sipnab 0.5.231

Done dynamic on Linux job 294240 crates.io SBOM Findings (VEX) Compare with 0.5.230

medium severity process_spawn in build_script code (24 places): std::process::Command::new

low

Automated verdict. Nobody reviewed it. A score is a reason to look closer, not a finding.

Evidence

Points	Signal	Where	What
10	static:process_spawn static · sipnab	build.rs:88	medium severity process_spawn in build_script code (24 places): std::process::Command::new
2	static:environment_enumeration static · sipnab	src/process_isolation.rs:1697	medium severity environment_enumeration in library code (2 places): std::env::vars_os
2	static:included_binary static · sipnab	src/capture/decrypt.rs:3124	medium severity included_binary in library code (2 places): tests/fixtures/tls_rsa/premaster_ct.bin (256 bytes)
2	static:yara:persistence_locations static · sipnab	CHANGELOG.md:20461	medium severity yara:persistence_locations in library code (4 places): Paths and keys used to persist on a developer machine
2	static:yara:sandbox_evasion static · sipnab	src/output/runtime.rs:178	medium severity yara:sandbox_evasion in library code: Checks for virtual machines, sandboxes or debuggers
1	static:build_script static · sipnab	build.rs	low severity build_script in build_script code: build.rs

Behavior

Profile

static:environment_enumeration static:included_binary static:process_spawn static:yara:persistence_locations static:yara:sandbox_evasion

Static findings

All 521 medium 12 low 183 info 326 12 groups

medium process_spawn build_script 4

std::process::Command::new build.rs:88 build.rs:184 build.rs:208 build.rs:217

medium yara_match persistence_locations library 4

Paths and keys used to persist on a developer machine CHANGELOG.md:20461 src/capture/archive/mod.rs:31 src/capture/archive/tar.rs:9 src/cli.rs:3988

medium included_binary library 2

tests/fixtures/tls_rsa/premaster_ct.bin (256 bytes) src/capture/decrypt.rs:3124 src/capture/rsa_key.rs:85

medium environment_enumeration library 1

std::env::vars_os src/process_isolation.rs:1697

medium yara_match sandbox_evasion library 1

Checks for virtual machines, sandboxes or debuggers src/output/runtime.rs:178

low network_access library 158

low process_spawn library 20

low foreign_functions library 4

extern block src/capture/libpcap.rs:143 src/capture/next_ex.rs:162 src/crash/frames.rs:327 src/crash/frames.rs:404

