compose-rust 0.0.3

Done dynamic on Linux job 272836 crates.io SBOM Findings (VEX)

New since the previous version: disk:outside.

low

Automated verdict. Nobody reviewed it. A score is a reason to look closer, not a finding.

Evidence

Points	Signal	Where	What
5	new_behavior diff · compose-rust	disk:outside	New since the previous version: disk:outside.
5	new_behavior diff · compose-rust	exec:downloader	New since the previous version: exec:downloader.
5	new_behavior diff · compose-rust	net:github.com	New since the previous version: net:github.com.
2	static:inline_assembly static · compose-rust	src/boundary.rs:1486	medium severity inline_assembly in library code (3 places): global_asm
2	static:obfuscated_data static · compose-rust	src/schema.rs:174	medium severity obfuscated_data in library code: events=Clicked,TextChanged,TextSubmitted,FocusLost,ProtocolError,KeyDown,RangeRequested,ValueChanged,WindowSizeChanged,DesignSystemResolved,FilesEntered,FilesDropped,NotificationActivated,Notification…

8 without points

Signal	Where	What
disk_outside_build disk	/work/home/.cache	The build left /work/home/.cache (dir) and 2 entries below it. A reviewer marked this a false positive in 0.0.0.
exec_downloader trace · compose-rust	/usr/bin/curl	The build ran /usr/bin/curl. A reviewer marked this a false positive in 0.0.0.
network_lookup network · compose-rust	github.com	The build looked up github.com. A reviewer marked this a false positive in 0.0.0.
static:build_script static · compose-rust	build.rs	low severity build_script in build_script code: build.rs A reviewer marked this a false positive in 0.0.0.
static:downloader_pattern static · compose-rust	build/renderer_dir.rs:35	high severity downloader_pattern in build_script code: https://github.com/DarkPyonix/compose-rust/releases at build/renderer_dir.rs:35 with std::process::Command::new at build.rs:678 A reviewer marked this a false positive in 0.0.0.
static:process_spawn static · compose-rust	build.rs:678	medium severity process_spawn in build_script code (8 places): std::process::Command::new A reviewer marked this a false positive in 0.0.0.
static:shell_command static · compose-rust	build.rs:791	high severity shell_command in build_script code (5 places): curl exited {code} A reviewer marked this a false positive in 0.0.0.
static:url_literal static · compose-rust	build/renderer_dir.rs:35	low severity url_literal in build_script code: https://github.com/DarkPyonix/compose-rust/releases A reviewer marked this a false positive in 0.0.0.

Behavior

New since the previous version

disk:outside exec:downloader net:github.com static:inline_assembly

Profile

disk:outside exec:downloader net:github.com static:downloader_pattern static:inline_assembly static:obfuscated_data static:process_spawn static:shell_command

Static findings

high shell_command build_script 5

curl exited {code} build.rs:791
curl exited {code}: {detail} build.rs:796
wget could not reach the network: {detail} build.rs:825
wget exited {code}: {detail} build.rs:826
curl could not resolve the host build/renderer_dir.rs:1007

high downloader_pattern build_script 1

https://github.com/DarkPyonix/compose-rust/releases at build/renderer_dir.rs:35 with std::process::Command::new at build.rs:678 build/renderer_dir.rs:35

medium process_spawn build_script 7

std::process::Command::new build.rs:678 build.rs:761 build.rs:773 build.rs:808 build/renderer_dir.rs:451 build/renderer_dir.rs:556 build/renderer_dir.rs:583

medium inline_assembly library 3

global_asm src/boundary.rs:1486 src/boundary.rs:1513 src/boundary.rs:1529

medium obfuscated_data library 1

events=Clicked,TextChanged,TextSubmitted,FocusLost,ProtocolError,KeyDown,RangeRequested,ValueChanged,WindowSizeChanged,DesignSystemResolved,FilesEntered,FilesDropped,NotificationActivated,Notification… src/schema.rs:174

