libc 0.2.190

Source: https://github.com/rust-lang/libc
Tag scanned: 0.2.190
Compared with: 0.2.189 (2 signals introduced since)
Files: 565 scanned, 44 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 9 info
Scan time: 4.4 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 4 of 4 warn and critical signals; 4 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-14 20:12

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~critical~~ → info by review dynamic-execution ci/run-apple-simulator.sh:41:1 new in this release

command name is a variable or substitution — executed command determined at runtime (ast pass, confidence 0.90)
```
# Delegate to run.sh for the rest.
"$(dirname "$0")/run.sh" "$target"
```
likely benign LLM, confidence 0.88 Invokes the sibling run.sh script located via dirname of $0 with a target argument.
Reasoning
The script delegates to a sibling run.sh located relative to $0 using dirname, with the target as an argument. The path is fixed relative to the script and does not come from untrusted input. This is ordinary CI wrapper behavior.
info dynamic-execution ci/run.sh:57:5 new in this release

command name is a variable (`$cmd`) that this file sets only to plain text (ast pass, confidence 0.40)
```
    # shellcheck disable=SC2086
    RUSTFLAGS="$RUSTFLAGS --cfg=libc_unstable_time64" $cmd -- $test_flags
fi
```
info dynamic-execution ci/bsd-prepare.sh:21:5

command name is a variable (`$deps`) that this file sets only to plain text (ast pass, confidence 0.40)
```
while [ $count -lt 3 ]; do
    $deps && success=true || true
    [ $success = true ] && break
    sleep 3
```
info ~~warn~~ → info by review dynamic-execution ci/bsd-prepare.sh:32:1

pipeline feeds into `sh` — piped data is executed as shell code (ast pass, confidence 0.80)
```
curl --proto '=https' --tlsv1.2 -sSf --retry 5 https://sh.rustup.rs | sh -s -- \
    --profile minimal \
    --default-toolchain nightly \
```
likely benign LLM, confidence 0.85 Downloads the rustup installer from sh.rustup.rs over HTTPS and runs it with sh in a CI setup script.
Reasoning
Piping curl output of the official rustup installer URL into sh is the standard rustup install idiom. It is a known supply-chain-sensitive pattern, but in a CI prep script with a fixed HTTPS official domain and TLS 1.2 enforcement, it is expected rather than malicious.
info ~~warn~~ → info by review dynamic-import ci/bsd-run.sh:8:1

`source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)
```
# shellcheck source=/dev/null
. "$HOME/.cargo/env"

# System info
```
likely benign LLM, confidence 0.90 Sources the cargo environment file from the home directory in a CI run script.
Reasoning
Sourcing $HOME/.cargo/env is the canonical way to load the rustup/cargo environment after installation. The path is a fixed file under the user's home directory and the shellcheck directive shows it was written deliberately.
info ~~critical~~ → info by review dynamic-execution ci/emscripten-entry.sh:8:1

`exec` called with a dynamic (variable/substitution) path (ast pass, confidence 0.85)
```
exec "$@"
```
likely benign LLM, confidence 0.80 Entrypoint script that replaces itself with the command passed as arguments.
Reasoning
`exec "$@"` is a standard entrypoint wrapper that forwards arguments as the command to run. It executes whatever the caller passes, which is by design for a Docker or CI entrypoint, not hidden obfuscation. Severity is critical only because the pattern is generic.
info dynamic-execution ci/run.sh:45:1

command name is a variable (`$cmd`) that this file sets only to plain text (ast pass, confidence 0.40)
```
# shellcheck disable=SC2086
$cmd --no-default-features -- $test_flags
# shellcheck disable=SC2086
$cmd -- $test_flags
```
info dynamic-execution ci/run.sh:47:1

command name is a variable (`$cmd`) that this file sets only to plain text (ast pass, confidence 0.40)
```
# shellcheck disable=SC2086
$cmd -- $test_flags
# shellcheck disable=SC2086
$cmd --features extra_traits -- $test_flags
```

info dynamic-execution ci/run.sh:49:1

command name is a variable (`$cmd`) that this file sets only to plain text (ast pass, confidence 0.40)

# shellcheck disable=SC2086
$cmd --features extra_traits -- $test_flags

cargo doc --target "$target" --workspace --no-deps

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/rust-lang/libc libc && cd libc
git checkout 0.2.190
disclude scan --severity info --diff 0.2.189 .