freya-core 0.5.0-rc.8

Done dynamic on Linux job 30935 crates.io SBOM Findings (VEX)

The build looked up github.com.

medium

Automated verdict. Nobody reviewed it. A score is a reason to look closer, not a finding.

Evidence

Points	Signal	Where	What
10	network_lookup network · freya-skia-bindings	github.com	The build looked up github.com.
10	network_lookup network · freya-skia-bindings	codeload.github.com	The build looked up codeload.github.com.
5	exec_downloader trace · freya-skia-bindings	/usr/bin/curl	The build ran /usr/bin/curl.
5	new_behavior diff · freya-core	exec:downloader	New since the previous version: exec:downloader.
5	new_behavior diff · freya-core	exec:interpreter	New since the previous version: exec:interpreter.
5	new_behavior diff · freya-core	net:codeload.github.com	New since the previous version: net:codeload.github.com.
5	new_behavior diff · freya-core	net:github.com	New since the previous version: net:github.com.
3	exec_interpreter trace · freya-skia-bindings	/usr/bin/python3	The build ran /usr/bin/python3.

Behavior

New since the previous version

exec:downloader exec:interpreter net:codeload.github.com net:github.com

Profile

exec:downloader exec:interpreter net:codeload.github.com net:github.com

Static findings

All 8 low 1 info 7 2 groups

low foreign_functions library 1

extern block src/io/timer.rs:19

info unsafe_code library 7

1 unsafe blocks, functions or impls src/elements/image.rs:168 src/extended_hashmap.rs:47
2 unsafe blocks, functions or impls src/io/timer.rs:28 src/user_event.rs:41
3 unsafe blocks, functions or impls src/lifecycle/memo.rs:58 src/lifecycle/state.rs:155
4 unsafe blocks, functions or impls src/style/shader.rs:22

Run: check

failed

Ended: agent reported the end
Guest: exit code 101
Run time: 51.5 s
VM restore: 65 ms
Payload: 11779 files, 309.9 MiB
Files opened: 11063

Processes 164

Siblings that ran the same program with the same result and the same processes below are folded into one row, with their number. Hide the 142 compiler processes (rustc, C toolchain)

