PyPI / distro / 1.9.0

distro 1.9.0

Source

https://github.com/python-distro/distro

Tag scanned

v1.9.0

Compared with

v1.8.0 (0 signals introduced since)

Files

41 scanned, 141 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 5 info

Scan time

5.9 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 5 of 5 warn and critical signals; 5 demoted to info.

Disclude version

4.1.0

Scanned (UTC)

2026-10-22 01:37

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info warn → info by review dynamic-import tests/resources/distros/__shared__/bin/lsb_release:31:1

   `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

   
   source $LSB_FILE
   
   if [[ -n $LSB_VERSION ]]; then

   likely benign LLM, confidence 0.85 Shared test-fixture lsb_release script that sources a variable LSB file path.

   Reasoning

   This is a shell test fixture that imitates the lsb_release command for a distro layout. The source of $LSB_FILE is a dynamic path, but it sits in a test resource that emulates LSB behaviour, and the snippet shows no network fetch, decoding, or hidden execution. The pattern is real but matches a legitimate script.

2. info warn → info by review dynamic-import tests/resources/distros/mageia5/bin/lsb_release:31:1

   `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

   
   source $LSB_FILE
   
   echo "LSB Version:	${LSB_VERSION:-*}"

   likely benign LLM, confidence 0.85 Mageia 5 test-fixture lsb_release script that sources a variable LSB file path.

   Reasoning

   Same dynamic source of $LSB_FILE as the shared fixture, inside a distro-specific test resource that prints an LSB version. Nothing in the snippet suggests malicious intent, so the dynamic path reflects a test emulator rather than an attack.

3. info warn → info by review dynamic-import tests/resources/distros/mandriva2011/bin/lsb_release:31:1

   `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

   
   source $LSB_FILE
   
   echo "LSB Version:	${LSB_VERSION:-*}"

   likely benign LLM, confidence 0.85 Mandriva 2011 test-fixture lsb_release script that sources a variable LSB file path.

   Reasoning

   Identical dynamic source pattern in a Mandriva 2011 test fixture that echoes an LSB version. The surrounding code is ordinary output formatting, which fits a benign emulated command.

4. info warn → info by review dynamic-import tests/resources/distros/ubuntu14/bin/lsb_release:31:1

   `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

   
   source $LSB_FILE
   
   echo "No LSB modules are available."

   likely benign LLM, confidence 0.85 Ubuntu 14 test-fixture lsb_release script that sources a variable LSB file path.

   Reasoning

   Dynamic source of $LSB_FILE in an Ubuntu 14 test fixture, followed by an ordinary message about missing LSB modules. This is a faithful imitation of lsb_release behaviour and shows no dropper or evasion.

5. info warn → info by review dynamic-import tests/resources/distros/ubuntu16/bin/lsb_release:31:1

   `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

   
   source $LSB_FILE
   
   echo "No LSB modules are available."

   likely benign LLM, confidence 0.85 Ubuntu 16 test-fixture lsb_release script that sources a variable LSB file path.

   Reasoning

   Dynamic source of $LSB_FILE in an Ubuntu 16 test fixture with a plain echo message afterward. The code matches the other distro fixtures and is consistent with a benign test emulator.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/python-distro/distro distro && cd distro
git checkout v1.9.0
disclude scan --severity info --diff v1.8.0 .