raw_player 2026.3.0-canary.1

Done dynamic on Linux job 224309 crates.io SBOM Findings (VEX) Compare with 2026.3.0-canary.0

high severity shell_command in build_script code (3 places): certutil

medium

Automated verdict. Nobody reviewed it. A score is a reason to look closer, not a finding.

Evidence

Points	Signal	Where	What
30	static:shell_command static · raw_player	build.rs:625	high severity shell_command in build_script code (3 places): certutil
10	network_lookup network · raw_player	github.com	The build looked up github.com.
5	exec_downloader trace · raw_player	/usr/bin/curl	The build ran /usr/bin/curl.

4 without points

Signal	Where	What
static:build_script static · raw_player	build.rs	low severity build_script in build_script code: build.rs
static:downloader_pattern static · raw_player	build.rs:361	high severity downloader_pattern in build_script code: https://github.com/shiguredo/raw-player-rs/releases/download/{version} at build.rs:361 with std::process::Command::new at build.rs:567
static:process_spawn static · raw_player	build.rs:567	medium severity process_spawn in build_script code (6 places): std::process::Command::new
static:url_literal static · raw_player	build.rs:361	low severity url_literal in build_script code: https://github.com/shiguredo/raw-player-rs/releases/download/{version}

Behavior

Profile

exec:downloader net:github.com static:downloader_pattern static:process_spawn static:shell_command

Static findings

high shell_command build_script 3

certutil build.rs:625
failed to execute certutil build.rs:630
unexpected certutil output build.rs:649

high downloader_pattern build_script 1

https://github.com/shiguredo/raw-player-rs/releases/download/{version} at build.rs:361 with std::process::Command::new at build.rs:567 build.rs:361

medium process_spawn build_script 6

std::process::Command::new build.rs:567 build.rs:585 build.rs:602 build.rs:618 build.rs:625 build.rs:632

low build_script build_script 1

build.rs build.rs

low foreign_functions library 1

extern block src/pixel_buffer.rs:19

low url_literal build_script 1

https://github.com/shiguredo/raw-player-rs/releases/download/{version} build.rs:361

info unsafe_code library 10

2 unsafe blocks, functions or impls src/audio_player.rs:152
9 unsafe blocks, functions or impls src/audio_stream.rs:24
1 unsafe blocks, functions or impls src/error.rs:16
6 unsafe blocks, functions or impls src/event.rs:18
7 unsafe blocks, functions or impls src/lib.rs:90
10 unsafe blocks, functions or impls src/pixel_buffer.rs:44
17 unsafe blocks, functions or impls src/renderer.rs:21
5 unsafe blocks, functions or impls src/texture.rs:33 src/window.rs:25
11 unsafe blocks, functions or impls src/video_player.rs:763

Run: check

failed

Ended: agent reported the end
Guest: exit code 101
Run time: 22.9 s
VM restore: 58 ms
Payload: 1548 files, 18.3 MiB
Files opened: 4457

Processes 75

Siblings that ran the same program with the same result and the same processes below are folded into one row, with their number. Hide the 65 compiler processes (rustc, C toolchain)

