PyPI / distro / 1.9.0

distro 1.9.0

Source

https://github.com/python-distro/distro

Tag scanned

v1.9.0

Compared with

v1.8.0 (0 signals introduced since)

Files

41 scanned, 141 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 5 info

Scan time

5.6 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 5 of 5 warn and critical signals; 5 demoted to info.

Disclude version

4.0.0

Scanned (UTC)

2026-10-14 18:27

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info warn → info by review dynamic-import tests/resources/distros/__shared__/bin/lsb_release:31:1

   `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

   
   source $LSB_FILE
   
   if [[ -n $LSB_VERSION ]]; then

   likely benign LLM, confidence 0.85 A bash lsb_release test fixture that sources a script path held in LSB_FILE.

   Reasoning

   This is a test fixture mimicking the standard Debian/Ubuntu lsb_release script, which sources a module file from a path held in a variable. The snippet does not show how LSB_FILE is set, but the context is a legitimate system utility reproduced for testing, not a dropper or attacker-controlled load.

2. info warn → info by review dynamic-import tests/resources/distros/mageia5/bin/lsb_release:31:1

   `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

   
   source $LSB_FILE
   
   echo "LSB Version:	${LSB_VERSION:-*}"

   likely benign LLM, confidence 0.85 A Mageia 5 lsb_release test fixture that sources LSB_FILE and then prints the LSB version.

   Reasoning

   Same standard lsb_release sourcing pattern in a Mageia test fixture. The file sits under tests/resources/distros, and the surrounding lines are ordinary version-printing output, so this is a benign fixture.

3. info warn → info by review dynamic-import tests/resources/distros/mandriva2011/bin/lsb_release:31:1

   `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

   
   source $LSB_FILE
   
   echo "LSB Version:	${LSB_VERSION:-*}"

   likely benign LLM, confidence 0.85 A Mandriva 2011 lsb_release test fixture that sources LSB_FILE and echoes the version.

   Reasoning

   Identical legitimate lsb_release sourcing in a Mandriva 2011 test fixture. Nothing in the snippet suggests network fetch, encoding or code injection, and the path is within the test resources.

4. info warn → info by review dynamic-import tests/resources/distros/ubuntu14/bin/lsb_release:31:1

   `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

   
   source $LSB_FILE
   
   echo "No LSB modules are available."

   likely benign LLM, confidence 0.85 An Ubuntu 14 lsb_release test fixture that sources LSB_FILE and reports when no LSB modules are present.

   Reasoning

   Standard lsb_release module-sourcing pattern in an Ubuntu 14 test fixture, followed by a benign message about missing LSB modules. This is a normal distro-tool reproduction used for testing.

5. info warn → info by review dynamic-import tests/resources/distros/ubuntu16/bin/lsb_release:31:1

   `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

   
   source $LSB_FILE
   
   echo "No LSB modules are available."

   likely benign LLM, confidence 0.85 An Ubuntu 16 lsb_release test fixture that sources LSB_FILE and reports when no LSB modules are present.

   Reasoning

   Same legitimate lsb_release sourcing pattern and benign output message as the Ubuntu 14 fixture. It is a test resource mirroring a system utility, with no sign of malicious intent.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/python-distro/distro distro && cd distro
git checkout v1.9.0
disclude scan --severity info --diff v1.8.0 .