Process	Arguments	Start	Took	Exit
cargo /usr/local/bin/cargo	check --locked --offline	5 ms	51.2 s	25856
└build_script proc-macro2		360 ms	400 ms	0
└rustc /usr/local/bin/rustc ×3	--version	362 ms	110 ms	0
└rustc /usr/local/bin/rustc	--cfg=procmacro2_build_probe --edition=2021 --crate-name=proc_macro2 --crate-type=lib --cap-lints=allow --emit=dep-info,metadata --out-dir /work/target/debug/build/proc-macro2-ea7d4b35dfd106d0/out/probe src/probe/proc_macro_span.rs --target x86_64-unknown-linux-gnu	473 ms	238 ms	256
└build_script quote		773 ms	9 ms	0
└rustc /usr/local/bin/rustc	--version	774 ms	7 ms	0
└rustc /usr/local/bin/rustc ×72	--crate-name proc_macro2 --edition=2021 /cw/vendor/proc-macro2-1.0.107/src/lib.rs --error-format=json --json=diagnostic-rendered-ansi,artifacts,future-incompat --crate-type lib --emit=dep-info,metadata,link -C embed-bitcode=no --cfg feature="default" --cfg feature="proc-macro" --check-cfg cfg(docsrs,test) --check-cfg cfg(feature, values("default", "nightly", "proc-macro", "span-locations")) -C metadata=d6303f2d6d2b4f35 -C extra-filename=-5d1a69abfd85ca7e --out-dir /work/target/debug/deps -L dependency=/work/target/debug/deps --extern unicode_ident=/work/target/debug/deps/libunicode_ident-76fddff3086055f2.rmeta --cap-lints allow	783 ms	656 ms	0
└rustc /usr/local/bin/rustc ×13	--crate-name serde_derive --edition=2021 /cw/vendor/serde_derive-1.0.229/src/lib.rs --error-format=json --json=diagnostic-rendered-ansi,artifacts,future-incompat --crate-type proc-macro --emit=dep-info,link -C prefer-dynamic -C embed-bitcode=no --cfg feature="default" --check-cfg cfg(docsrs,test) --check-cfg cfg(feature, values("default", "deserialize_in_place")) -C metadata=a7c602ab73e283e6 -C extra-filename=-67f47909f257f714 --out-dir /work/target/debug/deps -L dependency=/work/target/debug/deps --extern proc_macro2=/work/target/debug/deps/libproc_macro2-5d1a69abfd85ca7e.rlib --extern quote=/work/target/debug/deps/libquote-14318e9b26362138.rlib	7.0 s	2.2 s	0
└toolchain /usr/bin/cc	-Wl,--version-script=/work/target/debug/deps/rustcQDk7t5/list -Wl,--no-undefined-version -m64 /work/target/debug/deps/rustcQDk7t5/symbols.o /work/target/debug/deps/serde_derive-67f47909f257f714.serde_derive.fcfd42ff8a990930-cgu.00.rcgu.o /work/target/debug/deps/serde_derive-67f47909f257f714.serde_derive.fcfd42ff8a990930-cgu.01.rcgu.o /work/target/debug/deps/serde_derive-67f47909f257f714.serde_derive.fcfd42ff8a990930-cgu.02.rcgu.o /work/target/debug/deps/serde_derive-67f47909f257f714.serde_derive.fcfd42ff8a990930-cgu.03.rcgu.o /work/target/debug/deps/serde_derive-67f47909f257f714.serde_derive.fcfd42ff8a990930-cgu.04.rcgu.o /work/target/debug/deps/serde_derive-67f47909f257f714.serde_derive.fcfd42ff8a990930-cgu.05.rcgu.o /work/target/debug/deps/serde_derive-67f47909f257f714.serde_derive.fcfd42ff8a990930-cgu.06.rcgu.o /work/target/debug/deps/serde_derive-67f47909f257f714.serde_derive.fcfd42ff8a990930-cgu.07.rcgu.o /work/target/debug/deps/serde_derive-67f47909f257f714.serde_derive.fcfd42ff8a990930-cgu.08.rcgu.	9.1 s	156 ms	0
└toolchain /usr/libexec/gcc/x86_64-linux-gnu/14/collect2	-plugin /usr/libexec/gcc/x86_64-linux-gnu/14/liblto_plugin.so -plugin-opt=/usr/libexec/gcc/x86_64-linux-gnu/14/lto-wrapper -plugin-opt=-fresolution=/tmp/ccK0nwXo.res --build-id --eh-frame-hdr -m elf_x86_64 --hash-style=gnu --as-needed -shared -fuse-ld=lld -o /work/target/debug/deps/libserde_derive-67f47909f257f714.so /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/crti.o /usr/lib/gcc/x86_64-linux-gnu/14/crtbeginS.o -L/work/target/debug/deps/rustcQDk7t5/raw-dylibs -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/bin/gcc-ld -L/usr/lib/gcc/x86_64-linux-gnu/14 -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../../lib -L/lib/x86_64-linux-gnu -L/lib/../lib -L/usr/lib/x86_64-linux-gnu -L/usr/lib/../lib -L/usr/lib/gcc/x86_64-linux-gnu/14/../../.. --version-script=/work/target/debug/deps/rustcQDk7t5/list --no-undefined-version /work/target/debug/deps/rus	9.1 s	149 ms	0
