crates.io / rustls-webpki / 0.104.0-alpha.8

rustls-webpki 0.104.0-alpha.8

Source: https://github.com/rustls/webpki
Commit scanned: 4657021e5bd5 (recorded by crates.io)
Compared with: d3b9a6db1e3b (0 signals introduced since)
Files: 56 scanned, 256 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 3 info
Scan time: 4.5 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 3 of 3 warn and critical signals; 3 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-20 09:12

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review dynamic-execution third-party/chromium/data/verify_signed_data/ours/make-pss.py:54:5

`subprocess.check_call` called with `shell=True` and a literal command (ast pass, confidence 0.70)
```
if __name__ == '__main__':
    subprocess.check_call('openssl genrsa -out priv.pem 2048', shell = True)
    subprocess.check_call('openssl rsa -pubout -out pub.pem -in priv.pem', shell = True)
    subprocess.check_call('openssl asn1parse -inform pem -in pub.pem -out pub.der', shell = True)
```
likely benign LLM, confidence 0.93 Build-time helper in Chromium test data that invokes openssl with a hardcoded command to generate an RSA private key.
Reasoning
The shell=True call runs a fixed literal openssl command to generate test RSA keys. No external or user-controlled input reaches the command string, and the file sits in Chromium's test-data generator tree. This is a legitimate build-time pattern, though shell=True with literals is a minor hygiene issue.
info ~~warn~~ → info by review dynamic-execution third-party/chromium/data/verify_signed_data/ours/make-pss.py:55:5

`subprocess.check_call` called with `shell=True` and a literal command (ast pass, confidence 0.70)
```
    subprocess.check_call('openssl genrsa -out priv.pem 2048', shell = True)
    subprocess.check_call('openssl rsa -pubout -out pub.pem -in priv.pem', shell = True)
    subprocess.check_call('openssl asn1parse -inform pem -in pub.pem -out pub.der', shell = True)
```
likely benign LLM, confidence 0.93 Hardcoded openssl invocation that extracts the public key from the generated private key for test fixtures.
Reasoning
Same pattern as the sibling finding: a hardcoded openssl rsa command deriving a public key from a locally generated key. No untrusted input is involved, and the context is a Chromium test-data generator.
info ~~warn~~ → info by review dynamic-execution third-party/chromium/data/verify_signed_data/ours/make-pss.py:56:5

`subprocess.check_call` called with `shell=True` and a literal command (ast pass, confidence 0.70)
```
    subprocess.check_call('openssl rsa -pubout -out pub.pem -in priv.pem', shell = True)
    subprocess.check_call('openssl asn1parse -inform pem -in pub.pem -out pub.der', shell = True)
    gen('rsa-pss-sha256-salt32.pem', TOP + 'src/data/alg-pss-sha256.der', 'sha256')
```
likely benign LLM, confidence 0.93 Hardcoded openssl asn1parse call converting a test public key to DER format within a Chromium test-data generator.
Reasoning
A fixed openssl asn1parse command converts the PEM public key to DER for test fixtures. The arguments are literal and the script is a test-data generator, so there is no malicious indicator.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/rustls/webpki webpki && cd webpki
git checkout 4657021e5bd53b4393a3050cde52609b43b63f31
disclude scan --severity info --diff d3b9a6db1e3b7a81ca1e1e6136a303f4ab11b32d .