Crateward

freya-sdk 0.5.0-rc.8

Done dynamic on Linux job 30951 crates.io SBOM Findings (VEX)

The build looked up github.com.

48
medium
Automated verdict. Nobody reviewed it. A score is a reason to look closer, not a finding.

Evidence

PointsSignalWhereWhat
10network_lookup
network · freya-skia-bindings
github.comThe build looked up github.com.
10network_lookup
network · freya-skia-bindings
codeload.github.comThe build looked up codeload.github.com.
5exec_downloader
trace · freya-skia-bindings
/usr/bin/curlThe build ran /usr/bin/curl.
5new_behavior
diff · freya-sdk
exec:downloaderNew since the previous version: exec:downloader.
5new_behavior
diff · freya-sdk
exec:interpreterNew since the previous version: exec:interpreter.
5new_behavior
diff · freya-sdk
net:codeload.github.comNew since the previous version: net:codeload.github.com.
5new_behavior
diff · freya-sdk
net:github.comNew since the previous version: net:github.com.
3exec_interpreter
trace · freya-skia-bindings
/usr/bin/python3The build ran /usr/bin/python3.

Behavior

New since the previous version

exec:downloader exec:interpreter net:codeload.github.com net:github.com

Profile

exec:downloader exec:interpreter net:codeload.github.com net:github.com

Static findings

None.

Run: check

failed
Ended
agent reported the end
Guest
exit code 101
Run time
51.1 s
VM restore
68 ms
Payload
11789 files, 309.9 MiB
Files opened
11065

Processes 164

Siblings that ran the same program with the same result and the same processes below are folded into one row, with their number.