low build_script build_script 1

build.rs build.rs

info url_literal library 293

https://sipnab.com/ns/yang/sipnab-diagnosis src/analysis/yang.rs:70
https://github.com/NormB/sipnab src/analysis/yang.rs:1136
https://sipnab.com/docs/output-formats/ src/analysis/yang.rs:1160
https:// src/app/bootstrap.rs:5581 src/app/https_client.rs:81 src/output/vcon_jose.rs:740 src/output/vcon_jose.rs:740
http://127.0.0.1:8000/x src/app/bootstrap.rs:7386 src/app/vcon_forward.rs:2840 src/cli.rs:9345 src/cli.rs:9390
https://www.itu.int/rec/dologin_pub.asp?lang=e&id=T-REC-G.729-201206-I!!SOFT-ZST-E&type=items src/app/g729_install.rs:31
The trained codebook values of G.729 are published in the reference C code of the ITU-T G.729 software package, and that code's notice keeps its authors' rights. So sipnab reads them from your own cop… src/app/g729_install.rs:42
http://127.0.0.1:{port}/package.zip src/app/g729_install.rs:552
https://fetcher:s3cret-token@example.invalid/pkg.zip src/app/g729_install.rs:854 src/app/g729_install.rs:864
https://fetcher:ab?cd-secret@example.invalid/pkg.zip src/app/g729_install.rs:874
http:// src/app/https_client.rs:83
'{shown}': {client} speaks http:// and https:// only src/app/https_client.rs:88
{scheme}://{}{} src/app/https_client.rs:163
:// src/app/run_provenance.rs:331 src/app/run_provenance.rs:375
https://user:pw@store.example.com:8443/v1?x=1 src/app/run_provenance.rs:448
https://[redacted]@store.example.com:8443/v1?x=1 src/app/run_provenance.rs:449
udp://tok@[2001:db8::1]:9060 src/app/run_provenance.rs:452
udp://[redacted]@[2001:db8::1]:9060 src/app/run_provenance.rs:453
http://a@b@store.example.com/ src/app/run_provenance.rs:456
http://[redacted]@store.example.com/ src/app/run_provenance.rs:457
https://user:pw#x@store.example.com/v1 src/app/run_provenance.rs:464
https://[redacted]@store.example.com/v1 src/app/run_provenance.rs:465 src/app/run_provenance.rs:469 src/app/run_provenance.rs:513
https://user:pw?x@store.example.com/v1 src/app/run_provenance.rs:468
--hep-send=tcp://user:pw@collector.example.com:9060 src/app/run_provenance.rs:472
--hep-send=tcp://[redacted]@collector.example.com:9060 src/app/run_provenance.rs:473 src/app/run_provenance.rs:514
https://store.example.com/v1?mail=a@b src/app/run_provenance.rs:476 src/app/run_provenance.rs:477 src/app/vcon_forward.rs:2193
https://store.example.com/v1 src/app/run_provenance.rs:480 src/app/run_provenance.rs:481
https://user:planted-a@store.example.com/v1 src/app/run_provenance.rs:498
--hep-send=tcp://planted-b@collector.example.com:9060 src/app/run_provenance.rs:499
http://user:planted-c@store.example.com/x src/app/run_provenance.rs:503
http://[redacted]@store.example.com/x src/app/run_provenance.rs:518
MCP over HTTP at {}://{addr}/mcp src/app/tui_mode.rs:1032
MCP over HTTP at http://127.0.0.1:43929/mcp src/app/tui_mode.rs:2814
Reading A. | MCP over HTTP at https://127.0.0.1:43929/mcp src/app/tui_mode.rs:2818
url {url:?} is not https://, and draft-ietf-vcon-vcon-core-04 section 2.4.1 says "HTTPS MUST be used for retrieval"; nothing was fetched src/app/vcon_audio_fetch.rs:338
https://a/b.wav src/app/vcon_audio_fetch.rs:388
https://m/calls/ab-c_1.wav.jwe src/app/vcon_audio_fetch.rs:416
https://m/calls/a.wav?x=1 src/app/vcon_audio_fetch.rs:419
https://m/calls/ src/app/vcon_audio_fetch.rs:421
https://m/.. src/app/vcon_audio_fetch.rs:422
https://m/.hidden src/app/vcon_audio_fetch.rs:423
https://m/a%2F..%2Fb src/app/vcon_audio_fetch.rs:424
'{url}' sends call content in the clear to another host; use https:// (plain http:// is for a service on this host, 127.0.0.1 or ::1) src/app/vcon_enrich.rs:172