└toolchain /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/bin/rust-lld	-flavor gnu -plugin /usr/libexec/gcc/x86_64-linux-gnu/14/liblto_plugin.so -plugin-opt=/usr/libexec/gcc/x86_64-linux-gnu/14/lto-wrapper -plugin-opt=-fresolution=/tmp/ccK0nwXo.res --build-id --eh-frame-hdr -m elf_x86_64 --hash-style=gnu --as-needed -shared -o /work/target/debug/deps/libserde_derive-67f47909f257f714.so /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/crti.o /usr/lib/gcc/x86_64-linux-gnu/14/crtbeginS.o -L/work/target/debug/deps/rustcQDk7t5/raw-dylibs -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/bin/gcc-ld -L/usr/lib/gcc/x86_64-linux-gnu/14 -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../../lib -L/lib/x86_64-linux-gnu -L/lib/../lib -L/usr/lib/x86_64-linux-gnu -L/usr/lib/../lib -L/usr/lib/gcc/x86_64-linux-gnu/14/../../.. --version-script=/work/target/debug/deps/rustcQDk7t5/list --no-undefined-version /work/target/	9.1 s	145 ms	0
└build_script crossbeam-utils		14.4 s	1 ms	0
└build_script prettyplease		17.1 s	2 ms	0
└build_script rustix		17.1 s	36 ms	0
└rustc /usr/local/bin/rustc ×2	--crate-type=rlib --emit=metadata --target x86_64-unknown-linux-gnu -o /work/target/debug/build/rustix-91fad39b65314a2d/out/rustix_test_can_compile -	17.1 s	16 ms	0
└build_script clang-sys		17.5 s	2 ms	0
└build_script rustix		26.1 s	36 ms	0
└rustc /usr/local/bin/rustc ×2	--crate-type=rlib --emit=metadata --target x86_64-unknown-linux-gnu -o /work/target/debug/build/rustix-e4671d5fcdbad6f0/out/rustix_test_can_compile -	26.1 s	17 ms	0
└build_script crc32fast		27.4 s	10 ms	0
└rustc /usr/local/bin/rustc	--version	27.4 s	7 ms	0
└build_script bindgen		32.1 s	2 ms	0
└build_script async-io		42.9 s	22 ms	0
└rustc /usr/local/bin/rustc ×2	--version --verbose	42.9 s	7 ms	0
└rustc /usr/local/bin/rustc ×3	--crate-name zvariant --edition=2024 /cw/vendor/zvariant-5.15.0/src/lib.rs --error-format=json --json=diagnostic-rendered-ansi,artifacts,future-incompat --crate-type lib --emit=dep-info,metadata,link -C embed-bitcode=no --warn=unexpected_cfgs --check-cfg cfg(tokio_unstable) --cfg feature="default" --cfg feature="enumflags2" --check-cfg cfg(docsrs,test) --check-cfg cfg(feature, values("arrayvec", "camino", "chrono", "default", "enumflags2", "gvariant", "heapless", "option-as-array", "ostree-tests", "serde_bytes", "time", "url", "uuid")) -C metadata=a2fdac3cafbf34bb -C extra-filename=-bedd44819973a35f --out-dir /work/target/debug/deps -L dependency=/work/target/debug/deps --extern	47.1 s	1.5 s	0
└cargo /usr/local/bin/cargo	locate-project --workspace --message-format=plain --manifest-path=/cw/vendor/zvariant-5.15.0/Cargo.toml	47.2 s	12 ms	0
└build_script num-traits		48.7 s	45 ms	0
└rustc /usr/local/bin/rustc ×3	--version --verbose	48.7 s	7 ms	0
└build_script freya-skia-bindings		51.1 s	100 ms	25856
└other /usr/bin/pkg-config ×2	--libs --cflags freetype2	51.1 s	3 ms	256
└other /usr/bin/curl ×2	-L -f -sS -C - --create-dirs --output /work/target/debug/build/freya-skia-bindings-997847ed3a62d073/out/.cache/skia-binaries-c31b06a7031231446314-x86_64-unknown-linux-gnu-jpegd-jpege-svg-textlayout-webpd-webpe.tar.gz https://github.com/marc2332/rust-skia/releases/download/0.100.0-beta.1/skia-binaries-c31b06a7031231446314-x86_64-unknown-linux-gnu-jpegd-jpege-svg-textlayout-webpd-webpe.tar.gz	51.1 s	53 ms	5632
└unknown		51.2 s	0 ms	32512
└other /usr/bin/python3	--version	51.2 s	20 ms	0

