disclude.ionix 0.31.3
- Source
- https://github.com/nix-rust/nix
- Artifact scanned
nix-0.31.3.crate- Compared with
nix-0.31.2.crate(0 signals introduced since)- Files
- 120 scanned, 6 skipped (binary, oversized, or unrecognised)
- Signals
- 0 critical · 0 warn · 2 info
- Scan time
- 3.9 s
- LLM review
- Reviewed by claude-haiku-5-5 (Anthropic): 2 of 2 warn and critical signals; 2 demoted to info.
- Disclude version
- 4.3.0
- Scanned (UTC)
- 2026-10-24 05:57
Signals
Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.
-
iv: *b"\x04\x05\x06\x07\x08\x09\x0a\x0b", key: *b"\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f", salt: *b"\x00\x01\x02\x03", rec_seq: *b"\x00\x00\x00\x00\x00\x00\x00\x00",likely benign Test vector bytes for a kernel TLS socket option test, filled with sequential hex escapes for IV, key, salt and record sequence.Reasoning
The snippet is a Rust test fixture building a kernel TLS crypto info struct from sequential byte literals (0x00..0x1f counting up) and zero rec_seq. Sequential test vectors are a standard pattern for deterministic test data, not a payload. The raw-pass critical severity and 'unsafe block' elevation reflect the byte-escape pattern and file context, not malicious intent.
-
iv: *b"\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb", key: *b"\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef", salt: *b"\xf0\xf1\xf2\xf3", rec_seq: *b"\x00\x00\x00\x00\x00\x00\x00\x00",likely benign Fixed test key, IV and salt bytes in a kernel TLS sockopt test struct written as hex escapes.Reasoning
Same file and structure as the other finding: a kernel TLS crypto-info test struct with incrementing byte literals (0xf0..0xf7 etc.) as IV, key and salt, plus zero rec_seq. These are deterministic fixed test constants in a nix-style sys test, consistent with legitimate testing of setsockopt for TLS.
Reproduce This Scan
Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.
|
&&