Process	Arguments	Start	Took	Exit
cargo /usr/local/bin/cargo	check --locked --offline	5 ms	22.8 s	25856
└rustc /usr/local/bin/rustc ×8	--crate-name build_script_build --edition=2021 /cw/vendor/proc-macro2-1.0.107/build.rs --error-format=json --json=diagnostic-rendered-ansi,artifacts,future-incompat --crate-type bin --emit=dep-info,link -C embed-bitcode=no --cfg feature="default" --cfg feature="proc-macro" --check-cfg cfg(docsrs,test) --check-cfg cfg(feature, values("default", "nightly", "proc-macro", "span-locations")) -C metadata=a3dc8fb24392fcd4 -C extra-filename=-a411f7480bd0f42c --out-dir /work/target/debug/build/proc-macro2-a411f7480bd0f42c -L dependency=/work/target/debug/deps --cap-lints allow	151 ms	710 ms	0
└toolchain /usr/bin/cc	-m64 /work/target/debug/build/proc-macro2-a411f7480bd0f42c/rustcOk5Q5t/symbols.o /work/target/debug/build/proc-macro2-a411f7480bd0f42c/build_script_build-a411f7480bd0f42c.build_script_build.dd8d7f624ad1d48e-cgu.0.rcgu.o /work/target/debug/build/proc-macro2-a411f7480bd0f42c/build_script_build-a411f7480bd0f42c.cnca5igddme2fkrf01fktrtaw.rcgu.o -Wl,--as-needed -Wl,-Bstatic /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libstd-64f5f36fb0927694.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libpanic_unwind-549498e8b2e4d924.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libobject-7ff85ea729a864ff.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libmemchr-0e3477fb2664a277.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libaddr2line-09755979c57b7e64.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libgimli-9a1fede77fbbf2f0.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libcfg_if-360da4ba13154744.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/lib	706 ms	152 ms	0
└toolchain /usr/libexec/gcc/x86_64-linux-gnu/14/collect2	-plugin /usr/libexec/gcc/x86_64-linux-gnu/14/liblto_plugin.so -plugin-opt=/usr/libexec/gcc/x86_64-linux-gnu/14/lto-wrapper -plugin-opt=-fresolution=/tmp/ccFkCCSY.res --build-id --eh-frame-hdr -m elf_x86_64 --hash-style=gnu --as-needed -dynamic-linker /lib64/ld-linux-x86-64.so.2 -pie -fuse-ld=lld -o /work/target/debug/build/proc-macro2-a411f7480bd0f42c/build_script_build-a411f7480bd0f42c /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/Scrt1.o /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/crti.o /usr/lib/gcc/x86_64-linux-gnu/14/crtbeginS.o -L/work/target/debug/build/proc-macro2-a411f7480bd0f42c/rustcOk5Q5t/raw-dylibs -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/bin/gcc-ld -L/usr/lib/gcc/x86_64-linux-gnu/14 -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../../lib -L/lib/x86_64-linux-gnu -L/lib/../lib -L/usr/lib/x86_64-linux-gnu -L	714 ms	143 ms	0
└toolchain /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/bin/rust-lld	-flavor gnu -plugin /usr/libexec/gcc/x86_64-linux-gnu/14/liblto_plugin.so -plugin-opt=/usr/libexec/gcc/x86_64-linux-gnu/14/lto-wrapper -plugin-opt=-fresolution=/tmp/ccFkCCSY.res --build-id --eh-frame-hdr -m elf_x86_64 --hash-style=gnu --as-needed -dynamic-linker /lib64/ld-linux-x86-64.so.2 -pie -o /work/target/debug/build/proc-macro2-a411f7480bd0f42c/build_script_build-a411f7480bd0f42c /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/Scrt1.o /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/crti.o /usr/lib/gcc/x86_64-linux-gnu/14/crtbeginS.o -L/work/target/debug/build/proc-macro2-a411f7480bd0f42c/rustcOk5Q5t/raw-dylibs -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/bin/gcc-ld -L/usr/lib/gcc/x86_64-linux-gnu/14 -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../../lib -L/lib/x86_64-linux-gnu -L/lib/../lib -L/usr/lib/x86_6	716 ms	140 ms	0
└build_script proc-macro2		865 ms	81 ms	0
└rustc /usr/local/bin/rustc ×3	--version	866 ms	6 ms	0
└rustc /usr/local/bin/rustc	--cfg=procmacro2_build_probe --edition=2021 --crate-name=proc_macro2 --crate-type=lib --cap-lints=allow --emit=dep-info,metadata --out-dir /work/target/debug/build/proc-macro2-4f3f927bd5485a92/out/probe src/probe/proc_macro_span.rs --target x86_64-unknown-linux-gnu	873 ms	37 ms	256
└rustc /usr/local/bin/rustc ×27	--crate-name unicode_ident --edition=2021 /cw/vendor/unicode-ident-1.0.27/src/lib.rs --error-format=json --json=diagnostic-rendered-ansi,artifacts,future-incompat --crate-type lib --emit=dep-info,metadata,link -C embed-bitcode=no --check-cfg cfg(docsrs,test) --check-cfg cfg(feature, values()) -C metadata=3bb98f7b2f589c61 -C extra-filename=-86dff03eb05ec8a5 --out-dir /work/target/debug/deps -L dependency=/work/target/debug/deps --cap-lints allow	947 ms	45 ms	0
└build_script quote		1.4 s	9 ms	0
└rustc /usr/local/bin/rustc	--version	1.4 s	7 ms	0
└build_script libc		2.2 s	9 ms	0
└rustc /usr/local/bin/rustc	--version	2.2 s	7 ms	0
└build_script prettyplease		2.3 s	1 ms	0
└build_script clang-sys		2.4 s	1 ms	0
└build_script bindgen		13.3 s	1 ms	0
└build_script shiguredo_cmake		17.2 s	1 ms	0
└build_script raw_player		22.8 s	57 ms	25856
└other /usr/bin/curl	-fsSL --retry 3 -o /work/target/debug/build/raw_player-f935034e7f86b9c1/out/prebuilt/libSDL3-ubuntu-13_x86_64.tar.gz https://github.com/shiguredo/raw-player-rs/releases/download/2026.3.0-canary.1/libSDL3-ubuntu-13_x86_64.tar.gz	22.8 s	54 ms	5632

