compose-rust 0.0.0

Done dynamic on Linux job 64856 crates.io SBOM Findings (VEX)

high severity shell_command in build_script code (7 places): curl exited {code}

high

False positive. A person reviewed this verdict and found the crate benign. The evidence below is what the analysis saw.

Evidence

Points	Signal	Where	What
30	static:shell_command static · compose-rust	build.rs:382	high severity shell_command in build_script code (7 places): curl exited {code}
10	disk_outside_build disk	/work/home/.cache	The build left /work/home/.cache (dir) and 2 entries below it.
10	network_lookup network · compose-rust	github.com	The build looked up github.com.
5	exec_downloader trace · compose-rust	/usr/bin/curl	The build ran /usr/bin/curl.

5 without points

Signal	Where	What
static:build_script static · compose-rust	build.rs	low severity build_script in build_script code: build.rs
static:downloader_pattern static · compose-rust	build/renderer_dir.rs:35	high severity downloader_pattern in build_script code: https://github.com/DarkPyonix/compose-rust/releases at build/renderer_dir.rs:35 with std::process::Command::new at build.rs:352
static:included_binary static · compose-rust	tests/generated_protocol.rs:69	medium severity included_binary in test code (4 places): tests/vectors/mutations.bin (1147 bytes)
static:process_spawn static · compose-rust	build.rs:352	medium severity process_spawn in build_script code (14 places): std::process::Command::new
static:url_literal static · compose-rust	build/renderer_dir.rs:35	low severity url_literal in build_script code (2 places): https://github.com/DarkPyonix/compose-rust/releases

Behavior

Profile

disk:outside exec:downloader net:github.com static:downloader_pattern static:included_binary static:process_spawn static:shell_command

Static findings

high shell_command build_script 5

curl exited {code} build.rs:382
curl exited {code}: {detail} build.rs:387
wget could not reach the network: {detail} build.rs:416
wget exited {code}: {detail} build.rs:417
curl could not resolve the host build/renderer_dir.rs:913

high downloader_pattern build_script 1

https://github.com/DarkPyonix/compose-rust/releases at build/renderer_dir.rs:35 with std::process::Command::new at build.rs:352 build/renderer_dir.rs:35

medium process_spawn build_script 6

std::process::Command::new build.rs:352 build.rs:364 build.rs:399 build/renderer_dir.rs:394 build/renderer_dir.rs:489 build/renderer_dir.rs:516

medium included_binary test 4

tests/vectors/mutations.bin (1147 bytes) tests/generated_protocol.rs:69
tests/vectors/events.bin (225 bytes) tests/generated_protocol.rs:74 tests/generated_protocol.rs:87 tests/generated_protocol.rs:116

medium shell_command test 2

curl could not resolve github.com tests/renderer_resolution.rs:411 tests/renderer_resolution.rs:425

low process_spawn test 7

std::process::Command::new tests/codegen_tree.rs:25 tests/renderer_resolution.rs:530 tests/renderer_resolution.rs:565 tests/renderer_resolution.rs:674 tests/renderer_resolution.rs:1123 tests/renderer_resolution.rs:1157 tests/renderer_resolution.rs:1180

low foreign_functions library 3

extern block src/boundary.rs:73 src/boundary_jni.gen.rs:25 src/boundary_wasm.gen.rs:23

low build_script build_script 1

build.rs build.rs

low process_spawn library 1

std::process::Command::new src/codegen.rs:1986

low url_literal build_script 1

https://github.com/DarkPyonix/compose-rust/releases build/renderer_dir.rs:35

info unsafe_code test 5

11 unsafe blocks, functions or impls tests/boundary_call_cost.rs:49
18 unsafe blocks, functions or impls tests/boundary_hardening.rs:56
4 unsafe blocks, functions or impls tests/canvas_drawing.rs:27 tests/protocol_hardening.rs:36 tests/steady_state_allocations.rs:29

info unsafe_code library 3

35 unsafe blocks, functions or impls src/boundary.rs:82
9 unsafe blocks, functions or impls src/boundary_jni.gen.rs:61
5 unsafe blocks, functions or impls src/boundary_wasm.gen.rs:81

info url_literal test 1

https://github.com/DarkPyonix/compose-rust/releases/download/v0.0.0/dioxus-compose-renderer-v0.0.0-macos-aarch64.tar.gz tests/renderer_resolution.rs:83

Run: full

failed

The full build covers everything the earlier cargo check run did, so only the full run is shown.

