cp2k-spfft-sys 2026.2.0

Done dynamic on Linux job 301490 crates.io SBOM Findings (VEX) Compare with 0.3.2

high severity downloader_pattern in build_script code: https://github.com/eth-cscs/SpFFT/archive/17ddf73fe65547f93a5439185baf10cd7b49532f.tar.gz at build.rs:74 with std::process::Command::new at build.rs:83

high

False positive. A person reviewed this verdict and found the crate benign. The evidence below is what the analysis saw.

Evidence

Points	Signal	Where	What
30	static:downloader_pattern static · cp2k-spfft-sys	build.rs:74	high severity downloader_pattern in build_script code: https://github.com/eth-cscs/SpFFT/archive/17ddf73fe65547f93a5439185baf10cd7b49532f.tar.gz at build.rs:74 with std::process::Command::new at build.rs:83
10	network_lookup network · cp2k-pugixml-sys	github.com	The build looked up github.com.
5	exec_downloader trace · cp2k-pugixml-sys	/usr/bin/curl	The build ran /usr/bin/curl.
5	new_behavior diff · cp2k-spfft-sys	net:github.com	New since the previous version: net:github.com.

3 without points

Signal	Where	What
static:build_script static · cp2k-spfft-sys	build.rs	low severity build_script in build_script code: build.rs
static:process_spawn static · cp2k-spfft-sys	build.rs:83	medium severity process_spawn in build_script code (4 places): std::process::Command::new
static:url_literal static · cp2k-spfft-sys	build.rs:74	low severity url_literal in build_script code: https://github.com/eth-cscs/SpFFT/archive/17ddf73fe65547f93a5439185baf10cd7b49532f.tar.gz

Behavior

New since the previous version

net:github.com

Profile

exec:downloader net:github.com static:downloader_pattern static:process_spawn

Static findings

high downloader_pattern build_script 1

https://github.com/eth-cscs/SpFFT/archive/17ddf73fe65547f93a5439185baf10cd7b49532f.tar.gz at build.rs:74 with std::process::Command::new at build.rs:83 build.rs:74

medium process_spawn build_script 4

std::process::Command::new build.rs:83 build.rs:104 build.rs:147 build.rs:155

low build_script build_script 1

build.rs build.rs

low url_literal build_script 1

https://github.com/eth-cscs/SpFFT/archive/17ddf73fe65547f93a5439185baf10cd7b49532f.tar.gz build.rs:74

info native_link build_script 1

links = "cp2k_spfft" Cargo.toml

Run: full

failed

The full build covers everything the earlier cargo check run did, so only the full run is shown.

Ended: agent reported the end
Guest: exit code 101
Run time: 52.4 s
VM restore: 63 ms
Payload: 527 files, 4.5 MiB
Files opened: 1105

Processes 23

Siblings that ran the same program with the same result and the same processes below are folded into one row, with their number. Hide the 16 compiler processes (rustc, C toolchain)

