cp2k-gauxc-sys 2026.2.0

Done dynamic on Linux job 301315 crates.io SBOM Findings (VEX) Compare with 0.3.2

high severity downloader_pattern in build_script code: https://github.com/wavefunction91/GauXC/archive/{GAUXC_REV}.tar.gz at build.rs:126 with std::process::Command::new at build.rs:132

medium

Automated verdict. Nobody reviewed it. A score is a reason to look closer, not a finding.

Evidence

Points	Signal	Where	What
30	static:downloader_pattern static · cp2k-gauxc-sys	build.rs:126	high severity downloader_pattern in build_script code: https://github.com/wavefunction91/GauXC/archive/{GAUXC_REV}.tar.gz at build.rs:126 with std::process::Command::new at build.rs:132
10	network_lookup network · cp2k-libxc-sys	gitlab.com	The build looked up gitlab.com.
5	exec_downloader trace · cp2k-libxc-sys	/usr/bin/curl	The build ran /usr/bin/curl.

3 without points

Signal	Where	What
static:build_script static · cp2k-gauxc-sys	build.rs	low severity build_script in build_script code: build.rs
static:process_spawn static · cp2k-gauxc-sys	build.rs:132	medium severity process_spawn in build_script code (11 places): std::process::Command::new
static:url_literal static · cp2k-gauxc-sys	build.rs:126	low severity url_literal in build_script code (3 places): https://github.com/wavefunction91/GauXC/archive/{GAUXC_REV}.tar.gz

Behavior

Profile

exec:downloader net:gitlab.com static:downloader_pattern static:process_spawn

Static findings

high downloader_pattern build_script 1

https://github.com/wavefunction91/GauXC/archive/{GAUXC_REV}.tar.gz at build.rs:126 with std::process::Command::new at build.rs:132 build.rs:126

medium process_spawn build_script 11

std::process::Command::new build.rs:132 build.rs:237 build.rs:243 build.rs:247 build.rs:297 build.rs:312 build.rs:351 build.rs:362 build.rs:382 build.rs:386 build.rs:394

low url_literal build_script 3

https://github.com/wavefunction91/GauXC/archive/{GAUXC_REV}.tar.gz build.rs:126
-DGAUXC_NLOHMANN_JSON_URL=https://github.com/nlohmann/json/releases/download/v3.12.0/include.zip build.rs:231
https://github.com/wavefunction91/{repo}/archive/{rev}.tar.gz build.rs:286

low build_script build_script 1

build.rs build.rs

info native_link build_script 1

links = "cp2k_gauxc" Cargo.toml

Run: check

failed

Ended: agent reported the end
Guest: exit code 101
Run time: 1 min 15 s
VM restore: 59 ms
Payload: 4728 files, 135.1 MiB
Files opened: 9768

Processes 231

Siblings that ran the same program with the same result and the same processes below are folded into one row, with their number. Hide the 215 compiler processes (rustc, C toolchain)