Ended: agent reported the end
Guest: exit code 101
Run time: 23.1 s
VM restore: 69 ms
Payload: 7071 files, 153.7 MiB
Files opened: 6686

Processes 100

Siblings that ran the same program with the same result and the same processes below are folded into one row, with their number. Hide the 92 compiler processes (rustc, C toolchain)

Process	Arguments	Start	Took	Exit
cargo /usr/local/bin/cargo	build --locked --offline	5 ms	22.9 s	25856
└build_script proc-macro2		225 ms	404 ms	0
└rustc /usr/local/bin/rustc ×3	--version	227 ms	104 ms	0
└rustc /usr/local/bin/rustc	--cfg=procmacro2_build_probe --edition=2021 --crate-name=proc_macro2 --crate-type=lib --cap-lints=allow --emit=dep-info,metadata --out-dir /work/target/debug/build/proc-macro2-97392f29eb377993/out/probe src/probe/proc_macro_span.rs --target x86_64-unknown-linux-gnu	332 ms	258 ms	256
└rustc /usr/local/bin/rustc ×43	--crate-name proc_macro2 --edition=2021 /cw/vendor/proc-macro2-1.0.107/src/lib.rs --error-format=json --json=diagnostic-rendered-ansi,artifacts,future-incompat --crate-type lib --emit=dep-info,metadata,link -C embed-bitcode=no --cfg feature="default" --cfg feature="proc-macro" --cfg feature="span-locations" --check-cfg cfg(docsrs,test) --check-cfg cfg(feature, values("default", "nightly", "proc-macro", "span-locations")) -C metadata=5d63f7a10747f6e2 -C extra-filename=-e838b6f4c830537c --out-dir /work/target/debug/deps -L dependency=/work/target/debug/deps --extern unicode_ident=/work/target/debug/deps/libunicode_ident-76fddff3086055f2.rmeta	642 ms	681 ms	0
└rustc /usr/local/bin/rustc ×10	--crate-name build_script_build --edition=2021 /cw/vendor/libc-0.2.190/build.rs --error-format=json --json=diagnostic-rendered-ansi,artifacts,future-incompat --crate-type bin --emit=dep-info,link -C embed-bitcode=no --allow=unused_qualifications --warn=clippy::unnecessary_semicolon --allow=clippy::unnecessary_cast --warn=clippy::ptr_as_ptr --allow=clippy::non_minimal_cfg --allow=clippy::missing_safety_doc --warn=clippy::map_unwrap_or --warn=clippy::manual_assert --allow=clippy::identity_op --warn=clippy::explicit_iter_loop --cfg feature="default" --cfg feature="std" --check-cfg cfg(docsrs,test) --check-cfg cfg(feature, values("align", "const-extern-fn", "default", "extra_traits", "rustc-dep-of-std", "rustc-std-workspace-core", "std", "use_std")) -C metadata=cc8fbcc4ffcedc67	6.3 s	272 ms	0
└toolchain /usr/bin/cc	-m64 /work/target/debug/build/libc-d6090283aeec6873/rustcP44kyr/symbols.o /work/target/debug/build/libc-d6090283aeec6873/build_script_build-d6090283aeec6873.build_script_build.478463c381baa231-cgu.0.rcgu.o /work/target/debug/build/libc-d6090283aeec6873/build_script_build-d6090283aeec6873.build_script_build.478463c381baa231-cgu.1.rcgu.o /work/target/debug/build/libc-d6090283aeec6873/build_script_build-d6090283aeec6873.build_script_build.478463c381baa231-cgu.2.rcgu.o /work/target/debug/build/libc-d6090283aeec6873/build_script_build-d6090283aeec6873.build_script_build.478463c381baa231-cgu.3.rcgu.o /work/target/debug/build/libc-d6090283aeec6873/build_script_build-d6090283aeec6873.duv7zwsm27ecgad8ejp2yfjq7.rcgu.o -Wl,--as-needed -Wl,-Bstatic /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libstd-64f5f36fb0927694.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libpanic_unwind-549498e8b2e4d924.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libobject-7ff85ea729a864ff.rlib /usr/local/lib/rus	6.5 s	95 ms	0
└toolchain /usr/libexec/gcc/x86_64-linux-gnu/14/collect2	-plugin /usr/libexec/gcc/x86_64-linux-gnu/14/liblto_plugin.so -plugin-opt=/usr/libexec/gcc/x86_64-linux-gnu/14/lto-wrapper -plugin-opt=-fresolution=/tmp/cctrXMsP.res --build-id --eh-frame-hdr -m elf_x86_64 --hash-style=gnu --as-needed -dynamic-linker /lib64/ld-linux-x86-64.so.2 -pie -fuse-ld=lld -o /work/target/debug/build/libc-d6090283aeec6873/build_script_build-d6090283aeec6873 /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/Scrt1.o /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/crti.o /usr/lib/gcc/x86_64-linux-gnu/14/crtbeginS.o -L/work/target/debug/build/libc-d6090283aeec6873/rustcP44kyr/raw-dylibs -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/bin/gcc-ld -L/usr/lib/gcc/x86_64-linux-gnu/14 -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../../lib -L/lib/x86_64-linux-gnu -L/lib/../lib -L/usr/lib/x86_64-linux-gnu -L/usr/lib/../li	6.5 s	86 ms	0
└toolchain /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/bin/rust-lld	-flavor gnu -plugin /usr/libexec/gcc/x86_64-linux-gnu/14/liblto_plugin.so -plugin-opt=/usr/libexec/gcc/x86_64-linux-gnu/14/lto-wrapper -plugin-opt=-fresolution=/tmp/cctrXMsP.res --build-id --eh-frame-hdr -m elf_x86_64 --hash-style=gnu --as-needed -dynamic-linker /lib64/ld-linux-x86-64.so.2 -pie -o /work/target/debug/build/libc-d6090283aeec6873/build_script_build-d6090283aeec6873 /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/Scrt1.o /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/crti.o /usr/lib/gcc/x86_64-linux-gnu/14/crtbeginS.o -L/work/target/debug/build/libc-d6090283aeec6873/rustcP44kyr/raw-dylibs -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/bin/gcc-ld -L/usr/lib/gcc/x86_64-linux-gnu/14 -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../../lib -L/lib/x86_64-linux-gnu -L/lib/../lib -L/usr/lib/x86_64-linux-gnu -L	6.5 s	83 ms	0
└build_script libc		6.6 s	9 ms	0
└rustc /usr/local/bin/rustc	--version	6.6 s	6 ms	0
└build_script slotmap		14.3 s	23 ms	0
└rustc /usr/local/bin/rustc ×3	--verbose --version	14.3 s	6 ms	0
└build_script proc-macro2-diagnostics		17.1 s	8 ms	0
└rustc /usr/local/bin/rustc	--verbose --version	17.1 s	6 ms	0
└build_script compose-rust		22.8 s	56 ms	25856
└other /usr/bin/which	/usr/bin/which curl	22.8 s	1 ms	0
└other /usr/bin/curl	--silent --show-error --location --connect-timeout 30 --retry 2 --output /work/home/.cache/dioxus-compose/downloads/dioxus-compose-renderer-v0.0.0-linux-x64.tar.partial --write-out %{http_code} https://github.com/DarkPyonix/compose-rust/releases/download/v0.0.0/dioxus-compose-renderer-v0.0.0-linux-x64.tar.gz	22.8 s	53 ms	0

