walletkit-sqlite 0.26.0

Done dynamic on Linux job 59875 crates.io SBOM Findings (VEX)

The build looked up github.com.

high

False positive. A person reviewed this verdict and found the crate benign. The evidence below is what the analysis saw.

Evidence

Points	Signal	Where	What
10	network_lookup network · walletkit-sqlite	github.com	The build looked up github.com.
10	new_high_finding diff · walletkit-sqlite	build.rs:20	New since 0.25.2: downloader_pattern
10	new_high_finding diff · walletkit-sqlite	build.rs:91	New since 0.25.2: shell_command
10	static:downloader_pattern static · walletkit-sqlite	build.rs:20	high severity downloader_pattern in build_script code: https://github.com/utelle/SQLite3MultipleCiphers/releases/download/v2.3.2/sqlite3mc-2.3.2-sqlite-3.51.3-amalgamation.zip at build.rs:20 with std::process::Command::new at build.rs:73
10	static:process_spawn static · walletkit-sqlite	build.rs:73	medium severity process_spawn in build_script code: std::process::Command::new
5	exec_downloader trace · walletkit-sqlite	/usr/bin/curl	The build ran /usr/bin/curl.
1	static:build_script static · walletkit-sqlite	build.rs	low severity build_script in build_script code: build.rs
1	static:url_literal static · walletkit-sqlite	build.rs:20	low severity url_literal in build_script code: https://github.com/utelle/SQLite3MultipleCiphers/releases/download/v2.3.2/sqlite3mc-2.3.2-sqlite-3.51.3-amalgamation.zip

Behavior

Profile

exec:downloader net:github.com static:downloader_pattern static:process_spawn

Static findings

high downloader_pattern build_script 1

https://github.com/utelle/SQLite3MultipleCiphers/releases/download/v2.3.2/sqlite3mc-2.3.2-sqlite-3.51.3-amalgamation.zip at build.rs:20 with std::process::Command::new at build.rs:73 build.rs:20

medium process_spawn build_script 1

std::process::Command::new build.rs:73

low build_script build_script 1

build.rs build.rs

low foreign_functions library 1

extern block src/ffi.rs:444

low url_literal build_script 1

https://github.com/utelle/SQLite3MultipleCiphers/releases/download/v2.3.2/sqlite3mc-2.3.2-sqlite-3.51.3-amalgamation.zip build.rs:20

info unsafe_code library 1

47 unsafe blocks, functions or impls src/ffi.rs:73

Run: full

failed

The full build covers everything the earlier cargo check run did, so only the full run is shown.

Ended: agent reported the end
Guest: exit code 101
Run time: 5.8 s
VM restore: 61 ms
Payload: 5316 files, 62.2 MiB
Files opened: 2495

Processes 42

Siblings that ran the same program with the same result and the same processes below are folded into one row, with their number. Hide the 35 compiler processes (rustc, C toolchain)