Process	Arguments	Start	Took	Exit
cargo /usr/local/bin/cargo	check --locked --offline	5 ms	1 min 15 s	25856
└rustc /usr/local/bin/rustc ×13	--crate-name build_script_build --edition=2021 /cw/vendor/libc-0.2.191/build.rs --error-format=json --json=diagnostic-rendered-ansi,artifacts,future-incompat --crate-type bin --emit=dep-info,link -C embed-bitcode=no --allow=unused_qualifications --warn=clippy::unnecessary_semicolon --allow=clippy::unnecessary_cast --warn=clippy::ptr_as_ptr --allow=clippy::non_minimal_cfg --allow=clippy::missing_safety_doc --warn=clippy::map_unwrap_or --warn=clippy::manual_assert --allow=clippy::identity_op --warn=clippy::explicit_iter_loop --cfg feature="default" --cfg feature="std" --check-cfg cfg(docsrs,test) --check-cfg cfg(feature, values("align", "const-extern-fn", "default", "extra_traits", "rustc-dep-of-std", "rustc-std-workspace-core", "std", "use_std")) -C metadata=f2b3c09777387306	184 ms	741 ms	0
└toolchain /usr/bin/cc	-m64 /work/target/debug/build/libc-24a0c765ebd7d3cb/rustc7wmAot/symbols.o /work/target/debug/build/libc-24a0c765ebd7d3cb/build_script_build-24a0c765ebd7d3cb.build_script_build.2cf7c5ec755a4f39-cgu.0.rcgu.o /work/target/debug/build/libc-24a0c765ebd7d3cb/build_script_build-24a0c765ebd7d3cb.build_script_build.2cf7c5ec755a4f39-cgu.1.rcgu.o /work/target/debug/build/libc-24a0c765ebd7d3cb/build_script_build-24a0c765ebd7d3cb.build_script_build.2cf7c5ec755a4f39-cgu.2.rcgu.o /work/target/debug/build/libc-24a0c765ebd7d3cb/build_script_build-24a0c765ebd7d3cb.build_script_build.2cf7c5ec755a4f39-cgu.3.rcgu.o /work/target/debug/build/libc-24a0c765ebd7d3cb/build_script_build-24a0c765ebd7d3cb.9x3fp7esgkeb4azbnju054438.rcgu.o -Wl,--as-needed -Wl,-Bstatic /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libstd-64f5f36fb0927694.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libpanic_unwind-549498e8b2e4d924.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libobject-7ff85ea729a864ff.rlib /usr/local/lib/rus	778 ms	144 ms	0
└toolchain /usr/libexec/gcc/x86_64-linux-gnu/14/collect2	-plugin /usr/libexec/gcc/x86_64-linux-gnu/14/liblto_plugin.so -plugin-opt=/usr/libexec/gcc/x86_64-linux-gnu/14/lto-wrapper -plugin-opt=-fresolution=/tmp/cccifvKr.res --build-id --eh-frame-hdr -m elf_x86_64 --hash-style=gnu --as-needed -dynamic-linker /lib64/ld-linux-x86-64.so.2 -pie -fuse-ld=lld -o /work/target/debug/build/libc-24a0c765ebd7d3cb/build_script_build-24a0c765ebd7d3cb /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/Scrt1.o /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/crti.o /usr/lib/gcc/x86_64-linux-gnu/14/crtbeginS.o -L/work/target/debug/build/libc-24a0c765ebd7d3cb/rustc7wmAot/raw-dylibs -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/bin/gcc-ld -L/usr/lib/gcc/x86_64-linux-gnu/14 -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../../lib -L/lib/x86_64-linux-gnu -L/lib/../lib -L/usr/lib/x86_64-linux-gnu -L/usr/lib/../li	786 ms	136 ms	0