Network 2

The VM has no internet. Every name it looks up resolves to 10.0.2.1, the fake internet, which accepts every connection and records what was sent. Below, it is shown by its port alone, such as :443. The name the build wanted is in the lookups, the HTTP host and the TLS SNI.

Looked up github.com

Destination	Protocol	What was sent	Bytes
:443	tls	SNI github.com, inside TLS: GET /shiguredo/raw-player-rs/releases/download/2026.3.0-canary.1/libSDL3-ubuntu-13_x86_64.tar.gz, host github.com, agent curl/8.14.1	1.5 KiB

Sockets in the trace 3

When	Program	How	Address	Type
22.8 s	/usr/bin/curl	connect	unix:/var/run/nscd/socket	stream
22.8 s	/usr/bin/curl	connect	:53	datagram
22.8 s	/usr/bin/curl	connect	:443	stream

Files 0

Secrets opened

None.

Written outside the build directories

None.

Scratch disk 0

Files: 300
Directories: 86
Size: 204.8 MiB
Compiled units: 54
Scan: stopped at a limit

Nothing outside the build areas.

Output

Standard error

   Compiling proc-macro2 v1.0.107
   Compiling unicode-ident v1.0.27
   Compiling quote v1.0.47
   Compiling glob v0.3.4
   Compiling clang-sys v1.9.1
   Compiling shlex v2.0.1
   Compiling prettyplease v0.3.0
   Compiling libc v0.2.191
   Compiling memchr v2.8.3
   Compiling regex-syntax v0.8.11
   Compiling shiguredo_toml v2026.2.0
   Compiling cfg-if v1.0.5
   Compiling minimal-lexical v0.2.1
   Compiling find-msvc-tools v0.1.15
   Compiling cc v1.9.0
   Compiling nom v7.1.3
   Compiling libloading v0.8.9
   Compiling shiguredo_cmake v4.4.0
   Compiling regex-automata v0.4.18
   Compiling syn v3.0.9
   Compiling bindgen v0.73.2
   Compiling regex v1.13.1
   Compiling cexpr v0.6.0
   Compiling cmake v0.1.58
   Compiling log v0.4.34
   Compiling rustc-hash v2.1.3
   Compiling bitflags v2.13.2
   Compiling raw_player v2026.3.0-canary.1
error: failed to run custom build command for `raw_player v2026.3.0-canary.1`

Caused by:
  process didn't exit successfully: `/work/target/debug/build/raw_player-37001abc43d38faf/build-script-build` (exit status: 101)
  --- stdout
  cargo::rerun-if-changed=Cargo.toml
  cargo::rerun-if-changed=build.rs
  cargo::rerun-if-env-changed=CARGO_FEATURE_SOURCE_BUILD
  cargo::rerun-if-env-changed=DOCS_RS
  Downloading prebuilt SDL3 from https://github.com/shiguredo/raw-player-rs/releases/download/2026.3.0-canary.1/libSDL3-ubuntu-13_x86_64.tar.gz

  --- stderr
  curl: (22) The requested URL returned error: 404

  thread 'main' (1046) panicked at /cw/vendor/raw_player-2026.3.0-canary.1/build.rs:596:9:
  failed to download from https://github.com/shiguredo/raw-player-rs/releases/download/2026.3.0-canary.1/libSDL3-ubuntu-13_x86_64.tar.gz
  note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace

Timeline

When	From	To	Event	Worker
2026-10-21 06:26 UTC	Discovered	Fetched	fetched	fetcher-12688
2026-10-21 06:26 UTC	Fetched	ReadyForSandbox	static_analysis_completed	static-12726
2026-10-21 06:26 UTC	ReadyForSandbox	Running	sandbox_started	orchestrator-12760-slot1
2026-10-21 06:27 UTC	Running	DynamicallyAnalyzed	sandbox_completed	orchestrator-12760-slot1
2026-10-21 06:27 UTC	DynamicallyAnalyzed	Scored	scored	analyzer-12816
2026-10-21 06:27 UTC	Scored	Done	finalized	analyzer-12816