Network 4

The VM has no internet. Every name it looks up resolves to 10.0.2.1, the fake internet, which accepts every connection and records what was sent. Below, it is shown by its port alone, such as :443. The name the build wanted is in the lookups, the HTTP host and the TLS SNI.

Looked up github.com codeload.github.com

Destination	Protocol	What was sent	Bytes
:443	tls	SNI github.com, inside TLS: GET /marc2332/rust-skia/releases/download/0.100.0-beta.1/skia-binaries-c31b06a7031231446314-x86_64-unknown-linux-gnu-jpegd-jpege-svg-textlayout-webpd-webpe.tar.gz, host github.com, agent curl/8.14.1	1.5 KiB
:443	tls	SNI codeload.github.com, inside TLS: GET /rust-skia/skia/tar.gz/m153-0.101.2, host codeload.github.com, agent curl/8.14.1	1.5 KiB

Sockets in the trace 6

When	Program	How	Address	Type
51.1 s	/usr/bin/curl	connect	unix:/var/run/nscd/socket	stream
51.1 s	/usr/bin/curl	connect	:53	datagram
51.1 s	/usr/bin/curl	connect	:443	stream
51.2 s	/usr/bin/curl	connect	unix:/var/run/nscd/socket	stream
51.2 s	/usr/bin/curl	connect	:53	datagram
51.2 s	/usr/bin/curl	connect	:443	stream

Files 0

Secrets opened

None.

Written outside the build directories

None.

Scratch disk 0

Files: 683
Directories: 211
Size: 440.8 MiB
Compiled units: 127
Scan: stopped at a limit

Nothing outside the build areas.

Output

Standard error

   Compiling proc-macro2 v1.0.107
   Compiling quote v1.0.47
   Compiling syn v3.0.6
   Compiling winnow v1.0.4
   Compiling toml_parser v1.1.3+spec-1.1.0
   Compiling toml_datetime v1.1.1+spec-1.1.0
   Compiling serde_derive v1.0.229
   Compiling syn v2.0.119
    Checking parking v2.2.1
   Compiling cfg-if v1.0.5
   Compiling serde v1.0.229
   Compiling crossbeam-utils v0.8.23
   Compiling hashbrown v0.17.1
   Compiling equivalent v1.0.2
   Compiling indexmap v2.14.2
   Compiling glob v0.3.4
   Compiling clang-sys v1.9.1
   Compiling toml_edit v0.25.15+spec-1.1.0
   Compiling enumflags2_derive v0.7.12
   Compiling libc v0.2.189
    Checking futures-io v0.3.34
   Compiling rustix v1.1.5
   Compiling bitflags v2.13.2
   Compiling prettyplease v0.3.0
   Compiling proc-macro-crate v3.5.0
    Checking concurrent-queue v2.5.0
   Compiling zvariant_utils v4.2.0
   Compiling aho-corasick v1.1.5
    Checking event-listener v5.4.2
   Compiling linux-raw-sys v0.12.1
   Compiling minimal-lexical v0.2.1
   Compiling regex-syntax v0.8.11
   Compiling regex-automata v0.4.18
   Compiling nom v7.1.3
   Compiling crc32fast v1.5.2
    Checking event-listener-strategy v0.5.4
   Compiling zvariant_derive v5.15.0
    Checking futures-lite v2.6.1
   Compiling libloading v0.8.9
   Compiling adler2 v2.0.1
   Compiling simd-adler32 v0.3.10
    Checking slab v0.4.12
   Compiling bindgen v0.73.2
   Compiling miniz_oxide v0.9.1
   Compiling xattr v1.6.1
   Compiling cexpr v0.6.0
   Compiling regex v1.13.1
   Compiling filetime v0.2.29
   Compiling async-io v2.6.0
   Compiling tracing-attributes v0.1.31
   Compiling rustc-hash v2.1.3
   Compiling log v0.4.34
   Compiling toml v1.1.6+spec-1.1.0
    Checking tracing v0.1.44
   Compiling tar v0.4.46
   Compiling flate2 v1.1.10
    Checking polling v3.11.0
   Compiling enumflags2 v0.7.12
   Compiling zcheapstr v1.1.0
   Compiling num-traits v0.2.19
   Compiling endi v1.1.1
    Checking async-task v4.7.1
   Compiling pkg-config v0.3.34
   Compiling freya-skia-bindings v0.100.0-beta.1
   Compiling zvariant v5.15.0
    Checking async-channel v2.5.0
    Checking piper v0.2.5
    Checking async-signal v0.2.14
   Compiling zbus_names v4.3.4
error: failed to run custom build command for `freya-skia-bindings v0.100.0-beta.1`