low foreign_functions library 3

extern block src/boundary.rs:74 src/boundary_jni.gen.rs:29 src/boundary_wasm.gen.rs:24

low build_script build_script 1

build.rs build.rs

low process_spawn library 1

std::process::Command::new src/codegen.rs:4258

low url_literal build_script 1

https://github.com/DarkPyonix/compose-rust/releases build/renderer_dir.rs:35

info unsafe_code library 6

33 unsafe blocks, functions or impls src/boundary.rs:94
13 unsafe blocks, functions or impls src/boundary_jni.gen.rs:67
7 unsafe blocks, functions or impls src/boundary_wasm.gen.rs:92
3 unsafe blocks, functions or impls src/measure.rs:657
2 unsafe blocks, functions or impls src/runtime/host.rs:384
1 unsafe blocks, functions or impls src/runtime/state.rs:371

Run: check

failed

Ended: agent reported the end
Guest: exit code 101
Run time: 5.6 s
VM restore: 59 ms
Payload: 1417 files, 93.5 MiB
Files opened: 1292

Processes 27

Siblings that ran the same program with the same result and the same processes below are folded into one row, with their number. Hide the 21 compiler processes (rustc, C toolchain)

Process	Arguments	Start	Took	Exit
cargo /usr/local/bin/cargo	check --locked --offline	5 ms	5.5 s	25856
└rustc /usr/local/bin/rustc ×3	--crate-name build_script_build --edition=2021 /cw/vendor/proc-macro2-1.0.107/build.rs --error-format=json --json=diagnostic-rendered-ansi,artifacts,future-incompat --crate-type bin --emit=dep-info,link -C embed-bitcode=no --cfg feature="default" --cfg feature="proc-macro" --check-cfg cfg(docsrs,test) --check-cfg cfg(feature, values("default", "nightly", "proc-macro", "span-locations")) -C metadata=a3dc8fb24392fcd4 -C extra-filename=-a411f7480bd0f42c --out-dir /work/target/debug/build/proc-macro2-a411f7480bd0f42c -L dependency=/work/target/debug/deps --cap-lints allow	137 ms	726 ms	0
└toolchain /usr/bin/cc	-m64 /work/target/debug/build/proc-macro2-a411f7480bd0f42c/rustcYHItkW/symbols.o /work/target/debug/build/proc-macro2-a411f7480bd0f42c/build_script_build-a411f7480bd0f42c.build_script_build.dd8d7f624ad1d48e-cgu.0.rcgu.o /work/target/debug/build/proc-macro2-a411f7480bd0f42c/build_script_build-a411f7480bd0f42c.cnca5igddme2fkrf01fktrtaw.rcgu.o -Wl,--as-needed -Wl,-Bstatic /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libstd-64f5f36fb0927694.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libpanic_unwind-549498e8b2e4d924.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libobject-7ff85ea729a864ff.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libmemchr-0e3477fb2664a277.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libaddr2line-09755979c57b7e64.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libgimli-9a1fede77fbbf2f0.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libcfg_if-360da4ba13154744.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/lib	701 ms	159 ms	0
└toolchain /usr/libexec/gcc/x86_64-linux-gnu/14/collect2	-plugin /usr/libexec/gcc/x86_64-linux-gnu/14/liblto_plugin.so -plugin-opt=/usr/libexec/gcc/x86_64-linux-gnu/14/lto-wrapper -plugin-opt=-fresolution=/tmp/ccBrJXCR.res --build-id --eh-frame-hdr -m elf_x86_64 --hash-style=gnu --as-needed -dynamic-linker /lib64/ld-linux-x86-64.so.2 -pie -fuse-ld=lld -o /work/target/debug/build/proc-macro2-a411f7480bd0f42c/build_script_build-a411f7480bd0f42c /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/Scrt1.o /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/crti.o /usr/lib/gcc/x86_64-linux-gnu/14/crtbeginS.o -L/work/target/debug/build/proc-macro2-a411f7480bd0f42c/rustcYHItkW/raw-dylibs -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/bin/gcc-ld -L/usr/lib/gcc/x86_64-linux-gnu/14 -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../../lib -L/lib/x86_64-linux-gnu -L/lib/../lib -L/usr/lib/x86_64-linux-gnu -L	710 ms	149 ms	0
