nix 0.31.3

Source: https://github.com/nix-rust/nix
Tag scanned: v0.31.3
Compared with: v0.31.2 (0 signals introduced since)
Files: 125 scanned, 7 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 2 info
Scan time: 2.9 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 2 of 2 warn and critical signals; 2 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-14 21:15

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~critical~~ → info by review encoding-hex test/sys/test_sockopt.rs:926:17

16 consecutive `\xNN` escapes (entropy 4.0 bits/byte) [elevated: unsafe block in same file] (raw pass, confidence 0.65)
```
        iv: *b"\x04\x05\x06\x07\x08\x09\x0a\x0b",
        key: *b"\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f",
        salt: *b"\x00\x01\x02\x03",
        rec_seq: *b"\x00\x00\x00\x00\x00\x00\x00\x00",
```
likely benign LLM, confidence 0.95 Test vector with sequential byte literals for kernel TLS crypto sockopt parameters in a Rust test file.
Reasoning
The snippet is a Rust test fixture building kernel TLS crypto parameters (iv, key, salt, rec_seq) from sequential byte literals 0x00..0x1f. Sequential counting bytes are a common deterministic test vector pattern, not an encoded payload. The raw-pass entropy and hex-escape signal is a false positive for test data in the nix crate's sockopt tests.
info ~~critical~~ → info by review encoding-hex test/sys/test_sockopt.rs:939:17

16 consecutive `\xNN` escapes (entropy 4.0 bits/byte) [elevated: unsafe block in same file] (raw pass, confidence 0.65)
```
        iv: *b"\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb",
        key: *b"\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef",
        salt: *b"\xf0\xf1\xf2\xf3",
        rec_seq: *b"\x00\x00\x00\x00\x00\x00\x00\x00",
```
likely benign LLM, confidence 0.95 Deterministic test constants for TLS crypto parameters in a Rust sockopt test.
Reasoning
Same file and structure as the other finding: deterministic test key, IV, salt and zeroed rec_seq for a TLS sockopt test. The byte sequences are sequential and hand-written test constants. No execution, decoding, or network behavior is present in the snippet; the unsafe-block elevation reflects normal FFI test code.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/nix-rust/nix nix && cd nix
git checkout v0.31.3
disclude scan --severity info --diff v0.31.2 .