Network 2

The VM has no internet. Every name it looks up resolves to 10.0.2.1, the fake internet, which accepts every connection and records what was sent. Below, it is shown by its port alone, such as :443. The name the build wanted is in the lookups, the HTTP host and the TLS SNI.

Looked up github.com

Destination	Protocol	What was sent	Bytes
:443	tls	SNI github.com, inside TLS: GET /DarkPyonix/compose-rust/releases/download/v0.0.0/dioxus-compose-renderer-v0.0.0-linux-x64.tar.gz, host github.com, agent curl/8.14.1	1.5 KiB

Sockets in the trace 3

When	Program	How	Address	Type
22.9 s	/usr/bin/curl	connect	unix:/var/run/nscd/socket	stream
22.9 s	/usr/bin/curl	connect	:53	datagram
22.9 s	/usr/bin/curl	connect	:443	stream

Files 0

Secrets opened

None.

Written outside the build directories

None.

Scratch disk 3

Files: 417
Directories: 103
Size: 257.8 MiB
Compiled units: 92
Scan: stopped at a limit

Why	Path	Kind	Size	Mode
outside the build areas	/work/home/.cache	dir	4.0 KiB	755
outside the build areas	/work/home/.cache/dioxus-compose	dir	4.0 KiB	755
outside the build areas	/work/home/.cache/dioxus-compose/downloads	dir	4.0 KiB	755