Process	Arguments	Start	Took	Exit
cargo /usr/local/bin/cargo	build --locked --offline	5 ms	5.7 s	25856
└build_script generic-array		232 ms	123 ms	0
└rustc /usr/local/bin/rustc	--verbose --version	234 ms	120 ms	0
└rustc /usr/local/bin/rustc ×19	--crate-name cfg_if --edition=2018 /cw/vendor/cfg-if-1.0.5/src/lib.rs --error-format=json --json=diagnostic-rendered-ansi,artifacts,future-incompat --crate-type lib --emit=dep-info,metadata,link -C embed-bitcode=no --check-cfg cfg(docsrs,test) --check-cfg cfg(feature, values("core", "rustc-dep-of-std")) -C metadata=400facf07191281c -C extra-filename=-e5a3a60555e44b7f --out-dir /work/target/debug/deps -L dependency=/work/target/debug/deps --cap-lints allow	357 ms	124 ms	0
└build_script crc32fast		1.6 s	9 ms	0
└rustc /usr/local/bin/rustc	--version	1.6 s	7 ms	0
└build_script thiserror		2.0 s	36 ms	0
└rustc /usr/local/bin/rustc	--edition=2018 --crate-name=thiserror --crate-type=lib --cap-lints=allow --emit=dep-info,metadata --out-dir /work/target/debug/build/thiserror-3612222dcefb6f57/out/probe build/probe.rs --target x86_64-unknown-linux-gnu	2.0 s	26 ms	256
└rustc /usr/local/bin/rustc	--version	2.0 s	7 ms	0
└rustc /usr/local/bin/rustc ×3	--crate-name build_script_build --edition=2021 /cw/vendor/zip-2.4.2/src/build.rs --error-format=json --json=diagnostic-rendered-ansi,artifacts,future-incompat --crate-type bin --emit=dep-info,link -C embed-bitcode=no --cfg feature="_deflate-any" --cfg feature="deflate" --cfg feature="deflate-flate2" --cfg feature="deflate-zopfli" --cfg feature="flate2" --cfg feature="zopfli" --check-cfg cfg(docsrs,test) --check-cfg cfg(feature, values("_all-features", "_deflate-any", "aes", "aes-crypto", "bzip2", "chrono", "constant_time_eq", "default", "deflate", "deflate-flate2", "deflate-miniz", "deflate-zlib", "deflate-zlib-ng", "deflate-zopfli", "deflate64", "flate2", "getrandom", "hmac", "lzma", "lzma-rs", "nt-time", "pbkdf2", "sha1", "time", "unreserved", "xz", "zeroize", "zopfli", "zstd")) -C metadata=95604834719e47c8 -C extra-filename=-8e88c19ee24c8564	2.6 s	142 ms	0
└toolchain /usr/bin/cc	-m64 /work/target/debug/build/zip-8e88c19ee24c8564/rustckh9qky/symbols.o /work/target/debug/build/zip-8e88c19ee24c8564/build_script_build-8e88c19ee24c8564.build_script_build.ec41596daed713d8-cgu.0.rcgu.o /work/target/debug/build/zip-8e88c19ee24c8564/build_script_build-8e88c19ee24c8564.cjtziik4rt2lrb3gd33zdxyqi.rcgu.o -Wl,--as-needed -Wl,-Bstatic /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libstd-64f5f36fb0927694.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libpanic_unwind-549498e8b2e4d924.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libobject-7ff85ea729a864ff.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libmemchr-0e3477fb2664a277.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libaddr2line-09755979c57b7e64.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libgimli-9a1fede77fbbf2f0.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libcfg_if-360da4ba13154744.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/librustc_demangle-cfd0ab54b	2.6 s	103 ms	0
└toolchain /usr/libexec/gcc/x86_64-linux-gnu/14/collect2	-plugin /usr/libexec/gcc/x86_64-linux-gnu/14/liblto_plugin.so -plugin-opt=/usr/libexec/gcc/x86_64-linux-gnu/14/lto-wrapper -plugin-opt=-fresolution=/tmp/ccBJoFMc.res --build-id --eh-frame-hdr -m elf_x86_64 --hash-style=gnu --as-needed -dynamic-linker /lib64/ld-linux-x86-64.so.2 -pie -fuse-ld=lld -o /work/target/debug/build/zip-8e88c19ee24c8564/build_script_build-8e88c19ee24c8564 /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/Scrt1.o /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/crti.o /usr/lib/gcc/x86_64-linux-gnu/14/crtbeginS.o -L/work/target/debug/build/zip-8e88c19ee24c8564/rustckh9qky/raw-dylibs -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/bin/gcc-ld -L/usr/lib/gcc/x86_64-linux-gnu/14 -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../../lib -L/lib/x86_64-linux-gnu -L/lib/../lib -L/usr/lib/x86_64-linux-gnu -L/usr/lib/../lib	2.6 s	98 ms	0
└toolchain /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/bin/rust-lld	-flavor gnu -plugin /usr/libexec/gcc/x86_64-linux-gnu/14/liblto_plugin.so -plugin-opt=/usr/libexec/gcc/x86_64-linux-gnu/14/lto-wrapper -plugin-opt=-fresolution=/tmp/ccBJoFMc.res --build-id --eh-frame-hdr -m elf_x86_64 --hash-style=gnu --as-needed -dynamic-linker /lib64/ld-linux-x86-64.so.2 -pie -o /work/target/debug/build/zip-8e88c19ee24c8564/build_script_build-8e88c19ee24c8564 /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/Scrt1.o /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/crti.o /usr/lib/gcc/x86_64-linux-gnu/14/crtbeginS.o -L/work/target/debug/build/zip-8e88c19ee24c8564/rustckh9qky/raw-dylibs -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/bin/gcc-ld -L/usr/lib/gcc/x86_64-linux-gnu/14 -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../../lib -L/lib/x86_64-linux-gnu -L/lib/../lib -L/usr/lib/x86_64-linux-gnu -L/u	2.6 s	94 ms	0
└build_script zip		3.3 s	1 ms	0
└build_script walletkit-sqlite		5.7 s	63 ms	25856
└other /usr/bin/curl	-fsSL --retry 5 --retry-connrefused --retry-max-time 120 --max-time 120 -o /work/target/debug/build/walletkit-sqlite-1943575981677ac9/out/sqlite3mc-amalgamation.zip https://github.com/utelle/SQLite3MultipleCiphers/releases/download/v2.3.2/sqlite3mc-2.3.2-sqlite-3.51.3-amalgamation.zip	5.7 s	61 ms	5632

Network 2

The VM has no internet. Every name it looks up resolves to 10.0.2.1, the fake internet, which accepts every connection and records what was sent. Below, it is shown by its port alone, such as :443. The name the build wanted is in the lookups, the HTTP host and the TLS SNI.