└toolchain /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/bin/rust-lld	-flavor gnu -plugin /usr/libexec/gcc/x86_64-linux-gnu/14/liblto_plugin.so -plugin-opt=/usr/libexec/gcc/x86_64-linux-gnu/14/lto-wrapper -plugin-opt=-fresolution=/tmp/cccifvKr.res --build-id --eh-frame-hdr -m elf_x86_64 --hash-style=gnu --as-needed -dynamic-linker /lib64/ld-linux-x86-64.so.2 -pie -o /work/target/debug/build/libc-24a0c765ebd7d3cb/build_script_build-24a0c765ebd7d3cb /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/Scrt1.o /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/crti.o /usr/lib/gcc/x86_64-linux-gnu/14/crtbeginS.o -L/work/target/debug/build/libc-24a0c765ebd7d3cb/rustc7wmAot/raw-dylibs -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/bin/gcc-ld -L/usr/lib/gcc/x86_64-linux-gnu/14 -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../../lib -L/lib/x86_64-linux-gnu -L/lib/../lib -L/usr/lib/x86_64-linux-gnu -L	788 ms	132 ms	0
└build_script libc		929 ms	9 ms	0
└rustc /usr/local/bin/rustc	--version	930 ms	7 ms	0
└rustc /usr/local/bin/rustc ×49	--crate-name libc --edition=2021 /cw/vendor/libc-0.2.191/src/lib.rs --error-format=json --json=diagnostic-rendered-ansi,artifacts,future-incompat --crate-type lib --emit=dep-info,metadata,link -C embed-bitcode=no --allow=unused_qualifications --warn=clippy::unnecessary_semicolon --allow=clippy::unnecessary_cast --warn=clippy::ptr_as_ptr --allow=clippy::non_minimal_cfg --allow=clippy::missing_safety_doc --warn=clippy::map_unwrap_or --warn=clippy::manual_assert --allow=clippy::identity_op --warn=clippy::explicit_iter_loop --cfg feature="default" --cfg feature="std" --check-cfg cfg(docsrs,test) --check-cfg cfg(feature, values("align", "const-extern-fn", "default", "extra_traits", "rustc-dep-of-std", "rustc-std-workspace-core", "std", "use_std")) -C metadata=f380c4d05d342677	939 ms	1.0 s	0
└build_script proc-macro2		3.9 s	76 ms	0
└rustc /usr/local/bin/rustc ×3	--version	3.9 s	6 ms	0
└rustc /usr/local/bin/rustc	--cfg=procmacro2_build_probe --edition=2021 --crate-name=proc_macro2 --crate-type=lib --cap-lints=allow --emit=dep-info,metadata --out-dir /work/target/debug/build/proc-macro2-4f3f927bd5485a92/out/probe src/probe/proc_macro_span.rs --target x86_64-unknown-linux-gnu	3.9 s	29 ms	256
└build_script ring		4.0 s	1.8 s	0
└toolchain /usr/bin/cc ×2	-E /work/target/debug/build/ring-a1bdb3fff373a8f9/out/4333533550741687378detect_compiler_family.c	4.0 s	22 ms	0
└toolchain /usr/libexec/gcc/x86_64-linux-gnu/14/cc1	-E -quiet -imultiarch x86_64-linux-gnu /work/target/debug/build/ring-a1bdb3fff373a8f9/out/4333533550741687378detect_compiler_family.c -mtune=generic -march=x86-64 -fasynchronous-unwind-tables -dumpbase 4333533550741687378detect_compiler_family.c -dumpbase-ext .c	4.0 s	19 ms	0
└toolchain /usr/bin/cc ×2	-?	4.0 s	2 ms	256
└toolchain /usr/bin/cc ×30	-O0 -ffunction-sections -fdata-sections -fPIC -m64 -I /cw/vendor/ring-0.17.14/include -I /cw/vendor/ring-0.17.14/pregenerated -Wall -Wextra -fvisibility=hidden -std=c1x -Wall -Wbad-function-cast -Wcast-align -Wcast-qual -Wconversion -Wmissing-field-initializers -Wmissing-include-dirs -Wnested-externs -Wredundant-decls -Wshadow -Wsign-compare -Wsign-conversion -Wstrict-prototypes -Wundef -Wuninitialized -g3 -DNDEBUG -o	4.0 s	263 ms	0
