Subject
cc 1.2.62 is a build-time library for Cargo build scripts that drives the host C/C++ compiler to compile C, C++, assembly, and CUDA sources into static archives. It is used by a large fraction of -sys crates in the ecosystem. The crate's primary surface is the Build struct, which accumulates source files, flags, and environment overrides, then locates an appropriate compiler (cc, gcc, clang, cl.exe, nvcc), constructs an argv-form command line, spawns the compiler, and links the results into a .a or .lib archive. An optional parallel feature enables concurrent compilation coordinated via a Cargo jobserver. The crate itself has no build script (build = false).
Methodology
The published crate contents were compared against the upstream VCS repository at the commit recorded in .cargo_vcs_info.json using diff -rq. The differences were limited to Cargo.toml (cargo normalisation), the absence of tests/, .github/, dev-tools/, and src/bin/ from the published crate (all excluded in Cargo.toml.orig), and standard registry files. No source file divergences were found.
All 16 Rust source files (~7,500 unique lines) were read. The shipped src/detect_compiler_family.c (16 lines) was also read. Source survey grep passes were run for unsafe, Command::new, env::var, filesystem operations, network, concurrency, and cryptographic APIs before reading each file in full. The openvet CLI (0.6.0) was used throughout.
Results
The published contents match the VCS source exactly for all compiled files, justifying is-benign. The crate ships no binary artefacts (has-binaries) and no build.rs (has-build-exec, has-install-exec). 17 unit tests live in src/lib.rs; the integration test suite (excluded from the published crate but present in vcs/tests/) covers compilation behaviour across compilers. has-unit-tests and has-integration-tests are both true. No fuzz tests or property tests were found (has-fuzz-tests, has-property-tests).
The crate invokes compilers, archivers, and build-support tools via std::process::Command. All invocations use the argv form; flags and paths are passed as OsString values, never interpolated into a shell string. The shlex crate splits compiler paths (e.g. CC='sccache cc') and CFLAGS-style variables when CC_SHELL_ESCAPED_FLAGS is set, but the resulting tokens are fed directly as argv elements. There is no shell involvement. This justifies uses-exec and exec-safe.
All filesystem writes are anchored to OUT_DIR (for object files, archives, and flag-probe temporaries) or env::temp_dir (fallback during compiler-family detection only). The NamedTempfile helper creates files with create_new(true), avoiding races, and cleans up on drop. This justifies uses-filesystem and filesystem-safe.
Environment variable access goes through Build::get_env, which emits cargo:rerun-if-env-changed=<name> for each variable read. Cargo-set variables (CARGO_CFG_*, OUT_DIR, TARGET, HOST, NUM_JOBS) are read via a separate cargo_env_var_os helper that intentionally skips the rerun directive since Cargo already tracks those. The documented four-tier lookup scheme (CC_<target>, CC_<target_underscored>, TARGET_CC, CC) is implemented in target_envs. The crate does not enumerate the environment. Justifies uses-environment and environment-safe.
RwLock guards the compiler-family lookup cache; Mutex guards the jobserver's implicit-token state in the parallel feature. The Arc<AtomicBool> in CargoOutput handles the rerun-if-env-changed deduplication flag. No shared mutable state is accessed without synchronisation. Justifies uses-concurrency and concurrency-safe. Thread-safety contracts are not individually documented per type (concurrency-documented false).
Unsafe code appears in three locations: src/utilities.rs (the OnceLock<T> backport), src/parallel/async_executor.rs (Pin::new_unchecked and Waker::from_raw), and src/parallel/stderr.rs (libc::fcntl/ioctl and Windows PeekNamedPipe). Each unsafe block's invariants were read and verified as sound. The OnceLock invariants rely on Once::is_completed() as the initialization guard; Pin::new_unchecked is safe because the futures are stack-pinned and cannot move after the call; the libc calls operate on file descriptors obtained from live child handles. Justifies uses-unsafe and unsafe-safe. All unsafe is necessary for MSRV compatibility and non-blocking I/O; unsafe-minimal is true. However, most unsafe blocks lack canonical // SAFETY: comments (see FINDING-1), justifying unsafe-documented false.
The crate implements a parser for CARGO_ENCODED_RUSTFLAGS (unit-separated codegen flags in src/flags.rs) and a Rust target-triple parser in src/target/parser.rs. Both parsers are well-tested by the integration suite and handle edge cases (unknown flags, short targets). impl-parser, parser-impl-safe, parser-impl-correct, and parser-impl-tested are all true. uses-concurrency is true; impl-concurrency is false (uses standard library primitives, does not implement them). The codebase was reviewed for cryptographic operations, network calls, JIT compilation, and interpreter usage and none was found (uses-crypto, uses-network, uses-jit, uses-interpreter, impl-crypto, impl-jit, impl-interpreter, impl-protocol, impl-datastructure, impl-algorithm). The unsafe blocks were not put through an automated testing tool such as Miri; unsafe-tested is false.
One low-severity quality finding was identified (FINDING-1): missing // SAFETY: comments on the majority of unsafe blocks.
Conclusion
cc 1.2.62 is a widely-used build-time compiler driver with no binary artefacts, no build script, and no network access. Its 19 unsafe blocks are concentrated in an OnceLock backport and parallel-compilation I/O helpers; all were read and found sound. The crate makes deliberate attempts at determinism (ZERO_AR_DATE, the cqD archiver flag, relative-path hashing for object names). The single finding is a quality issue around missing // SAFETY: documentation on unsafe blocks.