ProcessArgumentsStartTookExit
cargo /usr/local/bin/cargo check --locked --offline 5 ms 50.9 s 25856
└build_script proc-macro2 363 ms 391 ms 0
└rustc /usr/local/bin/rustc ×3 --version 365 ms 112 ms 0
└rustc /usr/local/bin/rustc --cfg=procmacro2_build_probe --edition=2021 --crate-name=proc_macro2 --crate-type=lib --cap-lints=allow --emit=dep-info,metadata --out-dir /work/target/debug/build/proc-macro2-ea7d4b35dfd106d0/out/probe src/probe/proc_macro_span.rs --target x86_64-unknown-linux-gnu 478 ms 233 ms 256
└build_script quote 774 ms 9 ms 0
└rustc /usr/local/bin/rustc --version 775 ms 7 ms 0
└rustc /usr/local/bin/rustc ×72 --crate-name proc_macro2 --edition=2021 /cw/vendor/proc-macro2-1.0.107/src/lib.rs --error-format=json --json=diagnostic-rendered-ansi,artifacts,future-incompat --crate-type lib --emit=dep-info,metadata,link -C embed-bitcode=no --cfg feature="default" --cfg feature="proc-macro" --check-cfg cfg(docsrs,test) --check-cfg cfg(feature, values("default", "nightly", "proc-macro", "span-locations")) -C metadata=d6303f2d6d2b4f35 -C extra-filename=-5d1a69abfd85ca7e --out-dir /work/target/debug/deps -L dependency=/work/target/debug/deps --extern unicode_ident=/work/target/debug/deps/libunicode_ident-76fddff3086055f2.rmeta --cap-lints allow 784 ms 661 ms 0
└rustc /usr/local/bin/rustc ×13 --crate-name serde_derive --edition=2021 /cw/vendor/serde_derive-1.0.229/src/lib.rs --error-format=json --json=diagnostic-rendered-ansi,artifacts,future-incompat --crate-type proc-macro --emit=dep-info,link -C prefer-dynamic -C embed-bitcode=no --cfg feature="default" --check-cfg cfg(docsrs,test) --check-cfg cfg(feature, values("default", "deserialize_in_place")) -C metadata=a7c602ab73e283e6 -C extra-filename=-67f47909f257f714 --out-dir /work/target/debug/deps -L dependency=/work/target/debug/deps --extern proc_macro2=/work/target/debug/deps/libproc_macro2-5d1a69abfd85ca7e.rlib --extern quote=/work/target/debug/deps/libquote-14318e9b26362138.rlib 6.7 s 2.1 s 0
└toolchain /usr/bin/cc -Wl,--version-script=/work/target/debug/deps/rustclYoa5c/list -Wl,--no-undefined-version -m64 /work/target/debug/deps/rustclYoa5c/symbols.o /work/target/debug/deps/serde_derive-67f47909f257f714.serde_derive.fcfd42ff8a990930-cgu.00.rcgu.o /work/target/debug/deps/serde_derive-67f47909f257f714.serde_derive.fcfd42ff8a990930-cgu.01.rcgu.o /work/target/debug/deps/serde_derive-67f47909f257f714.serde_derive.fcfd42ff8a990930-cgu.02.rcgu.o /work/target/debug/deps/serde_derive-67f47909f257f714.serde_derive.fcfd42ff8a990930-cgu.03.rcgu.o /work/target/debug/deps/serde_derive-67f47909f257f714.serde_derive.fcfd42ff8a990930-cgu.04.rcgu.o /work/target/debug/deps/serde_derive-67f47909f257f714.serde_derive.fcfd42ff8a990930-cgu.05.rcgu.o /work/target/debug/deps/serde_derive-67f47909f257f714.serde_derive.fcfd42ff8a990930-cgu.06.rcgu.o /work/target/debug/deps/serde_derive-67f47909f257f714.serde_derive.fcfd42ff8a990930-cgu.07.rcgu.o /work/target/debug/deps/serde_derive-67f47909f257f714.serde_derive.fcfd42ff8a990930-cgu.08.rcgu. 8.7 s 143 ms 0
└toolchain /usr/libexec/gcc/x86_64-linux-gnu/14/collect2 -plugin /usr/libexec/gcc/x86_64-linux-gnu/14/liblto_plugin.so -plugin-opt=/usr/libexec/gcc/x86_64-linux-gnu/14/lto-wrapper -plugin-opt=-fresolution=/tmp/ccMC8odl.res --build-id --eh-frame-hdr -m elf_x86_64 --hash-style=gnu --as-needed -shared -fuse-ld=lld -o /work/target/debug/deps/libserde_derive-67f47909f257f714.so /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/crti.o /usr/lib/gcc/x86_64-linux-gnu/14/crtbeginS.o -L/work/target/debug/deps/rustclYoa5c/raw-dylibs -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/bin/gcc-ld -L/usr/lib/gcc/x86_64-linux-gnu/14 -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../../lib -L/lib/x86_64-linux-gnu -L/lib/../lib -L/usr/lib/x86_64-linux-gnu -L/usr/lib/../lib -L/usr/lib/gcc/x86_64-linux-gnu/14/../../.. --version-script=/work/target/debug/deps/rustclYoa5c/list --no-undefined-version /work/target/debug/deps/rus 8.7 s 136 ms 0
