zgx-ghostty-sys 0.1.0

Done dynamic on Linux job 265986 crates.io SBOM Findings (VEX)

high severity downloader_pattern in build_script code: https://github.com/ghostty-org/ghostty.git at build.rs:25 with std::process::Command::new at build.rs:74

high

False positive. A person reviewed this verdict and found the crate benign. The evidence below is what the analysis saw.

Evidence

Points	Signal	Where	What
30	static:downloader_pattern static · zgx-ghostty-sys	build.rs:25	high severity downloader_pattern in build_script code: https://github.com/ghostty-org/ghostty.git at build.rs:25 with std::process::Command::new at build.rs:74
10	build_script_added diff · zgx-ghostty-sys		A build script was added since 0.0.1.
10	new_high_finding diff · zgx-ghostty-sys	build.rs:25	New since 0.0.1: downloader_pattern

3 without points

Signal	Where	What
static:build_script static · zgx-ghostty-sys	build.rs	low severity build_script in build_script code: build.rs
static:process_spawn static · zgx-ghostty-sys	build.rs:74	medium severity process_spawn in build_script code (4 places): std::process::Command::new
static:url_literal static · zgx-ghostty-sys	build.rs:25	low severity url_literal in build_script code: https://github.com/ghostty-org/ghostty.git

Behavior

New since the previous version

static:downloader_pattern static:process_spawn

Profile

static:downloader_pattern static:process_spawn

Static findings

high downloader_pattern build_script 1

https://github.com/ghostty-org/ghostty.git at build.rs:25 with std::process::Command::new at build.rs:74 build.rs:25

medium process_spawn build_script 4

std::process::Command::new build.rs:74 build.rs:152 build.rs:183
std::process::Command build.rs:203

low foreign_functions library 90

extern block src/bindings.rs:1653 src/bindings.rs:1656 src/bindings.rs:1659 src/bindings.rs:1662 src/bindings.rs:1665 src/bindings.rs:1668 src/bindings.rs:1671 src/bindings.rs:1674 src/bindings.rs:1677 src/bindings.rs:1680 src/bindings.rs:1683 src/bindings.rs:1686 src/bindings.rs:1689 src/bindings.rs:1692 src/bindings.rs:1700 src/bindings.rs:1707 src/bindings.rs:1711 src/bindings.rs:1714 src/bindings.rs:1718 src/bindings.rs:1721 src/bindings.rs:1727 src/bindings.rs:1730 src/bindings.rs:1733 src/bindings.rs:1736 src/bindings.rs:1739 src/bindings.rs:1742 src/bindings.rs:1745 src/bindings.rs:1748 src/bindings.rs:1751 src/bindings.rs:1754 src/bindings.rs:1757 src/bindings.rs:1760 src/bindings.rs:1763 src/bindings.rs:1769 src/bindings.rs:1772 src/bindings.rs:1775 src/bindings.rs:1778 src/bindings.rs:1784 src/bindings.rs:1787 src/bindings.rs:1790 src/bindings.rs:1793 src/bindings.rs:1796 src/bindings.rs:1799 src/bindings.rs:1802 src/bindings.rs:1805 src/bindings.rs:1808 src/bindings.rs:1811 src/bindings.rs:1814 src/bindings.rs:1817 src/bindings.rs:1820 and 40 more

low build_script build_script 1

build.rs build.rs

low url_literal build_script 1

https://github.com/ghostty-org/ghostty.git build.rs:25

info native_link build_script 1

links = "ghostty-internal" Cargo.toml

Run: full

succeeded

The full build covers everything the earlier cargo check run did, so only the full run is shown.

Ended: agent reported the end
Guest: exit code 0
Run time: 1.1 s
VM restore: 69 ms
Payload: 13 files, 125.6 KiB
Files opened: 369

Processes 8

Siblings that ran the same program with the same result and the same processes below are folded into one row, with their number. Hide the 6 compiler processes (rustc, C toolchain)

