macro2-a411f7480bd0f42c/build_script_build-a411f7480bd0f42c.build_script_build.dd8d7f624ad1d48e-cgu.0.rcgu.o /work/target/debug/build/proc-macro2-a411f7480bd0f42c/build_script_build-a411f7480bd0f42c.cnca5igddme2fkrf01fktrtaw.rcgu.o -Wl,--as-needed -Wl,-Bstatic /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libstd-64f5f36fb0927694.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libpanic_unwind-549498e8b2e4d924.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libobject-7ff85ea729a864ff.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libmemchr-0e3477fb2664a277.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libaddr2line-09755979c57b7e64.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libgimli-9a1fede77fbbf2f0.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libcfg_if-360da4ba13154744.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/lib	680 ms	144 ms	0
└toolchain /usr/libexec/gcc/x86_64-linux-gnu/14/collect2	-plugin /usr/libexec/gcc/x86_64-linux-gnu/14/liblto_plugin.so -plugin-opt=/usr/libexec/gcc/x86_64-linux-gnu/14/lto-wrapper -plugin-opt=-fresolution=/tmp/cckt53CO.res --build-id --eh-frame-hdr -m elf_x86_64 --hash-style=gnu --as-needed -dynamic-linker /lib64/ld-linux-x86-64.so.2 -pie -fuse-ld=lld -o /work/target/debug/build/proc-macro2-a411f7480bd0f42c/build_script_build-a411f7480bd0f42c /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/Scrt1.o /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/crti.o /usr/lib/gcc/x86_64-linux-gnu/14/crtbeginS.o -L/work/target/debug/build/proc-macro2-a411f7480bd0f42c/rustcIezSao/raw-dylibs -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/bin/gcc-ld -L/usr/lib/gcc/x86_64-linux-gnu/14 -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../../lib -L/lib/x86_64-linux-gnu -L/lib/../lib -L/usr/lib/x86_64-linux-gnu -L	687 ms	137 ms	0
└toolchain /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/bin/rust-lld	-flavor gnu -plugin /usr/libexec/gcc/x86_64-linux-gnu/14/liblto_plugin.so -plugin-opt=/usr/libexec/gcc/x86_64-linux-gnu/14/lto-wrapper -plugin-opt=-fresolution=/tmp/cckt53CO.res --build-id --eh-frame-hdr -m elf_x86_64 --hash-style=gnu --as-needed -dynamic-linker /lib64/ld-linux-x86-64.so.2 -pie -o /work/target/debug/build/proc-macro2-a411f7480bd0f42c/build_script_build-a411f7480bd0f42c /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/Scrt1.o /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/crti.o /usr/lib/gcc/x86_64-linux-gnu/14/crtbeginS.o -L/work/target/debug/build/proc-macro2-a411f7480bd0f42c/rustcIezSao/raw-dylibs -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/bin/gcc-ld -L/usr/lib/gcc/x86_64-linux-gnu/14 -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../../lib -L/lib/x86_64-linux-gnu -L/lib/../lib -L/usr/lib/x86_6	689 ms	134 ms	0
└build_script proc-macro2		832 ms	80 ms	0
└rustc /usr/local/bin/rustc ×3	--version	833 ms	7 ms	0
└rustc /usr/local/bin/rustc	--cfg=procmacro2_build_probe --edition=2021 --crate-name=proc_macro2 --crate-type=lib --cap-lints=allow --emit=dep-info,metadata --out-dir /work/target/debug/build/proc-macro2-4f3f927bd5485a92/out/probe src/probe/proc_macro_span.rs --target x86_64-unknown-linux-gnu	841 ms	33 ms	256
└rustc /usr/local/bin/rustc ×59	--crate-name unicode_ident --edition=2021 /cw/vendor/unicode-ident-1.0.27/src/lib.rs --error-format=json --json=diagnostic-rendered-ansi,artifacts,future-incompat --crate-type lib --emit=dep-info,metadata,link -C embed-bitcode=no --check-cfg cfg(docsrs,test) --check-cfg cfg(feature, values()) -C metadata=3bb98f7b2f589c61 -C extra-filename=-86dff03eb05ec8a5 --out-dir /work/target/debug/deps -L dependency=/work/target/debug/deps --cap-lints allow	1.0 s	46 ms	0
└build_script quote		1.5 s	8 ms	0
└rustc /usr/local/bin/rustc	--version	1.5 s	7 ms	0
└build_script icu_properties_data		11.2 s	1 ms	0
└build_script icu_normalizer_data		11.5 s	2 ms	0
└build_script crc32fast		12.7 s	9 ms	0
└rustc /usr/local/bin/rustc	--version	12.7 s	7 ms	0
└build_script serde_core		13.1 s	10 ms	0
└rustc /usr/local/bin/rustc	--version	13.1 s	8 ms	0
└build_script zmij		27.2 s	10 ms	0
└rustc /usr/local/bin/rustc	--version	27.2 s	8 ms	0
└build_script serde_json		28.8 s	1 ms	0
└build_script serde		30.4 s	9 ms	0
└rustc /usr/local/bin/rustc	--version	30.4 s	7 ms	0
└build_script mime_guess		36.3 s	8 ms	0
└build_script utoipa-swagger-ui		43.2 s	89 ms	25856
└other /usr/bin/curl	-sSL -o /work/target/debug/build/utoipa-swagger-ui-13d4f032d30c07e0/out/v5.32.6.zip https://github.com/swagger-api/swagger-ui/archive/refs/tags/v5.32.6.zip	43.2 s	86 ms	0

Network 2

The VM has no internet. Every name it looks up resolves to 10.0.2.1, the fake internet, which accepts every connection and records what was sent. Below, it is shown by its port alone, such as :443. The name the build wanted is in the lookups, the HTTP host and the TLS SNI.