└toolchain /usr/libexec/gcc/x86_64-linux-gnu/14/cc1	-quiet -I /cw/vendor/ring-0.17.14/include -I /cw/vendor/ring-0.17.14/pregenerated -imultiarch x86_64-linux-gnu -dD -D NDEBUG /cw/vendor/ring-0.17.14/crypto/curve25519/curve25519.c -quiet -dumpdir /work/target/debug/build/ring-a1bdb3fff373a8f9/out/ -dumpbase b9fed4bd5e786284-curve25519.c -dumpbase-ext .c -m64 -mtune=generic -march=x86-64 -g3 -O0 -Wextra -Wall -Wbad-function-cast -Wcast-align -Wcast-qual -Wconversion -Wmissing-field-initializers -Wmissing-include-dirs	4.0 s	235 ms	0
└toolchain /usr/bin/as	-I /cw/vendor/ring-0.17.14/include -I /cw/vendor/ring-0.17.14/pregenerated --gdwarf-5 --64 -o /work/target/debug/build/ring-a1bdb3fff373a8f9/out/b9fed4bd5e786284-curve25519.o /tmp/ccf4LFvF.s	4.3 s	24 ms	0
└toolchain /usr/bin/ar ×4	cqD /work/target/debug/build/ring-a1bdb3fff373a8f9/out/libring_core_0_17_14_.a /work/target/debug/build/ring-a1bdb3fff373a8f9/out/b9fed4bd5e786284-curve25519.o /work/target/debug/build/ring-a1bdb3fff373a8f9/out/2b18790154092d07-aes_nohw.o /work/target/debug/build/ring-a1bdb3fff373a8f9/out/20d6a080d7761227-montgomery.o /work/target/debug/build/ring-a1bdb3fff373a8f9/out/20d6a080d7761227-montgomery_inv.o /work/target/debug/build/ring-a1bdb3fff373a8f9/out/abdfa25550f18ac7-ecp_nistz.o /work/target/debug/build/ring-a1bdb3fff373a8f9/out/abdfa25550f18ac7-gfp_p256.o /work/target/debug/build/ring-a1bdb3fff373a8f9/out/abdfa25550f18ac7-gfp_p384.o /work/target/debug/build/ring-a1bdb3fff373a8f9/out/abdfa25550f18ac7-p256.o /work/target/debug/build/ring-a1bdb3fff373a8f9/out/9fa4cd275cb9daeb-limbs.o /work/target/debug/build/ring-a1bdb3fff373a8f9/out/8948ea8e62ee340e-mem.o /work/target/debug/build/ring-a1bdb3fff373a8f9/out/e288d65bf9bc9ef0-poly1305.o /work/target/debug/build/ring-a1bdb3fff373a8f9/out/8948ea8e62ee340e-crypt	5.7 s	20 ms	0
└build_script quote		6.8 s	9 ms	0
└rustc /usr/local/bin/rustc	--version	6.8 s	8 ms	0
└build_script rustix		7.2 s	34 ms	0
└rustc /usr/local/bin/rustc ×2	--crate-type=rlib --emit=metadata --target x86_64-unknown-linux-gnu -o /work/target/debug/build/rustix-d1a934849d48d427/out/rustix_test_can_compile -	7.2 s	15 ms	0
└build_script httparse		7.2 s	8 ms	0
└rustc /usr/local/bin/rustc	--version	7.2 s	7 ms	0
└build_script crc32fast		12.1 s	8 ms	0
└rustc /usr/local/bin/rustc	--version	12.1 s	7 ms	0
└build_script rustls		12.2 s	1 ms	0
└build_script anyhow		15.4 s	34 ms	0
└rustc /usr/local/bin/rustc	--cfg=anyhow_build_probe --edition=2018 --crate-name=anyhow --crate-type=lib --cap-lints=allow --emit=dep-info,metadata --out-dir /work/target/debug/build/anyhow-53d53971fb3aec2e/out/probe src/nightly.rs --target x86_64-unknown-linux-gnu	15.4 s	23 ms	256
└rustc /usr/local/bin/rustc	--version	15.4 s	7 ms	0
└build_script thiserror		19.4 s	26 ms	0
└rustc /usr/local/bin/rustc	--edition=2018 --crate-name=thiserror --crate-type=lib --cap-lints=allow --emit=dep-info,metadata --out-dir /work/target/debug/build/thiserror-3612222dcefb6f57/out/probe build/probe.rs --target x86_64-unknown-linux-gnu	19.4 s	16 ms	256
└rustc /usr/local/bin/rustc	--version	19.4 s	6 ms	0
└build_script cp2k-libxc-sys		25.3 s	50.1 s	25856
└other /usr/bin/curl ×4	-fL --retry 3 -o /work/target/debug/libxc-v7.1-stable/libxc-7.1.2.tar.bz2 https://gitlab.com/libxc/libxc/-/archive/7.1.2/libxc-7.1.2.tar.bz2	25.3 s	54 ms	5632

