libc 0.2.191

Source: https://github.com/rust-lang/libc
Tag scanned: 0.2.191
Compared with: 0.2.190 (1 signals introduced since)
Files: 566 scanned, 44 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 10 info
Scan time: 6.9 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 4 of 4 warn and critical signals; 4 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-18 00:10

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info dynamic-execution ci/run.sh:53:1 new in this release

command name is a variable (`$doc_cmd`) that this file sets only to plain text (ast pass, confidence 0.40)
```
$doc_cmd

# On relevant platforms, also test with our optional settings
```
info dynamic-execution ci/bsd-prepare.sh:21:5

command name is a variable (`$deps`) that this file sets only to plain text (ast pass, confidence 0.40)
```
while [ $count -lt 3 ]; do
    $deps && success=true || true
    [ $success = true ] && break
    sleep 3
```
info ~~warn~~ → info by review dynamic-execution ci/bsd-prepare.sh:32:1

pipeline feeds into `sh` — piped data is executed as shell code (ast pass, confidence 0.80)
```
curl --proto '=https' --tlsv1.2 -sSf --retry 5 https://sh.rustup.rs | sh -s -- \
    --profile minimal \
    --default-toolchain nightly \
```
likely benign LLM, confidence 0.80 CI script installs the Rust toolchain by piping the rustup.rs installer from the official domain into sh.
Reasoning
The pipeline fetches the official rustup installer over HTTPS with TLS 1.2 enforced and pipes it to sh. This is the documented rustup bootstrap in a CI setup script. It is a risky pattern in general, since remote code runs without verification, but the source is the expected vendor domain and the context is a build toolchain install, not an obfuscated dropper.
info ~~warn~~ → info by review dynamic-import ci/bsd-run.sh:8:1

`source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)
```
# shellcheck source=/dev/null
. "$HOME/.cargo/env"

# System info
```
likely benign LLM, confidence 0.92 Sources the rustup-generated cargo environment file from the home directory.
Reasoning
Sourcing $HOME/.cargo/env is the standard rustup step for putting cargo on PATH. The path is a fixed file under the user's home directory and is not attacker-controlled input.
info ~~critical~~ → info by review dynamic-execution ci/emscripten-entry.sh:8:1

`exec` called with a dynamic (variable/substitution) path (ast pass, confidence 0.85)
```
exec "$@"
```
likely benign LLM, confidence 0.90 Entrypoint script that execs the command passed to it as arguments.
Reasoning
`exec "$@"` is a standard entrypoint wrapper that replaces the shell with the arguments it was given. The dynamic command is the intended behaviour of a container or CI entrypoint, and nothing in the snippet fetches or decodes code.
info ~~critical~~ → info by review dynamic-execution ci/run-apple-simulator.sh:41:1

command name is a variable or substitution — executed command determined at runtime (ast pass, confidence 0.90)
```
# Delegate to run.sh for the rest.
"$(dirname "$0")/run.sh" "$target"
```
likely benign LLM, confidence 0.90 Delegates to a sibling run.sh script located next to this script, passing a target argument.
Reasoning
The command is `dirname "$0"/run.sh`, a sibling script resolved relative to the current script's location, followed by a target argument. The executed file name is fixed and this is ordinary helper delegation in a CI script.
info dynamic-execution ci/run.sh:47:1

command name is a variable (`$cmd`) that this file sets only to plain text (ast pass, confidence 0.40)
```
# shellcheck disable=SC2086
$cmd --no-default-features -- $test_flags
# shellcheck disable=SC2086
$cmd -- $test_flags
```
info dynamic-execution ci/run.sh:49:1

command name is a variable (`$cmd`) that this file sets only to plain text (ast pass, confidence 0.40)
```
# shellcheck disable=SC2086
$cmd -- $test_flags
# shellcheck disable=SC2086
$cmd --features extra_traits -- $test_flags
```
info dynamic-execution ci/run.sh:51:1

command name is a variable (`$cmd`) that this file sets only to plain text (ast pass, confidence 0.40)
```
# shellcheck disable=SC2086
$cmd --features extra_traits -- $test_flags

$doc_cmd
```
info dynamic-execution ci/run.sh:59:5

command name is a variable (`$cmd`) that this file sets only to plain text (ast pass, confidence 0.40)
```
    # shellcheck disable=SC2086
    RUSTFLAGS="$RUSTFLAGS --cfg=libc_unstable_time64" $cmd -- $test_flags
fi
```

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/rust-lang/libc libc && cd libc
git checkout 0.2.191
disclude scan --severity info --diff 0.2.190 .