Caused by:
  process didn't exit successfully: `/work/target/debug/build/freya-skia-bindings-94953112c8f4eada/build-script-build` (exit status: 101)
  --- stdout
  cargo:rerun-if-env-changed=DOCS_RS
  cargo:rerun-if-env-changed=SKIA_DEBUG
  cargo:rerun-if-env-changed=FREETYPE2_NO_PKG_CONFIG
  cargo:rerun-if-env-changed=PKG_CONFIG_x86_64-unknown-linux-gnu
  cargo:rerun-if-env-changed=PKG_CONFIG_x86_64_unknown_linux_gnu
  cargo:rerun-if-env-changed=HOST_PKG_CONFIG
  cargo:rerun-if-env-changed=PKG_CONFIG
  cargo:rerun-if-env-changed=FREETYPE2_STATIC
  cargo:rerun-if-env-changed=FREETYPE2_DYNAMIC
  cargo:rerun-if-env-changed=PKG_CONFIG_ALL_STATIC
  cargo:rerun-if-env-changed=PKG_CONFIG_ALL_DYNAMIC
  cargo:rerun-if-env-changed=PKG_CONFIG_PATH_x86_64-unknown-linux-gnu
  cargo:rerun-if-env-changed=PKG_CONFIG_PATH_x86_64_unknown_linux_gnu
  cargo:rerun-if-env-changed=HOST_PKG_CONFIG_PATH
  cargo:rerun-if-env-changed=PKG_CONFIG_PATH
  cargo:rerun-if-env-changed=PKG_CONFIG_LIBDIR_x86_64-unknown-linux-gnu
  cargo:rerun-if-env-changed=PKG_CONFIG_LIBDIR_x86_64_unknown_linux_gnu
  cargo:rerun-if-env-changed=HOST_PKG_CONFIG_LIBDIR
  cargo:rerun-if-env-changed=PKG_CONFIG_LIBDIR
  cargo:rerun-if-env-changed=PKG_CONFIG_SYSROOT_DIR_x86_64-unknown-linux-gnu
  cargo:rerun-if-env-changed=PKG_CONFIG_SYSROOT_DIR_x86_64_unknown_linux_gnu
  cargo:rerun-if-env-changed=HOST_PKG_CONFIG_SYSROOT_DIR
  cargo:rerun-if-env-changed=PKG_CONFIG_SYSROOT_DIR
  cargo:rerun-if-env-changed=FONTCONFIG_NO_PKG_CONFIG
  cargo:rerun-if-env-changed=PKG_CONFIG_x86_64-unknown-linux-gnu
  cargo:rerun-if-env-changed=PKG_CONFIG_x86_64_unknown_linux_gnu
  cargo:rerun-if-env-changed=HOST_PKG_CONFIG
  cargo:rerun-if-env-changed=PKG_CONFIG
  cargo:rerun-if-env-changed=FONTCONFIG_STATIC
  cargo:rerun-if-env-changed=FONTCONFIG_DYNAMIC
  cargo:rerun-if-env-changed=PKG_CONFIG_ALL_STATIC
  cargo:rerun-if-env-changed=PKG_CONFIG_ALL_DYNAMIC
  cargo:rerun-if-env-changed=PKG_CONFIG_PATH_x86_64-unknown-linux-gnu
  cargo:rerun-if-env-changed=PKG_CONFIG_PATH_x86_64_unknown_linux_gnu
  cargo:rerun-if-env-changed=HOST_PKG_CONFIG_PATH
  cargo:rerun-if-env-changed=PKG_CONFIG_PATH
  cargo:rerun-if-env-changed=PKG_CONFIG_LIBDIR_x86_64-unknown-linux-gnu
  cargo:rerun-if-env-changed=PKG_CONFIG_LIBDIR_x86_64_unknown_linux_gnu
  cargo:rerun-if-env-changed=HOST_PKG_CONFIG_LIBDIR
  cargo:rerun-if-env-changed=PKG_CONFIG_LIBDIR
  cargo:rerun-if-env-changed=PKG_CONFIG_SYSROOT_DIR_x86_64-unknown-linux-gnu