Looked up github.com

Destination	Protocol	What was sent	Bytes
:443	tls	SNI github.com, inside TLS: GET /swagger-api/swagger-ui/archive/refs/tags/v5.32.6.zip, host github.com, agent curl/8.14.1	1.5 KiB

Sockets in the trace 3

When	Program	How	Address	Type
43.2 s	/usr/bin/curl	connect	unix:/var/run/nscd/socket	stream
43.2 s	/usr/bin/curl	connect	:53	datagram
43.2 s	/usr/bin/curl	connect	:443	stream

Files 0

Secrets opened

None.

Written outside the build directories

None.

Scratch disk 0

Files: 589
Directories: 139
Size: 288.1 MiB
Compiled units: 112

Nothing outside the build areas.

Output

Standard error

   Compiling proc-macro2 v1.0.107
   Compiling quote v1.0.47
   Compiling unicode-ident v1.0.27
   Compiling syn v3.0.9
   Compiling synstructure v0.14.0
   Compiling zerofrom-derive v0.1.8
   Compiling zerofrom v0.1.8
   Compiling yoke-derive v0.8.4
   Compiling stable_deref_trait v1.2.1
   Compiling yoke v0.8.3
   Compiling zerovec-derive v0.11.6
   Compiling zerovec v0.11.8
   Compiling displaydoc v0.2.7
   Compiling tinystr v0.8.4
   Compiling litemap v0.8.3
   Compiling writeable v0.6.4
   Compiling icu_locale_core v2.3.0
   Compiling zerotrie v0.2.5
   Compiling potential_utf v0.1.6
   Compiling icu_normalizer_data v2.3.0
   Compiling utf8_iter v1.0.4
   Compiling icu_properties_data v2.3.0
   Compiling icu_collections v2.3.0
   Compiling icu_provider v2.3.1
   Compiling serde_core v1.0.229
   Compiling smallvec v1.16.3
   Compiling crc32fast v1.5.3
   Compiling memchr v2.8.3
   Compiling icu_normalizer v2.3.0
   Compiling icu_properties v2.3.0
   Compiling cfg-if v1.0.5
   Compiling idna_adapter v1.2.2
   Compiling aho-corasick v1.1.5
   Compiling zmij v1.0.23
   Compiling simd-adler32 v0.3.10
   Compiling hashbrown v0.17.1
   Compiling zlib-rs v0.6.8
   Compiling log v0.4.34
   Compiling equivalent v1.0.3
   Compiling bumpalo v3.20.3
   Compiling regex-syntax v0.8.11
   Compiling percent-encoding v2.3.2
   Compiling form_urlencoded v1.2.2
   Compiling regex-automata v0.4.18
   Compiling zopfli v0.8.4
   Compiling indexmap v2.14.2
   Compiling flate2 v1.1.10
   Compiling idna v1.1.0
   Compiling serde v1.0.229
   Compiling typed-path v0.12.4
   Compiling unicase v2.10.0
   Compiling serde_json v1.0.154
   Compiling mime_guess v2.0.5
   Compiling zip v9.0.5
   Compiling url v2.5.8
   Compiling regex v1.13.1
   Compiling serde_derive v1.0.229
    Checking itoa v1.0.18
   Compiling utoipa-swagger-ui v10.0.2
   Compiling utoipa-gen v6.0.1
    Checking mime v0.3.17
    Checking utoipa v6.0.0
error: failed to run custom build command for `utoipa-swagger-ui v10.0.2`

Caused by:
  process didn't exit successfully: `/work/target/debug/build/utoipa-swagger-ui-bc1136925485feb1/build-script-build` (exit status: 101)
  --- stdout
  OUT_DIR: /work/target/debug/build/utoipa-swagger-ui-13d4f032d30c07e0/out
  SWAGGER_UI_DOWNLOAD_URL: https://github.com/swagger-api/swagger-ui/archive/refs/tags/v5.32.6.zip
  cargo:rerun-if-env-changed=SWAGGER_UI_DOWNLOAD_URL
  start download to: "/work/target/debug/build/utoipa-swagger-ui-13d4f032d30c07e0/out/v5.32.6.zip"
  reqwest feature: Err(NotPresent)
  trying to download using `curl` system package

  --- stderr

  thread 'main' (1450) panicked at /cw/vendor/utoipa-swagger-ui-10.0.2/build.rs:238:51:
  failed to open downloaded Swagger UI: InvalidArchive("Could not find EOCD")
  note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace

Timeline

When	From	To	Event	Worker
2026-10-20 16:27 UTC	Discovered	Fetched	fetched	fetcher-12688
2026-10-20 16:27 UTC	Fetched	ReadyForSandbox	static_analysis_completed	static-12726
2026-10-20 16:31 UTC	ReadyForSandbox	Running	sandbox_started	orchestrator-12760-slot2
2026-10-20 16:32 UTC	Running	DynamicallyAnalyzed	sandbox_completed	orchestrator-12760-slot2
2026-10-20 16:32 UTC	DynamicallyAnalyzed	Scored	scored	analyzer-12816
2026-10-20 16:32 UTC	Scored	Done	finalized	analyzer-12816