└toolchain /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/bin/rust-lld -flavor gnu -plugin /usr/libexec/gcc/x86_64-linux-gnu/14/liblto_plugin.so -plugin-opt=/usr/libexec/gcc/x86_64-linux-gnu/14/lto-wrapper -plugin-opt=-fresolution=/tmp/ccMC8odl.res --build-id --eh-frame-hdr -m elf_x86_64 --hash-style=gnu --as-needed -shared -o /work/target/debug/deps/libserde_derive-67f47909f257f714.so /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/crti.o /usr/lib/gcc/x86_64-linux-gnu/14/crtbeginS.o -L/work/target/debug/deps/rustclYoa5c/raw-dylibs -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/bin/gcc-ld -L/usr/lib/gcc/x86_64-linux-gnu/14 -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../../lib -L/lib/x86_64-linux-gnu -L/lib/../lib -L/usr/lib/x86_64-linux-gnu -L/usr/lib/../lib -L/usr/lib/gcc/x86_64-linux-gnu/14/../../.. --version-script=/work/target/debug/deps/rustclYoa5c/list --no-undefined-version /work/target/ 8.7 s 132 ms 0
└build_script crossbeam-utils 13.8 s 2 ms 0
└build_script rustix 16.3 s 34 ms 0
└rustc /usr/local/bin/rustc ×2 --crate-type=rlib --emit=metadata --target x86_64-unknown-linux-gnu -o /work/target/debug/build/rustix-91fad39b65314a2d/out/rustix_test_can_compile - 16.3 s 16 ms 0
└build_script prettyplease 16.4 s 2 ms 0
└build_script clang-sys 16.8 s 1 ms 0
└build_script crc32fast 24.5 s 9 ms 0
└rustc /usr/local/bin/rustc --version 24.5 s 6 ms 0
└build_script rustix 24.5 s 32 ms 0
└rustc /usr/local/bin/rustc ×2 --crate-type=rlib --emit=metadata --target x86_64-unknown-linux-gnu -o /work/target/debug/build/rustix-e4671d5fcdbad6f0/out/rustix_test_can_compile - 24.5 s 15 ms 0
└build_script bindgen 28.7 s 1 ms 0
└build_script async-io 42.2 s 24 ms 0
└rustc /usr/local/bin/rustc ×2 --version --verbose 42.2 s 7 ms 0
└rustc /usr/local/bin/rustc ×3 --crate-name zvariant --edition=2024 /cw/vendor/zvariant-5.15.0/src/lib.rs --error-format=json --json=diagnostic-rendered-ansi,artifacts,future-incompat --crate-type lib --emit=dep-info,metadata,link -C embed-bitcode=no --warn=unexpected_cfgs --check-cfg cfg(tokio_unstable) --cfg feature="default" --cfg feature="enumflags2" --check-cfg cfg(docsrs,test) --check-cfg cfg(feature, values("arrayvec", "camino", "chrono", "default", "enumflags2", "gvariant", "heapless", "option-as-array", "ostree-tests", "serde_bytes", "time", "url", "uuid")) -C metadata=a2fdac3cafbf34bb -C extra-filename=-bedd44819973a35f --out-dir /work/target/debug/deps -L dependency=/work/target/debug/deps --extern 46.3 s 1.6 s 0
└cargo /usr/local/bin/cargo locate-project --workspace --message-format=plain --manifest-path=/cw/vendor/zvariant-5.15.0/Cargo.toml 46.4 s 13 ms 0
└build_script num-traits 48.3 s 41 ms 0
└rustc /usr/local/bin/rustc ×3 --version --verbose 48.3 s 7 ms 0
└build_script freya-skia-bindings 50.8 s 90 ms 25856
└other /usr/bin/pkg-config ×2 --libs --cflags freetype2 50.8 s 3 ms 256
└other /usr/bin/curl ×2 -L -f -sS -C - --create-dirs --output /work/target/debug/build/freya-skia-bindings-997847ed3a62d073/out/.cache/skia-binaries-c31b06a7031231446314-x86_64-unknown-linux-gnu-jpegd-jpege-svg-textlayout-webpd-webpe.tar.gz https://github.com/marc2332/rust-skia/releases/download/0.100.0-beta.1/skia-binaries-c31b06a7031231446314-x86_64-unknown-linux-gnu-jpegd-jpege-svg-textlayout-webpd-webpe.tar.gz 50.8 s 57 ms 5632
└unknown 50.8 s 0 ms 32512
└other /usr/bin/python3 --version 50.8 s 4 ms 0