Process	Arguments	Start	Took	Exit
cargo /usr/local/bin/cargo	build --locked --offline	5 ms	52.4 s	25856
└rustc /usr/local/bin/rustc ×3	--crate-name build_script_build --edition=2021 /cw/vendor/libc-0.2.191/build.rs --error-format=json --json=diagnostic-rendered-ansi,artifacts,future-incompat --crate-type bin --emit=dep-info,link -C embed-bitcode=no --allow=unused_qualifications --warn=clippy::unnecessary_semicolon --allow=clippy::unnecessary_cast --warn=clippy::ptr_as_ptr --allow=clippy::non_minimal_cfg --allow=clippy::missing_safety_doc --warn=clippy::map_unwrap_or --warn=clippy::manual_assert --allow=clippy::identity_op --warn=clippy::explicit_iter_loop --cfg feature="default" --cfg feature="std" --check-cfg cfg(docsrs,test) --check-cfg cfg(feature, values("align", "const-extern-fn", "default", "extra_traits", "rustc-dep-of-std", "rustc-std-workspace-core", "std", "use_std")) -C metadata=f2b3c09777387306	120 ms	816 ms	0
└toolchain /usr/bin/cc	-m64 /work/target/debug/build/libc-24a0c765ebd7d3cb/rustcp8bYl5/symbols.o /work/target/debug/build/libc-24a0c765ebd7d3cb/build_script_build-24a0c765ebd7d3cb.build_script_build.2cf7c5ec755a4f39-cgu.0.rcgu.o /work/target/debug/build/libc-24a0c765ebd7d3cb/build_script_build-24a0c765ebd7d3cb.build_script_build.2cf7c5ec755a4f39-cgu.1.rcgu.o /work/target/debug/build/libc-24a0c765ebd7d3cb/build_script_build-24a0c765ebd7d3cb.build_script_build.2cf7c5ec755a4f39-cgu.2.rcgu.o /work/target/debug/build/libc-24a0c765ebd7d3cb/build_script_build-24a0c765ebd7d3cb.build_script_build.2cf7c5ec755a4f39-cgu.3.rcgu.o /work/target/debug/build/libc-24a0c765ebd7d3cb/build_script_build-24a0c765ebd7d3cb.9x3fp7esgkeb4azbnju054438.rcgu.o -Wl,--as-needed -Wl,-Bstatic /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libstd-64f5f36fb0927694.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libpanic_unwind-549498e8b2e4d924.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libobject-7ff85ea729a864ff.rlib /usr/local/lib/rus	774 ms	158 ms	0
└toolchain /usr/libexec/gcc/x86_64-linux-gnu/14/collect2	-plugin /usr/libexec/gcc/x86_64-linux-gnu/14/liblto_plugin.so -plugin-opt=/usr/libexec/gcc/x86_64-linux-gnu/14/lto-wrapper -plugin-opt=-fresolution=/tmp/cc7QRXPh.res --build-id --eh-frame-hdr -m elf_x86_64 --hash-style=gnu --as-needed -dynamic-linker /lib64/ld-linux-x86-64.so.2 -pie -fuse-ld=lld -o /work/target/debug/build/libc-24a0c765ebd7d3cb/build_script_build-24a0c765ebd7d3cb /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/Scrt1.o /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/crti.o /usr/lib/gcc/x86_64-linux-gnu/14/crtbeginS.o -L/work/target/debug/build/libc-24a0c765ebd7d3cb/rustcp8bYl5/raw-dylibs -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/bin/gcc-ld -L/usr/lib/gcc/x86_64-linux-gnu/14 -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../../lib -L/lib/x86_64-linux-gnu -L/lib/../lib -L/usr/lib/x86_64-linux-gnu -L/usr/lib/../li	781 ms	151 ms	0
└toolchain /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/bin/rust-lld	-flavor gnu -plugin /usr/libexec/gcc/x86_64-linux-gnu/14/liblto_plugin.so -plugin-opt=/usr/libexec/gcc/x86_64-linux-gnu/14/lto-wrapper -plugin-opt=-fresolution=/tmp/cc7QRXPh.res --build-id --eh-frame-hdr -m elf_x86_64 --hash-style=gnu --as-needed -dynamic-linker /lib64/ld-linux-x86-64.so.2 -pie -o /work/target/debug/build/libc-24a0c765ebd7d3cb/build_script_build-24a0c765ebd7d3cb /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/Scrt1.o /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/crti.o /usr/lib/gcc/x86_64-linux-gnu/14/crtbeginS.o -L/work/target/debug/build/libc-24a0c765ebd7d3cb/rustcp8bYl5/raw-dylibs -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/bin/gcc-ld -L/usr/lib/gcc/x86_64-linux-gnu/14 -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../../lib -L/lib/x86_64-linux-gnu -L/lib/../lib -L/usr/lib/x86_64-linux-gnu -L	784 ms	147 ms	0
└build_script libc		940 ms	9 ms	0
└rustc /usr/local/bin/rustc	--version	941 ms	7 ms	0
└rustc /usr/local/bin/rustc ×3	--crate-name libc --edition=2021 /cw/vendor/libc-0.2.191/src/lib.rs --error-format=json --json=diagnostic-rendered-ansi,artifacts,future-incompat --crate-type lib --emit=dep-info,metadata,link -C embed-bitcode=no --allow=unused_qualifications --warn=clippy::unnecessary_semicolon --allow=clippy::unnecessary_cast --warn=clippy::ptr_as_ptr --allow=clippy::non_minimal_cfg --allow=clippy::missing_safety_doc --warn=clippy::map_unwrap_or --warn=clippy::manual_assert --allow=clippy::identity_op --warn=clippy::explicit_iter_loop --cfg feature="default" --cfg feature="std" --check-cfg cfg(docsrs,test) --check-cfg cfg(feature, values("align", "const-extern-fn", "default", "extra_traits", "rustc-dep-of-std", "rustc-std-workspace-core", "std", "use_std")) -C metadata=f380c4d05d342677	950 ms	853 ms	0
└build_script cp2k-pugixml-sys		2.2 s	50.1 s	25856
└other /usr/bin/curl ×4	-fL --retry 3 -o /work/target/debug/pugixml-stable/pugixml-1.15.tar.gz https://github.com/zeux/pugixml/archive/refs/tags/v1.15.tar.gz	2.2 s	67 ms	5632

Network 5

The VM has no internet. Every name it looks up resolves to 10.0.2.1, the fake internet, which accepts every connection and records what was sent. Below, it is shown by its port alone, such as :443. The name the build wanted is in the lookups, the HTTP host and the TLS SNI.