  cargo:rerun-if-env-changed=PKG_CONFIG_SYSROOT_DIR_x86_64_unknown_linux_gnu
  cargo:rerun-if-env-changed=HOST_PKG_CONFIG_SYSROOT_DIR
  cargo:rerun-if-env-changed=PKG_CONFIG_SYSROOT_DIR
  cargo:rerun-if-env-changed=SKIA_USE_SYSTEM_LIBRARIES
  cargo:rerun-if-env-changed=SKIA_USE_SYSTEM_LIBRARIES
  cargo:rerun-if-env-changed=SKIA_SOURCE_DIR
  cargo:rerun-if-env-changed=FORCE_SKIA_BUILD
  cargo:rerun-if-env-changed=FORCE_SKIA_BINARIES_DOWNLOAD
  TRYING TO DOWNLOAD AND INSTALL SKIA BINARIES: 0.100.0-beta.1/c31b06a7031231446314-x86_64-unknown-linux-gnu-jpegd-jpege-svg-textlayout-webpd-webpe
  cargo:rerun-if-env-changed=SKIA_BINARIES_URL
    FROM: https://github.com/marc2332/rust-skia/releases/download/0.100.0-beta.1/skia-binaries-c31b06a7031231446314-x86_64-unknown-linux-gnu-jpegd-jpege-svg-textlayout-webpd-webpe.tar.gz
  DOWNLOAD AND INSTALL FAILED: curl error code: "22"
  curl stderr: "curl: (22) The requested URL returned error: 404\n"
  STARTING A FULL BUILD
  HOST: x86_64-unknown-linux-gnu
  cargo:rerun-if-env-changed=CLANGCC
  cargo:rerun-if-env-changed=CC
  cargo:rerun-if-env-changed=CLANGCXX
  cargo:rerun-if-env-changed=CXX
  cargo:rerun-if-env-changed=OPT_LEVEL
  cargo:rerun-if-env-changed=SKIA_USE_SYSTEM_LIBRARIES
  cargo:rerun-if-env-changed=SDKTARGETSYSROOT
  cargo:rerun-if-env-changed=SDKROOT
  cargo:rerun-if-env-changed=SKIA_NINJA_COMMAND
  cargo:rerun-if-env-changed=SKIA_GN_COMMAND
  Probing 'python'
  Probing 'python3'
  Python 3 found: "python3"
  Synchronizing Skia dependencies
  DOWNLOADING: https://codeload.github.com/rust-skia/skia/tar.gz/m153-0.101.2

  --- stderr

  thread 'main' (1557) panicked at /cw/vendor/freya-skia-bindings-0.100.0-beta.1/build_support/binary_cache/download.rs:81:35:
  Failed to download https://codeload.github.com/rust-skia/skia/tar.gz/m153-0.101.2 (curl error code: "22"
  curl stderr: "curl: (22) The requested URL returned error: 404\n")
  note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace

Timeline

When	From	To	Event	Worker
2026-09-29 12:25 UTC	Discovered	Fetched	fetched	fetcher-627152
2026-09-29 12:25 UTC	Fetched	ReadyForSandbox	static_analysis_completed	static-450252
2026-09-29 12:25 UTC	ReadyForSandbox	Running	sandbox_started	orchestrator-639812-slot1
2026-09-29 12:26 UTC	Running	DynamicallyAnalyzed	sandbox_completed	orchestrator-639812-slot1
2026-09-29 12:26 UTC	DynamicallyAnalyzed	Scored	scored	analyzer-523934
2026-09-29 12:26 UTC	Scored	Done	finalized	analyzer-523934