libc 0.2.191

Source: https://github.com/rust-lang/libc
Tag scanned: 0.2.191
Compared with: 0.2.190 (1 signals introduced since)
Files: 566 scanned, 44 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 10 info
Scan time: 5.4 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 4 of 4 warn and critical signals; 4 demoted to info.
Disclude version: 4.1.0
Scanned (UTC): 2026-10-22 21:45

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info dynamic-execution ci/run.sh:53:1 new in this release

command name is a variable (`$doc_cmd`) that this file sets only to plain text (ast pass, confidence 0.40)
```
$doc_cmd

# On relevant platforms, also test with our optional settings
```
info dynamic-execution ci/bsd-prepare.sh:21:5

command name is a variable (`$deps`) that this file sets only to plain text (ast pass, confidence 0.40)
```
while [ $count -lt 3 ]; do
    $deps && success=true || true
    [ $success = true ] && break
    sleep 3
```
info ~~warn~~ → info by review dynamic-execution ci/bsd-prepare.sh:32:1

pipeline feeds into `sh` — piped data is executed as shell code (ast pass, confidence 0.80)
```
curl --proto '=https' --tlsv1.2 -sSf --retry 5 https://sh.rustup.rs | sh -s -- \
    --profile minimal \
    --default-toolchain nightly \
```
likely benign LLM, confidence 0.85 CI script installs rustup by piping the official rustup.rs installer over HTTPS into sh.
Reasoning
Piping curl output from the official rustup URL into sh is the standard rustup installer pattern in CI scripts. It is a dynamic-execution pattern by definition, but it is a well-known legitimate install method pinned to HTTPS with TLS 1.2 enforced. No obfuscation is present. Residual risk is only the general supply-chain trust in rustup.rs.
info ~~warn~~ → info by review dynamic-import ci/bsd-run.sh:8:1

`source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)
```
# shellcheck source=/dev/null
. "$HOME/.cargo/env"

# System info
```
likely benign LLM, confidence 0.92 CI script sources the cargo environment file from the home directory.
Reasoning
Sourcing $HOME/.cargo/env is the standard way to load the Rust toolchain environment after rustup install. The path is a fixed location under the user's home directory, not attacker-controlled input. The shellcheck comment shows this is an intentional, reviewed line.
info ~~critical~~ → info by review dynamic-execution ci/emscripten-entry.sh:8:1

`exec` called with a dynamic (variable/substitution) path (ast pass, confidence 0.85)
```
exec "$@"
```
likely benign LLM, confidence 0.93 Entrypoint script execs the arguments it was given.
Reasoning
`exec "$@"` is a standard entrypoint wrapper that replaces the shell with the command passed as arguments. It runs only what the invoking CI job supplies, with no encoding or hidden payload. Flagged as critical by pattern alone, but the context is a normal container or CI entrypoint.
info ~~critical~~ → info by review dynamic-execution ci/run-apple-simulator.sh:41:1

command name is a variable or substitution — executed command determined at runtime (ast pass, confidence 0.90)
```
# Delegate to run.sh for the rest.
"$(dirname "$0")/run.sh" "$target"
```
likely benign LLM, confidence 0.92 Simulator runner delegates to a sibling run.sh script located via dirname of $0.
Reasoning
The script invokes run.sh located relative to its own directory via $(dirname "$0"), passing the target as an argument. This is a normal delegation pattern within a repository's CI tooling. The dynamic part is the script's own sibling path, not untrusted input.
info dynamic-execution ci/run.sh:47:1

command name is a variable (`$cmd`) that this file sets only to plain text (ast pass, confidence 0.40)
```
# shellcheck disable=SC2086
$cmd --no-default-features -- $test_flags
# shellcheck disable=SC2086
$cmd -- $test_flags
```
info dynamic-execution ci/run.sh:49:1

command name is a variable (`$cmd`) that this file sets only to plain text (ast pass, confidence 0.40)
```
# shellcheck disable=SC2086
$cmd -- $test_flags
# shellcheck disable=SC2086
$cmd --features extra_traits -- $test_flags
```
info dynamic-execution ci/run.sh:51:1

command name is a variable (`$cmd`) that this file sets only to plain text (ast pass, confidence 0.40)
```
# shellcheck disable=SC2086
$cmd --features extra_traits -- $test_flags

$doc_cmd
```
info dynamic-execution ci/run.sh:59:5

command name is a variable (`$cmd`) that this file sets only to plain text (ast pass, confidence 0.40)
```
    # shellcheck disable=SC2086
    RUSTFLAGS="$RUSTFLAGS --cfg=libc_unstable_time64" $cmd -- $test_flags
fi
```

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/rust-lang/libc libc && cd libc
git checkout 0.2.191
disclude scan --severity info --diff 0.2.190 .