Network 5

The VM has no internet. Every name it looks up resolves to 10.0.2.1, the fake internet, which accepts every connection and records what was sent. Below, it is shown by its port alone, such as :443. The name the build wanted is in the lookups, the HTTP host and the TLS SNI.

Looked up gitlab.com

Destination	Protocol	What was sent	Bytes
:443	tls	SNI gitlab.com, inside TLS: GET /libxc/libxc/-/archive/7.1.2/libxc-7.1.2.tar.bz2, host gitlab.com, agent curl/8.14.1	1.5 KiB
:443	tls	SNI gitlab.com, inside TLS: GET /libxc/libxc/-/archive/7.1.2/libxc-7.1.2.tar.bz2, host gitlab.com, agent curl/8.14.1	1.5 KiB
:443	tls	SNI gitlab.com, inside TLS: GET /libxc/libxc/-/archive/7.1.2/libxc-7.1.2.tar.bz2, host gitlab.com, agent curl/8.14.1	1.5 KiB
:443	tls	SNI gitlab.com, inside TLS: GET /libxc/libxc/-/archive/7.1.2/libxc-7.1.2.tar.bz2, host gitlab.com, agent curl/8.14.1	1.5 KiB

Sockets in the trace 12

When	Program	How	Address	Type
25.3 s	/usr/bin/curl	connect	unix:/var/run/nscd/socket	stream
25.3 s	/usr/bin/curl	connect	:53	datagram
25.3 s	/usr/bin/curl	connect	:443	stream
30.4 s	/usr/bin/curl	connect	unix:/var/run/nscd/socket	stream
30.4 s	/usr/bin/curl	connect	:53	datagram
30.4 s	/usr/bin/curl	connect	:443	stream
40.4 s	/usr/bin/curl	connect	unix:/var/run/nscd/socket	stream
40.4 s	/usr/bin/curl	connect	:53	datagram
40.4 s	/usr/bin/curl	connect	:443	stream
55.4 s	/usr/bin/curl	connect	unix:/var/run/nscd/socket	stream
55.4 s	/usr/bin/curl	connect	:53	datagram
55.4 s	/usr/bin/curl	connect	:443	stream

Files 0

Secrets opened

None.

Written outside the build directories

None.

Scratch disk 0

Files: 537
Directories: 136
Size: 234.3 MiB
Compiled units: 99

Nothing outside the build areas.