└toolchain /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/bin/rust-lld	-flavor gnu -plugin /usr/libexec/gcc/x86_64-linux-gnu/14/liblto_plugin.so -plugin-opt=/usr/libexec/gcc/x86_64-linux-gnu/14/lto-wrapper -plugin-opt=-fresolution=/tmp/ccBrJXCR.res --build-id --eh-frame-hdr -m elf_x86_64 --hash-style=gnu --as-needed -dynamic-linker /lib64/ld-linux-x86-64.so.2 -pie -o /work/target/debug/build/proc-macro2-a411f7480bd0f42c/build_script_build-a411f7480bd0f42c /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/Scrt1.o /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/crti.o /usr/lib/gcc/x86_64-linux-gnu/14/crtbeginS.o -L/work/target/debug/build/proc-macro2-a411f7480bd0f42c/rustcYHItkW/raw-dylibs -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/bin/gcc-ld -L/usr/lib/gcc/x86_64-linux-gnu/14 -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../../lib -L/lib/x86_64-linux-gnu -L/lib/../lib -L/usr/lib/x86_6	713 ms	145 ms	0
└build_script proc-macro2		867 ms	88 ms	0
└rustc /usr/local/bin/rustc ×3	--version	868 ms	7 ms	0
└rustc /usr/local/bin/rustc	--cfg=procmacro2_build_probe --edition=2021 --crate-name=proc_macro2 --crate-type=lib --cap-lints=allow --emit=dep-info,metadata --out-dir /work/target/debug/build/proc-macro2-4f3f927bd5485a92/out/probe src/probe/proc_macro_span.rs --target x86_64-unknown-linux-gnu	876 ms	39 ms	256
└rustc /usr/local/bin/rustc ×4	--crate-name unicode_ident --edition=2021 /cw/vendor/unicode-ident-1.0.27/src/lib.rs --error-format=json --json=diagnostic-rendered-ansi,artifacts,future-incompat --crate-type lib --emit=dep-info,metadata,link -C embed-bitcode=no --check-cfg cfg(docsrs,test) --check-cfg cfg(feature, values()) -C metadata=3bb98f7b2f589c61 -C extra-filename=-86dff03eb05ec8a5 --out-dir /work/target/debug/deps -L dependency=/work/target/debug/deps --cap-lints allow	1.0 s	51 ms	0
└build_script quote		1.6 s	8 ms	0
└rustc /usr/local/bin/rustc	--version	1.6 s	6 ms	0
└build_script compose-rust		5.5 s	59 ms	25856
└other /usr/bin/which	/usr/bin/which curl	5.5 s	1 ms	0
└other /usr/bin/curl	--silent --show-error --location --connect-timeout 30 --retry 2 --output /work/home/.cache/compose-rust/downloads/compose-rust-renderer-v0.0.3-linux-x64.tar.partial --write-out %{http_code} https://github.com/DarkPyonix/compose-rust/releases/download/v0.0.3/compose-rust-renderer-v0.0.3-linux-x64.tar.gz	5.5 s	56 ms	0

Network 2

The VM has no internet. Every name it looks up resolves to 10.0.2.1, the fake internet, which accepts every connection and records what was sent. Below, it is shown by its port alone, such as :443. The name the build wanted is in the lookups, the HTTP host and the TLS SNI.

Looked up github.com

Destination	Protocol	What was sent	Bytes
:443	tls	SNI github.com, inside TLS: GET /DarkPyonix/compose-rust/releases/download/v0.0.3/compose-rust-renderer-v0.0.3-linux-x64.tar.gz, host github.com, agent curl/8.14.1	1.5 KiB

Sockets in the trace 3

When	Program	How	Address	Type
5.5 s	/usr/bin/curl	connect	unix:/var/run/nscd/socket	stream
5.5 s	/usr/bin/curl	connect	:53	datagram
5.5 s	/usr/bin/curl	connect	:443	stream

Files 0

Secrets opened

None.