kind = "conserver"\u{a}url = "https://keys.example.com/base"\u{a}auth_file = "/etc/keys/auth"\u{a}ca = "/etc/keys/ca.pem"\u{a}timeout = 12\u{a}max_response_head = 15000\u{a}max_size = 16000 src/app/vcon_fetch.rs:1558
https://keys.example.com/base/vcon/{uuid} src/app/vcon_fetch.rs:1571
--vcon-fetch-url=https://flags.example.com src/app/vcon_fetch.rs:1593
https://flags.example.com/api/v1/vcons/{uuid} src/app/vcon_fetch.rs:1606
--vcon-fetch-url=http://127.0.0.1:9/v/{uuid} src/app/vcon_fetch.rs:1631 src/app/vcon_fetch.rs:1705 src/app/vcon_fetch.rs:1718 src/app/vcon_fetch.rs:1744 src/app/vcon_fetch.rs:1879 src/app/vcon_fetch.rs:1895 src/app/vcon_fetch.rs:1932
--vcon-fetch-url=https://user:pw@store.example/{uuid} src/app/vcon_fetch.rs:1659
url = "https://user:pw@store.example/{uuid}" src/app/vcon_fetch.rs:1666
--vcon-fetch-url=ftp://store.example/{uuid} src/app/vcon_fetch.rs:1680
an ftp:// URL was accepted src/app/vcon_fetch.rs:1686
https://api.vcon.store src/app/vcon_fetch.rs:1784
https://api.vcon.store/v1/vcons/{uuid} src/app/vcon_fetch.rs:1785
http://127.0.0.1:8000/ src/app/vcon_fetch.rs:1788 src/app/vcon_forward.rs:2794
http://127.0.0.1:8000/vcon/{uuid} src/app/vcon_fetch.rs:1789
http://127.0.0.1:8000/api/ src/app/vcon_fetch.rs:1792
http://127.0.0.1:8000/api/vcon/{uuid} src/app/vcon_fetch.rs:1793
http://127.0.0.1:3000 src/app/vcon_fetch.rs:1796
http://127.0.0.1:3000/api/v1/vcons/{uuid} src/app/vcon_fetch.rs:1797
http://127.0.0.1:3000/x/{uuid}?full=1 src/app/vcon_fetch.rs:1800 src/app/vcon_fetch.rs:1801
http://127.0.0.1:9/v/{uuid} src/app/vcon_fetch.rs:1804 src/app/vcon_fetch.rs:1805
http://127.0.0.1:9/v src/app/vcon_fetch.rs:1807
http://127.0.0.1:9/v?x=1 src/app/vcon_fetch.rs:1811
kind = "conserver"\u{a}url = "http://127.0.0.1:9"\u{a}auth_file = {:?} src/app/vcon_fetch.rs:2022
url = "http://127.0.0.1:9/v/{uuid}" src/app/vcon_fetch.rs:2031
http://{} src/app/vcon_fetch.rs:2299
{endpoint} is plain http to another machine: the auth header and every container cross the network unencrypted. Use https:// for anything but loopback src/app/vcon_forward.rs:694
{issuer_from} {issuer:?} is not a URI: give a scheme and more, such as https://pbx.example.com/sipnab, of 1 to {} characters src/app/vcon_forward.rs:995
http://127.0.0.1:8000/vcon/external-ingress?ingress_list=sipnab src/app/vcon_forward.rs:2179 src/app/vcon_forward.rs:2720
https://api.vcon.store/v1/vcons src/app/vcon_forward.rs:2191 src/app/vcon_forward.rs:2689
http://store.example.com src/app/vcon_forward.rs:2195
https://[2001:db8::1]:8443/x src/app/vcon_forward.rs:2197 src/app/vcon_forward.rs:2199
ftp://store.example.com/ src/app/vcon_forward.rs:2209 src/app/vcon_forward.rs:2254
https:///v1 src/app/vcon_forward.rs:2211
https://store.example.com:99999/ src/app/vcon_forward.rs:2212
https://store.example.com:x/ src/app/vcon_forward.rs:2213
https://user:pw@store.example.com/ src/app/vcon_forward.rs:2214
https://vcs_live_token@store.example.com/v1 src/app/vcon_forward.rs:2215
https://store.example.com/v1#frag src/app/vcon_forward.rs:2216
https://store.example.com /v1 src/app/vcon_forward.rs:2217
https://user:pw@store.example.com/v1 src/app/vcon_forward.rs:2232
sipnab speaks http:// and https:// only src/app/vcon_forward.rs:2257
https://user:planted-pw@store.example.com/v1 src/app/vcon_forward.rs:2267 src/app/vcon_forward.rs:2284
ftp://user:planted-pw@store.example.com/ src/app/vcon_forward.rs:2268
https://user:planted-pw@store.example.com /v1 src/app/vcon_forward.rs:2270
https://user:planted-pw@store.example.com/v1#frag src/app/vcon_forward.rs:2271
https://user:planted-pw@store.example.com:99999/ src/app/vcon_forward.rs:2272
https://user:planted-pw#x@store.example.com/v1 src/app/vcon_forward.rs:2273
https://user:planted-pw?x@store.example.com/v1 src/app/vcon_forward.rs:2274