Looked up github.com

Destination	Protocol	What was sent	Bytes
:443	tls	SNI github.com, inside TLS: GET /utelle/SQLite3MultipleCiphers/releases/download/v2.3.2/sqlite3mc-2.3.2-sqlite-3.51.3-amalgamation.zip, host github.com, agent curl/8.14.1	1.5 KiB

Sockets in the trace 3

When	Program	How	Address	Type
5.7 s	/usr/bin/curl	connect	unix:/var/run/nscd/socket	stream
5.7 s	/usr/bin/curl	connect	:53	datagram
5.7 s	/usr/bin/curl	connect	:443	stream

Files 0

Secrets opened

None.

Written outside the build directories

None.

Scratch disk 0

Files: 200
Directories: 64
Size: 93.6 MiB
Compiled units: 39

Nothing outside the build areas.

Output

Standard error

   Compiling generic-array v0.14.7
   Compiling cfg-if v1.0.5
   Compiling typenum v1.20.1
   Compiling crc32fast v1.5.2
   Compiling simd-adler32 v0.3.10
   Compiling adler2 v2.0.1
   Compiling thiserror v2.0.21
   Compiling miniz_oxide v0.9.1
   Compiling crypto-common v0.1.7
   Compiling block-buffer v0.10.4
   Compiling zip v2.4.2
   Compiling log v0.4.34
   Compiling zopfli v0.8.3
   Compiling digest v0.10.7
   Compiling flate2 v1.1.10
   Compiling displaydoc v0.2.7
   Compiling cpufeatures v0.2.17
   Compiling sha2 v0.10.9
   Compiling walletkit-sqlite v0.26.0
   Compiling zeroize v1.9.0
   Compiling secrecy v0.10.3
warning: walletkit-sqlite@0.26.0: Downloading sqlite3mc v2.3.2 amalgamation (SQLite 3.51.3)...
error: failed to run custom build command for `walletkit-sqlite v0.26.0`

Caused by:
  process didn't exit successfully: `/work/target/debug/build/walletkit-sqlite-f9815345a002cee9/build-script-build` (exit status: 101)
  --- stdout
  cargo:rerun-if-env-changed=DOCS_RS
  cargo:rerun-if-changed=src/native_sqlite.c
  cargo:warning=Downloading sqlite3mc v2.3.2 amalgamation (SQLite 3.51.3)...

  --- stderr
  curl: (22) The requested URL returned error: 404

  thread 'main' (805) panicked at /cw/vendor/walletkit-sqlite-0.26.0/build.rs:89:5:
  failed to download https://github.com/utelle/SQLite3MultipleCiphers/releases/download/v2.3.2/sqlite3mc-2.3.2-sqlite-3.51.3-amalgamation.zip: curl exit status: 22
  note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace

Timeline

When	From	To	Event	Worker
2026-10-02 14:23 UTC	Discovered	Fetched	fetched	fetcher-2797145
2026-10-02 14:23 UTC	Fetched	ReadyForSandbox	static_analysis_completed	static-2797146
2026-10-02 14:24 UTC	ReadyForSandbox	Running	sandbox_started	orchestrator-2797150-slot0
2026-10-02 14:24 UTC	Running	DynamicallyAnalyzed	sandbox_completed	orchestrator-2797150-slot0
2026-10-02 14:24 UTC	DynamicallyAnalyzed	ReadyForSandbox	scored	analyzer-2797147
2026-10-02 14:24 UTC	ReadyForSandbox	Running	sandbox_started	orchestrator-2797150-slot0
2026-10-02 14:24 UTC	Running	DynamicallyAnalyzed	sandbox_completed	orchestrator-2797150-slot0
2026-10-02 14:24 UTC	DynamicallyAnalyzed	Scored	scored	analyzer-2797147
2026-10-02 14:24 UTC	Scored	Done	finalized	analyzer-2797147