Network 4

The VM has no internet. Every name it looks up resolves to 10.0.2.1, the fake internet, which accepts every connection and records what was sent. Below, it is shown by its port alone, such as :443. The name the build wanted is in the lookups, the HTTP host and the TLS SNI.

Looked up github.com codeload.github.com

DestinationProtocolWhat was sentBytes
:443tlsSNI github.com, inside TLS: GET /marc2332/rust-skia/releases/download/0.100.0-beta.1/skia-binaries-c31b06a7031231446314-x86_64-unknown-linux-gnu-jpegd-jpege-svg-textlayout-webpd-webpe.tar.gz, host github.com, agent curl/8.14.11.5 KiB
:443tlsSNI codeload.github.com, inside TLS: GET /rust-skia/skia/tar.gz/m153-0.101.2, host codeload.github.com, agent curl/8.14.11.5 KiB
Sockets in the trace 6
WhenProgramHowAddressType
50.8 s/usr/bin/curlconnectunix:/var/run/nscd/socketstream
50.8 s/usr/bin/curlconnect:53datagram
50.8 s/usr/bin/curlconnect:443stream
50.8 s/usr/bin/curlconnectunix:/var/run/nscd/socketstream
50.8 s/usr/bin/curlconnect:53datagram
50.8 s/usr/bin/curlconnect:443stream

Files 0

Secrets opened

None.

Written outside the build directories

None.

Scratch disk 0

Files
683
Directories
212
Size
440.8 MiB
Compiled units
127
Scan
stopped at a limit

Nothing outside the build areas.

Output

Standard error
   Compiling proc-macro2 v1.0.107
   Compiling quote v1.0.47
   Compiling syn v3.0.6
   Compiling winnow v1.0.4
   Compiling toml_parser v1.1.3+spec-1.1.0
   Compiling toml_datetime v1.1.1+spec-1.1.0
   Compiling serde_derive v1.0.229
   Compiling syn v2.0.119
    Checking parking v2.2.1
   Compiling cfg-if v1.0.5
   Compiling serde v1.0.229
   Compiling hashbrown v0.17.1
   Compiling crossbeam-utils v0.8.23
   Compiling equivalent v1.0.2
   Compiling indexmap v2.14.2
   Compiling glob v0.3.4
   Compiling clang-sys v1.9.1
   Compiling toml_edit v0.25.15+spec-1.1.0
   Compiling enumflags2_derive v0.7.12
   Compiling libc v0.2.189
   Compiling bitflags v2.13.2
    Checking futures-io v0.3.34
   Compiling prettyplease v0.3.0
   Compiling rustix v1.1.5
   Compiling proc-macro-crate v3.5.0
    Checking concurrent-queue v2.5.0
   Compiling zvariant_utils v4.2.0
   Compiling aho-corasick v1.1.5
    Checking event-listener v5.4.2
   Compiling linux-raw-sys v0.12.1
   Compiling minimal-lexical v0.2.1
   Compiling regex-syntax v0.8.11
   Compiling regex-automata v0.4.18
   Compiling nom v7.1.3
   Compiling crc32fast v1.5.2
    Checking event-listener-strategy v0.5.4
   Compiling zvariant_derive v5.15.0
    Checking futures-lite v2.6.1
   Compiling libloading v0.8.9
    Checking slab v0.4.12
   Compiling bindgen v0.73.2
   Compiling simd-adler32 v0.3.10
   Compiling adler2 v2.0.1
   Compiling miniz_oxide v0.9.1
   Compiling xattr v1.6.1
   Compiling cexpr v0.6.0
   Compiling regex v1.13.1
   Compiling filetime v0.2.29
   Compiling async-io v2.6.0
   Compiling tracing-attributes v0.1.31
   Compiling log v0.4.34
   Compiling rustc-hash v2.1.3
   Compiling toml v1.1.6+spec-1.1.0
    Checking tracing v0.1.44
   Compiling tar v0.4.46
   Compiling flate2 v1.1.10
    Checking polling v3.11.0
   Compiling enumflags2 v0.7.12
   Compiling zcheapstr v1.1.0
   Compiling num-traits v0.2.19
   Compiling pkg-config v0.3.34
   Compiling endi v1.1.1
    Checking async-task v4.7.1
   Compiling freya-skia-bindings v0.100.0-beta.1
   Compiling zvariant v5.15.0
    Checking async-channel v2.5.0
    Checking piper v0.2.5
    Checking async-signal v0.2.14
   Compiling zbus_names v4.3.4
error: failed to run custom build command for `freya-skia-bindings v0.100.0-beta.1`