kind = "generic"\u{a}url = "https://keys.example.com/v1/vcons"\u{a}replace_url = "https://keys.example.com/v1/vcons/{uuid}"\u{a}auth_file = "/etc/keys/auth"\u{a}ca = "/etc/keys/ca.pem"\u{a}done = "/sr… src/app/vcon_forward.rs:2435
https://keys.example.com/v1/vcons src/app/vcon_forward.rs:2450
https://keys.example.com/v1/vcons/{uuid} src/app/vcon_forward.rs:2453
--vcon-forward-url=https://flags.example.com/v2/in src/app/vcon_forward.rs:2486
--vcon-forward-replace-url=https://flags.example.com/v2/in/{uuid} src/app/vcon_forward.rs:2487
https://flags.example.com/v2/in src/app/vcon_forward.rs:2501
https://flags.example.com/v2/in/{uuid} src/app/vcon_forward.rs:2504
--vcon-forward-url=http://127.0.0.1:9/x src/app/vcon_forward.rs:2541 src/app/vcon_forward.rs:2575 src/app/vcon_forward.rs:2629 src/app/vcon_forward.rs:2768
--vcon-forward-url=https://api.vcon.store src/app/vcon_forward.rs:2684
--vcon-forward-url=https://api.vcon.store/v1/vcons src/app/vcon_forward.rs:2692
kind = "conserver"\u{a}url = "http://127.0.0.1:8000" src/app/vcon_forward.rs:2716 src/app/vcon_forward.rs:2786
--vcon-forward-url=https://proxy.example.com/other/path src/app/vcon_forward.rs:2740
--vcon-forward-replace-url=https://proxy.example.com/other/path/{uuid} src/app/vcon_forward.rs:2742
https://proxy.example.com/other/path src/app/vcon_forward.rs:2746
https://proxy.example.com/other/path/{uuid} src/app/vcon_forward.rs:2749
http://192.0.2.10:8000/x src/app/vcon_forward.rs:2826
http://store.example.com/x src/app/vcon_forward.rs:2833
http://localhost:8000/x src/app/vcon_forward.rs:2847
http://[::1]:8000/x src/app/vcon_forward.rs:2853
https://192.0.2.10/x src/app/vcon_forward.rs:2857
{scheme}://{} src/app/vcon_scitt.rs:853 src/mcp/transport.rs:234
https://pbx.example.com/sipnab src/app/vcon_scitt.rs:996
1http://x src/app/vcon_scitt.rs:1006
https://a b src/app/vcon_scitt.rs:1008
ht_tp://x src/app/vcon_scitt.rs:1009
http://127.0.0.1:1/ src/app/vcon_scitt.rs:1049
http://127.0.0.1:1/scitt src/app/vcon_scitt.rs:1050
http://127.0.0.1:1/scitt/ src/app/vcon_scitt.rs:1051
http://127.0.0.1:1/s?tenant=a src/app/vcon_scitt.rs:1052
https://ts.example:8443/scitt src/app/vcon_scitt.rs:1148 src/app/vcon_scitt.rs:1185
https://ts.example:8443/scitt/entries/1 src/app/vcon_scitt.rs:1152
https://TS.example:8443/entries/1?x=1 src/app/vcon_scitt.rs:1153
http://ts.example/scitt src/app/vcon_scitt.rs:1161
http://ts.example:80/e/1 src/app/vcon_scitt.rs:1165
http://ts.example:8443/entries/1 src/app/vcon_scitt.rs:1169
https://ts.example/entries/1 src/app/vcon_scitt.rs:1170
https://other.example:8443/entries/1 src/app/vcon_scitt.rs:1171
ftp://ts.example:8443/entries/1 src/app/vcon_scitt.rs:1174
https://poller:s3cret-token@other.example:8443/entries/1 src/app/vcon_scitt.rs:1196 src/app/vcon_scitt.rs:1212
https://poller:s3cret-token@ts.example:8443/entries/1 src/app/vcon_scitt.rs:1197
https://ts.example:8443 src/app/vcon_scitt.rs:1217
https://poller:ab?cd-secret@ts.example:8443/e/1 src/app/vcon_scitt.rs:1226
https://signer:s3cret-token@example.invalid/chain.pem src/capture/vcon_input.rs:1498 src/capture/vcon_input.rs:1507
https://signer:ab?cd-secret@example.invalid/chain.pem src/capture/vcon_input.rs:1517
https://store.example.com/v1/vcons src/cli.rs:9013 src/cli.rs:9063
https://store.example.com/v1/vcons/{uuid} src/cli.rs:9027
Build the G.729 codebook tables from the ITU-T G.729 software package and install them.\u{a}\u{a}Downloads the package from itu.int, checks its sha256, builds the table file from it, and writes the fi… src/cli/g729_args.rs:40
kind = "vcon-store"\u{a}url = "https://store.example.com/v1/vcons"\u{a}replace_url = "https://store.example.com/v1/vcons/{uuid}"\u{a}auth_file = "/etc/sipnab/vcon.auth"\u{a}ca = "/etc/sipnab/store-ca.… src/config.rs:5371