Process	Arguments	Start	Took
cargo /usr/local/bin/cargo	build --locked --offline	5 ms	1.0 s
└rustc /usr/local/bin/rustc	--crate-name build_script_build --edition=2024 /cw/vendor/zgx-ghostty-sys-0.1.0/build.rs --error-format=json --json=diagnostic-rendered-ansi,artifacts,future-incompat --crate-type bin --emit=dep-info,link -C embed-bitcode=no --check-cfg cfg(docsrs,test) --check-cfg cfg(feature, values("link")) -C metadata=5bc7941c932a6455 -C extra-filename=-2248309e1301bec5 --out-dir /work/target/debug/build/zgx-ghostty-sys-2248309e1301bec5 -L dependency=/work/target/debug/deps --cap-lints allow	144 ms	754 ms
└toolchain /usr/bin/cc	-m64 /work/target/debug/build/zgx-ghostty-sys-2248309e1301bec5/rustctEg37k/symbols.o /work/target/debug/build/zgx-ghostty-sys-2248309e1301bec5/build_script_build-2248309e1301bec5.build_script_build.2e1c2e28308fcc6f-cgu.0.rcgu.o /work/target/debug/build/zgx-ghostty-sys-2248309e1301bec5/build_script_build-2248309e1301bec5.build_script_build.2e1c2e28308fcc6f-cgu.1.rcgu.o /work/target/debug/build/zgx-ghostty-sys-2248309e1301bec5/build_script_build-2248309e1301bec5.en87uc2jwm3bm3jscizi0kcra.rcgu.o -Wl,--as-needed -Wl,-Bstatic /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libstd-64f5f36fb0927694.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libpanic_unwind-549498e8b2e4d924.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libobject-7ff85ea729a864ff.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libmemchr-0e3477fb2664a277.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libaddr2line-09755979c57b7e64.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libgimli-9a1fed	745 ms	149 ms
└toolchain /usr/libexec/gcc/x86_64-linux-gnu/14/collect2	-plugin /usr/libexec/gcc/x86_64-linux-gnu/14/liblto_plugin.so -plugin-opt=/usr/libexec/gcc/x86_64-linux-gnu/14/lto-wrapper -plugin-opt=-fresolution=/tmp/ccwkNfZq.res --build-id --eh-frame-hdr -m elf_x86_64 --hash-style=gnu --as-needed -dynamic-linker /lib64/ld-linux-x86-64.so.2 -pie -fuse-ld=lld -o /work/target/debug/build/zgx-ghostty-sys-2248309e1301bec5/build_script_build-2248309e1301bec5 /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/Scrt1.o /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/crti.o /usr/lib/gcc/x86_64-linux-gnu/14/crtbeginS.o -L/work/target/debug/build/zgx-ghostty-sys-2248309e1301bec5/rustctEg37k/raw-dylibs -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/bin/gcc-ld -L/usr/lib/gcc/x86_64-linux-gnu/14 -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../../lib -L/lib/x86_64-linux-gnu -L/lib/../lib -L/usr/lib/x86_64-linu	753 ms	141 ms
└toolchain /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/bin/rust-lld	-flavor gnu -plugin /usr/libexec/gcc/x86_64-linux-gnu/14/liblto_plugin.so -plugin-opt=/usr/libexec/gcc/x86_64-linux-gnu/14/lto-wrapper -plugin-opt=-fresolution=/tmp/ccwkNfZq.res --build-id --eh-frame-hdr -m elf_x86_64 --hash-style=gnu --as-needed -dynamic-linker /lib64/ld-linux-x86-64.so.2 -pie -o /work/target/debug/build/zgx-ghostty-sys-2248309e1301bec5/build_script_build-2248309e1301bec5 /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/Scrt1.o /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/crti.o /usr/lib/gcc/x86_64-linux-gnu/14/crtbeginS.o -L/work/target/debug/build/zgx-ghostty-sys-2248309e1301bec5/rustctEg37k/raw-dylibs -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/bin/gcc-ld -L/usr/lib/gcc/x86_64-linux-gnu/14 -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../../lib -L/lib/x86_64-linux-gnu -L/lib/../lib -L/usr/l	755 ms	138 ms
└build_script zgx-ghostty-sys		902 ms	1 ms
└rustc /usr/local/bin/rustc ×2	--crate-name zgx_ghostty_sys --edition=2024 /cw/vendor/zgx-ghostty-sys-0.1.0/src/lib.rs --error-format=json --json=diagnostic-rendered-ansi,artifacts,future-incompat --crate-type lib --emit=dep-info,metadata,link -C embed-bitcode=no -C debuginfo=2 --check-cfg cfg(docsrs,test) --check-cfg cfg(feature, values("link")) -C metadata=660949c21f78866a -C extra-filename=-ad59dbd3b62d6745 --out-dir /work/target/debug/deps -L dependency=/work/target/debug/deps --cap-lints allow	904 ms	160 ms

Network 0

No network activity.

Files 0

Secrets opened

None.

Written outside the build directories

None.

Scratch disk 0

Files: 46
Directories: 26
Size: 10.0 MiB
Compiled units: 4

Nothing outside the build areas.

Output

Standard error

   Compiling zgx-ghostty-sys v0.1.0
   Compiling crateward-probe v0.0.0 (/cw/probe)
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 1.04s

Timeline

When	From	To	Event	Worker
2026-10-25 06:59 UTC	Discovered	Fetched	fetched	fetcher-12688
2026-10-25 06:59 UTC	Fetched	ReadyForSandbox	static_analysis_completed	static-12726
2026-10-25 07:02 UTC	ReadyForSandbox	Running	sandbox_started	orchestrator-12760-slot1
2026-10-25 07:02 UTC	Running	DynamicallyAnalyzed	sandbox_completed	orchestrator-12760-slot1
2026-10-25 07:02 UTC	DynamicallyAnalyzed	ReadyForSandbox	scored	analyzer-12816
2026-10-25 07:02 UTC	ReadyForSandbox	Running	sandbox_started	orchestrator-12760-slot2
2026-10-25 07:02 UTC	Running	DynamicallyAnalyzed	sandbox_completed	orchestrator-12760-slot2
2026-10-25 07:02 UTC	DynamicallyAnalyzed	Scored	scored	analyzer-12816
2026-10-25 07:02 UTC	Scored	Done	finalized	analyzer-12816