Caused by:
  process didn't exit successfully: `/work/target/debug/build/freya-skia-bindings-94953112c8f4eada/build-script-build` (exit status: 101)
  --- stdout
  cargo:rerun-if-env-changed=DOCS_RS
  cargo:rerun-if-env-changed=SKIA_DEBUG
  cargo:rerun-if-env-changed=FREETYPE2_NO_PKG_CONFIG
  cargo:rerun-if-env-changed=PKG_CONFIG_x86_64-unknown-linux-gnu
  cargo:rerun-if-env-changed=PKG_CONFIG_x86_64_unknown_linux_gnu
  cargo:rerun-if-env-changed=HOST_PKG_CONFIG
  cargo:rerun-if-env-changed=PKG_CONFIG
  cargo:rerun-if-env-changed=FREETYPE2_STATIC
  cargo:rerun-if-env-changed=FREETYPE2_DYNAMIC
  cargo:rerun-if-env-changed=PKG_CONFIG_ALL_STATIC
  cargo:rerun-if-env-changed=PKG_CONFIG_ALL_DYNAMIC
  cargo:rerun-if-env-changed=PKG_CONFIG_PATH_x86_64-unknown-linux-gnu
  cargo:rerun-if-env-changed=PKG_CONFIG_PATH_x86_64_unknown_linux_gnu
  cargo:rerun-if-env-changed=HOST_PKG_CONFIG_PATH
  cargo:rerun-if-env-changed=PKG_CONFIG_PATH
  cargo:rerun-if-env-changed=PKG_CONFIG_LIBDIR_x86_64-unknown-linux-gnu
  cargo:rerun-if-env-changed=PKG_CONFIG_LIBDIR_x86_64_unknown_linux_gnu
  cargo:rerun-if-env-changed=HOST_PKG_CONFIG_LIBDIR
  cargo:rerun-if-env-changed=PKG_CONFIG_LIBDIR
  cargo:rerun-if-env-changed=PKG_CONFIG_SYSROOT_DIR_x86_64-unknown-linux-gnu
  cargo:rerun-if-env-changed=PKG_CONFIG_SYSROOT_DIR_x86_64_unknown_linux_gnu
  cargo:rerun-if-env-changed=HOST_PKG_CONFIG_SYSROOT_DIR
  cargo:rerun-if-env-changed=PKG_CONFIG_SYSROOT_DIR
  cargo:rerun-if-env-changed=FONTCONFIG_NO_PKG_CONFIG
  cargo:rerun-if-env-changed=PKG_CONFIG_x86_64-unknown-linux-gnu
  cargo:rerun-if-env-changed=PKG_CONFIG_x86_64_unknown_linux_gnu
  cargo:rerun-if-env-changed=HOST_PKG_CONFIG
  cargo:rerun-if-env-changed=PKG_CONFIG
  cargo:rerun-if-env-changed=FONTCONFIG_STATIC
  cargo:rerun-if-env-changed=FONTCONFIG_DYNAMIC
  cargo:rerun-if-env-changed=PKG_CONFIG_ALL_STATIC
  cargo:rerun-if-env-changed=PKG_CONFIG_ALL_DYNAMIC
  cargo:rerun-if-env-changed=PKG_CONFIG_PATH_x86_64-unknown-linux-gnu
  cargo:rerun-if-env-changed=PKG_CONFIG_PATH_x86_64_unknown_linux_gnu
  cargo:rerun-if-env-changed=HOST_PKG_CONFIG_PATH
  cargo:rerun-if-env-changed=PKG_CONFIG_PATH
  cargo:rerun-if-env-changed=PKG_CONFIG_LIBDIR_x86_64-unknown-linux-gnu
  cargo:rerun-if-env-changed=PKG_CONFIG_LIBDIR_x86_64_unknown_linux_gnu
  cargo:rerun-if-env-changed=HOST_PKG_CONFIG_LIBDIR
  cargo:rerun-if-env-changed=PKG_CONFIG_LIBDIR
  cargo:rerun-if-env-changed=PKG_CONFIG_SYSROOT_DIR_x86_64-unknown-linux-gnu