Written outside the build directories

None.

Scratch disk 3

Files: 72
Directories: 41
Size: 43.3 MiB
Compiled units: 8

Why	Path	Kind	Size	Mode
outside the build areas	/work/home/.cache	dir	4.0 KiB	755
outside the build areas	/work/home/.cache/compose-rust	dir	4.0 KiB	755
outside the build areas	/work/home/.cache/compose-rust/downloads	dir	4.0 KiB	755

Output

Standard error

   Compiling proc-macro2 v1.0.107
   Compiling quote v1.0.47
   Compiling unicode-ident v1.0.27
   Compiling syn v2.0.119
   Compiling compose-rust v0.0.3
error: failed to run custom build command for `compose-rust v0.0.3`

Caused by:
  process didn't exit successfully: `/work/target/debug/build/compose-rust-767ad0f625243047/build-script-build` (exit status: 101)
  --- stdout
  cargo:rustc-check-cfg=cfg(renderer_linked)
  cargo:rustc-check-cfg=cfg(windows_crt_linked_in)
  cargo:rustc-check-cfg=cfg(windows_crt_dynamic)
  cargo:rerun-if-env-changed=COMPOSE_RUST_RENDERER_DIR
  cargo:rerun-if-env-changed=DXC_MACOS_NATIVE_LIB
  cargo:rerun-if-env-changed=DXC_LINUX_NATIVE_LIB
  cargo:rerun-if-env-changed=COMPOSE_RUST_CACHE_DIR
  cargo:rerun-if-env-changed=DIOXUS_COMPOSE_RENDERER_DIR
  cargo:rerun-if-env-changed=DIOXUS_COMPOSE_CACHE_DIR
  cargo:rerun-if-env-changed=DOCS_RS
  cargo:rerun-if-changed=build/renderer_dir.rs
  cargo:rerun-if-changed=build/sha256.rs
  cargo:rerun-if-changed=build/elf.rs
  cargo:rerun-if-changed=build/windows_crt.rs

  --- stderr

  thread 'main' (694) panicked at /cw/vendor/compose-rust-0.0.3/build.rs:218:25:


  compose-rust: the release for v0.0.3 does not carry compose-rust-renderer-v0.0.3-linux-x64.tar.gz.

  The server was reached and answered that there is no such file, so this is not a
  network problem. Either that release was published without the linux-x64 renderer,
  or it predates this crate version being tagged at all. What it does carry is
  listed at:
      https://github.com/DarkPyonix/compose-rust/releases/tag/v0.0.3

  Any renderer you already have works too. Unpack compose-rust-renderer-v0.0.3-linux-x64.tar.gz, or build one from a
  checkout of the repository: the static archive with
  renderer/desktop/scripts/build-macos.sh or
  renderer/desktop/scripts/build-linux.sh, the shared library with
  renderer/desktop/scripts/build-native.sh. Then set
  COMPOSE_RUST_RENDERER_DIR to the directory it wrote. The variable is checked first and
  nothing is downloaded when it is set.


  note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace

Timeline

When	From	To	Event	Worker
2026-10-26 01:28 UTC	Discovered	Fetched	fetched	fetcher-12688
2026-10-26 01:28 UTC	Fetched	ReadyForSandbox	static_analysis_completed	static-12726
2026-10-26 01:28 UTC	ReadyForSandbox	Running	sandbox_started	orchestrator-12760-slot0
2026-10-26 01:28 UTC	Running	DynamicallyAnalyzed	sandbox_completed	orchestrator-12760-slot0
2026-10-26 01:28 UTC	DynamicallyAnalyzed	Scored	scored	analyzer-12816
2026-10-26 01:28 UTC	Scored	Done	finalized	analyzer-12816