Looked up github.com

Destination	Protocol	What was sent	Bytes
:443	tls	SNI github.com, inside TLS: GET /zeux/pugixml/archive/refs/tags/v1.15.tar.gz, host github.com, agent curl/8.14.1	1.5 KiB
:443	tls	SNI github.com, inside TLS: GET /zeux/pugixml/archive/refs/tags/v1.15.tar.gz, host github.com, agent curl/8.14.1	1.5 KiB
:443	tls	SNI github.com, inside TLS: GET /zeux/pugixml/archive/refs/tags/v1.15.tar.gz, host github.com, agent curl/8.14.1	1.5 KiB
:443	tls	SNI github.com, inside TLS: GET /zeux/pugixml/archive/refs/tags/v1.15.tar.gz, host github.com, agent curl/8.14.1	1.5 KiB

Sockets in the trace 12

When	Program	How	Address	Type
2.3 s	/usr/bin/curl	connect	unix:/var/run/nscd/socket	stream
2.3 s	/usr/bin/curl	connect	:53	datagram
2.3 s	/usr/bin/curl	connect	:443	stream
7.3 s	/usr/bin/curl	connect	unix:/var/run/nscd/socket	stream
7.3 s	/usr/bin/curl	connect	:53	datagram
7.3 s	/usr/bin/curl	connect	:443	stream
17.3 s	/usr/bin/curl	connect	unix:/var/run/nscd/socket	stream
17.3 s	/usr/bin/curl	connect	:53	datagram
17.3 s	/usr/bin/curl	connect	:443	stream
32.3 s	/usr/bin/curl	connect	unix:/var/run/nscd/socket	stream
32.3 s	/usr/bin/curl	connect	:53	datagram
32.3 s	/usr/bin/curl	connect	:443	stream

Files 0

Secrets opened

None.

Written outside the build directories

None.

Scratch disk 0

Files: 60
Directories: 44
Size: 36.4 MiB
Compiled units: 6

Nothing outside the build areas.

Output

Standard error

   Compiling libc v0.2.191
   Compiling num_cpus v1.17.0
   Compiling cp2k-build-utils v2026.2.0
   Compiling cp2k-fftw3-sys v2026.2.0
   Compiling cp2k-pugixml-sys v2026.2.0
warning: cp2k-pugixml-sys@2026.2.0: Downloading pugixml 1.15...
warning: cp2k-pugixml-sys@2026.2.0: download attempt 1/4 for https://github.com/zeux/pugixml/archive/refs/tags/v1.15.tar.gz failed; retrying
warning: cp2k-pugixml-sys@2026.2.0: download attempt 2/4 for https://github.com/zeux/pugixml/archive/refs/tags/v1.15.tar.gz failed; retrying
warning: cp2k-pugixml-sys@2026.2.0: download attempt 3/4 for https://github.com/zeux/pugixml/archive/refs/tags/v1.15.tar.gz failed; retrying
warning: cp2k-pugixml-sys@2026.2.0: download attempt 4/4 for https://github.com/zeux/pugixml/archive/refs/tags/v1.15.tar.gz failed; retrying
error: failed to run custom build command for `cp2k-pugixml-sys v2026.2.0`

Caused by:
  process didn't exit successfully: `/work/target/debug/build/cp2k-pugixml-sys-c0eb7fed0eb62073/build-script-build` (exit status: 101)
  --- stdout
  cargo:rerun-if-changed=build.rs
  cargo:warning=Downloading pugixml 1.15...
  cargo:warning=download attempt 1/4 for https://github.com/zeux/pugixml/archive/refs/tags/v1.15.tar.gz failed; retrying
  cargo:warning=download attempt 2/4 for https://github.com/zeux/pugixml/archive/refs/tags/v1.15.tar.gz failed; retrying
  cargo:warning=download attempt 3/4 for https://github.com/zeux/pugixml/archive/refs/tags/v1.15.tar.gz failed; retrying
  cargo:warning=download attempt 4/4 for https://github.com/zeux/pugixml/archive/refs/tags/v1.15.tar.gz failed; retrying

  --- stderr

  thread 'main' (647) panicked at /cw/vendor/cp2k-build-utils-2026.2.0/src/lib.rs:285:5:
  Failed to download https://github.com/zeux/pugixml/archive/refs/tags/v1.15.tar.gz after 4 attempts:   % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                   Dload  Upload   Total   Spent    Left  Speed
  
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
  curl: (22) The requested URL returned error: 404

  note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace

Timeline

When	From	To	Event	Worker
2026-10-28 16:07 UTC	Discovered	Fetched	fetched	fetcher-12688
2026-10-28 16:07 UTC	Fetched	ReadyForSandbox	static_analysis_completed	static-12726
2026-10-28 16:07 UTC	ReadyForSandbox	Running	sandbox_started	orchestrator-12760-slot0
2026-10-28 16:08 UTC	Running	DynamicallyAnalyzed	sandbox_completed	orchestrator-12760-slot0
2026-10-28 16:08 UTC	DynamicallyAnalyzed	ReadyForSandbox	scored	analyzer-12816
2026-10-28 16:08 UTC	ReadyForSandbox	Running	sandbox_started	orchestrator-12760-slot2
2026-10-28 16:08 UTC	Running	DynamicallyAnalyzed	sandbox_completed	orchestrator-12760-slot2
2026-10-28 16:09 UTC	DynamicallyAnalyzed	Scored	scored	analyzer-12816
2026-10-28 16:09 UTC	Scored	Done	finalized	analyzer-12816