  cargo:rerun-if-env-changed=PKG_CONFIG_SYSROOT_DIR_x86_64_unknown_linux_gnu
  cargo:rerun-if-env-changed=HOST_PKG_CONFIG_SYSROOT_DIR
  cargo:rerun-if-env-changed=PKG_CONFIG_SYSROOT_DIR
  cargo:rerun-if-env-changed=SKIA_USE_SYSTEM_LIBRARIES
  cargo:rerun-if-env-changed=SKIA_USE_SYSTEM_LIBRARIES
  cargo:rerun-if-env-changed=SKIA_SOURCE_DIR
  cargo:rerun-if-env-changed=FORCE_SKIA_BUILD
  cargo:rerun-if-env-changed=FORCE_SKIA_BINARIES_DOWNLOAD
  TRYING TO DOWNLOAD AND INSTALL SKIA BINARIES: 0.100.0-beta.1/c31b06a7031231446314-x86_64-unknown-linux-gnu-jpegd-jpege-svg-textlayout-webpd-webpe
  cargo:rerun-if-env-changed=SKIA_BINARIES_URL
    FROM: https://github.com/marc2332/rust-skia/releases/download/0.100.0-beta.1/skia-binaries-c31b06a7031231446314-x86_64-unknown-linux-gnu-jpegd-jpege-svg-textlayout-webpd-webpe.tar.gz
  DOWNLOAD AND INSTALL FAILED: curl error code: "22"
  curl stderr: "curl: (22) The requested URL returned error: 404\n"
  STARTING A FULL BUILD
  HOST: x86_64-unknown-linux-gnu
  cargo:rerun-if-env-changed=CLANGCC
  cargo:rerun-if-env-changed=CC
  cargo:rerun-if-env-changed=CLANGCXX
  cargo:rerun-if-env-changed=CXX
  cargo:rerun-if-env-changed=OPT_LEVEL
  cargo:rerun-if-env-changed=SKIA_USE_SYSTEM_LIBRARIES
  cargo:rerun-if-env-changed=SDKTARGETSYSROOT
  cargo:rerun-if-env-changed=SDKROOT
  cargo:rerun-if-env-changed=SKIA_NINJA_COMMAND
  cargo:rerun-if-env-changed=SKIA_GN_COMMAND
  Probing 'python'
  Probing 'python3'
  Python 3 found: "python3"
  Synchronizing Skia dependencies
  DOWNLOADING: https://codeload.github.com/rust-skia/skia/tar.gz/m153-0.101.2

  --- stderr

  thread 'main' (1557) panicked at /cw/vendor/freya-skia-bindings-0.100.0-beta.1/build_support/binary_cache/download.rs:81:35:
  Failed to download https://codeload.github.com/rust-skia/skia/tar.gz/m153-0.101.2 (curl error code: "22"
  curl stderr: "curl: (22) The requested URL returned error: 404\n")
  note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace

Timeline

6
WhenFromToEventWorker
2026-09-29 12:27 UTCDiscoveredFetchedfetchedfetcher-627152
2026-09-29 12:27 UTCFetchedReadyForSandboxstatic_analysis_completedstatic-450252
2026-09-29 12:28 UTCReadyForSandboxRunningsandbox_startedorchestrator-639812-slot2
2026-09-29 12:29 UTCRunningDynamicallyAnalyzedsandbox_completedorchestrator-639812-slot2
2026-09-29 12:29 UTCDynamicallyAnalyzedScoredscoredanalyzer-523934
2026-09-29 12:29 UTCScoredDonefinalizedanalyzer-523934