Output

Standard error

   Compiling proc-macro2 v1.0.107
   Compiling quote v1.0.47
   Compiling syn v2.0.119
   Compiling syn v3.0.6
   Compiling libc v0.2.190
   Compiling cfg-if v1.0.5
   Compiling serde_core v1.0.229
   Compiling serde_derive v1.0.229
   Compiling once_cell v1.21.4
   Compiling pin-project-lite v0.2.17
   Compiling tracing-core v0.1.36
   Compiling serde v1.0.229
   Compiling tracing-attributes v0.1.31
   Compiling scopeguard v1.2.0
   Compiling smallvec v1.16.2
   Compiling parking_lot_core v0.9.12
   Compiling lock_api v0.4.14
   Compiling tracing v0.1.44
   Compiling thiserror-impl v2.0.21
   Compiling slotmap v1.1.1
   Compiling futures-core v0.3.34
   Compiling konst_macro_rules v0.2.19
   Compiling konst v0.2.20
   Compiling const_format_proc_macros v0.2.34
   Compiling thiserror v2.0.21
   Compiling parking_lot v0.12.5
   Compiling subsecond-types v0.7.10
   Compiling libloading v0.8.9
   Compiling memmap2 v0.9.11
   Compiling proc-macro2-diagnostics v0.10.1
   Compiling pin-project-internal v1.1.13
   Compiling futures-task v0.3.34
   Compiling slab v0.4.12
   Compiling futures-util v0.3.34
   Compiling pin-project v1.1.13
   Compiling subsecond v0.7.10
   Compiling generational-box v0.7.10
   Compiling anyhow v1.0.104
   Compiling const_format v0.2.36
   Compiling futures-channel v0.3.34
   Compiling warnings-macro v0.2.0
   Compiling dioxus-core-types v0.7.10
   Compiling longest-increasing-subsequence v0.1.0
   Compiling rustc-hash v2.1.3
   Compiling dioxus-core v0.7.10
   Compiling warnings v0.2.1
   Compiling convert_case v0.8.0
   Compiling dioxus-rsx v0.7.10
   Compiling dioxus-signals v0.7.10
   Compiling compose-rust v0.0.0
error: failed to run custom build command for `compose-rust v0.0.0`

Caused by:
  process didn't exit successfully: `/work/target/debug/build/compose-rust-f56ee24e623be56b/build-script-build` (exit status: 101)
  --- stdout
  cargo:rustc-check-cfg=cfg(renderer_linked)
  cargo:rerun-if-env-changed=DIOXUS_COMPOSE_RENDERER_DIR
  cargo:rerun-if-env-changed=DIOXUS_COMPOSE_CACHE_DIR
  cargo:rerun-if-env-changed=DOCS_RS
  cargo:rerun-if-changed=build/renderer_dir.rs
  cargo:rerun-if-changed=build/sha256.rs
  cargo:rerun-if-changed=build/elf.rs

  --- stderr

  thread 'main' (1193) panicked at /cw/vendor/compose-rust-0.0.0/build.rs:225:25:


  dioxus-compose: the release for v0.0.0 does not carry dioxus-compose-renderer-v0.0.0-linux-x64.tar.gz.

  The server was reached and answered that there is no such file, so this is not a
  network problem. Either that release was published without the linux-x64 renderer,
  or it predates this crate version being tagged at all. What it does carry is
  listed at:
      https://github.com/DarkPyonix/compose-rust/releases/tag/v0.0.0

  Any renderer you already have works too. Unpack dioxus-compose-renderer-v0.0.0-linux-x64.tar.gz, or build one with
  dioxus-compose-renderer/desktop/scripts/build-native.sh from a checkout of the
  repository, then set DIOXUS_COMPOSE_RENDERER_DIR to that directory. The variable is checked
  first and nothing is downloaded when it is set.


  note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace

Timeline

When	From	To	Event	Worker
2026-10-03 05:48 UTC	Discovered	Fetched	fetched	fetcher-2797145
2026-10-03 05:48 UTC	Fetched	ReadyForSandbox	static_analysis_completed	static-2797146
2026-10-03 05:48 UTC	ReadyForSandbox	Running	sandbox_started	orchestrator-2797150-slot2
2026-10-03 05:48 UTC	Running	DynamicallyAnalyzed	sandbox_completed	orchestrator-2797150-slot2
2026-10-03 05:48 UTC	DynamicallyAnalyzed	ReadyForSandbox	scored	analyzer-2797147
2026-10-03 05:48 UTC	ReadyForSandbox	Running	sandbox_started	orchestrator-2797150-slot0
2026-10-03 05:48 UTC	Running	DynamicallyAnalyzed	sandbox_completed	orchestrator-2797150-slot0
2026-10-03 05:48 UTC	DynamicallyAnalyzed	Scored	scored	analyzer-2797147
2026-10-03 05:48 UTC	Scored	Done	finalized	analyzer-2797147