Output

Standard error

   Compiling libc v0.2.191
   Compiling cfg-if v1.0.5
   Compiling shlex v2.0.1
   Compiling find-msvc-tools v0.1.15
   Compiling cc v1.10.0
   Compiling ring v0.17.14
   Compiling proc-macro2 v1.0.107
   Compiling quote v1.0.47
   Compiling unicode-ident v1.0.27
   Compiling zeroize v1.9.1
   Compiling rustls-pki-types v1.15.1
   Compiling getrandom v0.2.17
   Compiling untrusted v0.9.0
   Compiling httparse v1.10.1
   Compiling rustix v1.1.6
   Compiling bitflags v2.13.2
   Compiling bytes v1.12.1
   Compiling log v0.4.34
   Compiling rustls v0.23.46
   Compiling crc32fast v1.5.3
   Compiling itoa v1.0.18
   Compiling linux-raw-sys v0.12.1
   Compiling http v1.5.0
   Compiling syn v3.0.9
   Compiling rustls-webpki v0.103.16
   Compiling adler2 v2.0.1
   Compiling simd-adler32 v0.3.10
   Compiling subtle v2.6.1
   Compiling base64 v0.23.1
   Compiling thiserror v2.0.21
   Compiling once_cell v1.21.4
   Compiling anyhow v1.0.104
   Compiling ureq-proto v0.6.5
   Compiling miniz_oxide v0.9.1
   Compiling thiserror-impl v2.0.21
   Compiling xattr v1.7.0
   Compiling webpki-roots v1.0.11
   Compiling filetime v0.2.29
   Compiling num_cpus v1.17.0
   Compiling option-ext v0.2.0
   Compiling utf8-zero v0.8.1
   Compiling percent-encoding v2.3.2
   Compiling ureq v3.5.0
   Compiling dirs-sys v0.5.0
   Compiling cp2k-build-utils v2026.2.0
   Compiling tar v0.4.46
   Compiling flate2 v1.1.10
   Compiling openblas-build v0.10.16
   Compiling dirs v6.0.0
   Compiling pkg-config v0.3.34
   Compiling openblas-src v0.10.16
   Compiling cp2k-libxc-sys v2026.2.0
warning: cp2k-libxc-sys@2026.2.0: Downloading Libxc 7.1.2...
warning: cp2k-libxc-sys@2026.2.0: download attempt 1/4 for https://gitlab.com/libxc/libxc/-/archive/7.1.2/libxc-7.1.2.tar.bz2 failed; retrying
warning: cp2k-libxc-sys@2026.2.0: download attempt 2/4 for https://gitlab.com/libxc/libxc/-/archive/7.1.2/libxc-7.1.2.tar.bz2 failed; retrying
warning: cp2k-libxc-sys@2026.2.0: download attempt 3/4 for https://gitlab.com/libxc/libxc/-/archive/7.1.2/libxc-7.1.2.tar.bz2 failed; retrying
warning: cp2k-libxc-sys@2026.2.0: download attempt 4/4 for https://gitlab.com/libxc/libxc/-/archive/7.1.2/libxc-7.1.2.tar.bz2 failed; retrying
error: failed to run custom build command for `cp2k-libxc-sys v2026.2.0`

Caused by:
  process didn't exit successfully: `/work/target/debug/build/cp2k-libxc-sys-1afb0e05dacf0a05/build-script-build` (exit status: 101)
  --- stdout
  cargo:rerun-if-changed=build.rs
  cargo:rerun-if-env-changed=CP2K_TARGET_ARCH
  cargo:rerun-if-env-changed=CP2K_CUDA_ARCH
  cargo:rerun-if-env-changed=CP2K_HIP_ARCH
  cargo:warning=Downloading Libxc 7.1.2...
  cargo:warning=download attempt 1/4 for https://gitlab.com/libxc/libxc/-/archive/7.1.2/libxc-7.1.2.tar.bz2 failed; retrying
  cargo:warning=download attempt 2/4 for https://gitlab.com/libxc/libxc/-/archive/7.1.2/libxc-7.1.2.tar.bz2 failed; retrying
  cargo:warning=download attempt 3/4 for https://gitlab.com/libxc/libxc/-/archive/7.1.2/libxc-7.1.2.tar.bz2 failed; retrying
  cargo:warning=download attempt 4/4 for https://gitlab.com/libxc/libxc/-/archive/7.1.2/libxc-7.1.2.tar.bz2 failed; retrying

  --- stderr

  thread 'main' (1431) panicked at /cw/vendor/cp2k-build-utils-2026.2.0/src/lib.rs:285:5:
  Failed to download https://gitlab.com/libxc/libxc/-/archive/7.1.2/libxc-7.1.2.tar.bz2 after 4 attempts:   % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                   Dload  Upload   Total   Spent    Left  Speed
  
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
  curl: (22) The requested URL returned error: 404

  note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace

Timeline

When	From	To	Event	Worker
2026-10-28 15:50 UTC	Discovered	Fetched	fetched	fetcher-12688
2026-10-28 15:50 UTC	Fetched	ReadyForSandbox	static_analysis_completed	static-12726
2026-10-28 15:50 UTC	ReadyForSandbox	Running	sandbox_started	orchestrator-12760-slot2
2026-10-28 15:51 UTC	Running	DynamicallyAnalyzed	sandbox_completed	orchestrator-12760-slot2
2026-10-28 15:51 UTC	DynamicallyAnalyzed	Scored	scored	analyzer-12816
2026-10-28 15:51 UTC	Scored	Done	finalized	analyzer-12816