sipnab://lint/ src/mcp/completion.rs:42
sipnab://filter/ src/mcp/completion.rs:54
sipnab://vcon/ src/mcp/completion.rs:61
sipnab://live/dialogs/{call_id} src/mcp/completion.rs:132 src/mcp/completion.rs:393 src/mcp/server.rs:14672 src/mcp/server.rs:20910
sipnab://lint/{rule_id} src/mcp/completion.rs:143 src/mcp/server.rs:4501
sipnab://filter/{alias} src/mcp/completion.rs:154 src/mcp/server.rs:14702
sipnab://reference/{topic} src/mcp/completion.rs:167
sipnab://schema/{tool} src/mcp/completion.rs:177 src/mcp/server.rs:16113
sipnab:///{filename} src/mcp/completion.rs:190 src/mcp/server.rs:16117 src/mcp/server.rs:20914 src/mcp/server.rs:20923
sipnab://vcon/{call_id} src/mcp/completion.rs:213 src/mcp/server.rs:20944 src/mcp/server.rs:21014
sipnab://live/dialogs src/mcp/completion.rs:407 src/mcp/live.rs:32 src/mcp/subscribe.rs:441 src/mcp/subscribe.rs:459 src/mcp/subscribe.rs:462 src/mcp/subscribe.rs:464 src/mcp/subscribe.rs:475 src/mcp/subscribe.rs:477 src/mcp/subscribe.rs:515 src/mcp/subscribe.rs:518 src/mcp/subscribe.rs:535 src/mcp/subscribe.rs:538 src/mcp/subscribe.rs:552 src/mcp/subscribe.rs:554 src/mcp/subscribe.rs:570 src/mcp/subscribe.rs:572 src/mcp/subscribe.rs:607 src/mcp/subscribe.rs:609 src/mcp/subscribe.rs:627 src/mcp/subscribe.rs:629 src/mcp/subscribe.rs:630 src/mcp/subscribe.rs:642 src/mcp/subscribe.rs:655 src/mcp/subscribe.rs:657 src/mcp/subscribe.rs:672 src/mcp/subscribe.rs:673
sipnab://nope/{x} src/mcp/completion.rs:408
sipnab://live/dialogs/ src/mcp/live.rs:35 src/mcp/live.rs:138
sipnab://live/dialogs/abc123@10.0.0.1 src/mcp/live.rs:114
sipnab://live/dialogs/a/b src/mcp/live.rs:126
sipnab://reference/filter-dsl src/mcp/live.rs:135 src/mcp/reference.rs:52 src/mcp/reference.rs:115
sipnab:///capture.pcap src/mcp/live.rs:136
sipnab://live/streams src/mcp/live.rs:137
https://sipnab.com src/mcp/live.rs:139
You are auditing codec interoperability with sipnab.\u{a}\u{a}1. `capture_status`.\u{a}2. `check_codec_negotiation` for offers that produced no common codec.\u{a}3. `group_dialogs` by `rtp.codec` with… src/mcp/prompts.rs:89
sipnab://reference/sip-response-codes src/mcp/reference.rs:60
sipnab://reference/mos-and-codecs src/mcp/reference.rs:67
sipnab://reference/does-not-exist src/mcp/reference.rs:143
sipnab:///{name} src/mcp/server.rs:4447
'{alias}' is not a diagnostic alias; complete the 'sipnab://filter/{{alias}}' template, or read sipnab://reference/filter-dsl for the grammar. Served: {} src/mcp/server.rs:4522
'{tool}' is not a tool this server loaded; complete the 'sipnab://schema/{{tool}}' template for the loaded names src/mcp/server.rs:4557
sipnab:/// src/mcp/server.rs:4583
'{uri}' is not a sipnab resource URI; expected sipnab:///<filename> for a capture, one of the sipnab://reference/... URIs that resources/list names, or a URI built from a template that resources/templ… src/mcp/server.rs:4588
sipnab://reference/ src/mcp/server.rs:4741
sipnab:///../etc/passwd src/mcp/server.rs:14637
sipnab:///sub/dir.pcap src/mcp/server.rs:14637
sipnab://filter/slow-setup src/mcp/server.rs:14746
sipnab://filter/no-such-alias src/mcp/server.rs:14772
sipnab://live/dialogs/{i} src/mcp/subscribe.rs:493
sipnab://live/dialogs/one-too-many src/mcp/subscribe.rs:497
sipnab://schema/ src/mcp/tool_schema.rs:22
https://example.invalid/ src/mcp/tool_schema.rs:194
https://vcon.example.com/v1/vcons src/mcp/tools/vcon.rs:2632
--mcp-resource-url {raw:?}: must be an absolute URL including the scheme, e.g. https://sipnab.example.com/mcp src/mcp/transport.rs:199
https://resource.example.com src/mcp/transport.rs:1065 src/mcp/transport.rs:1068 src/mcp/transport.rs:1094
https://resource.example.com/.well-known/oauth-protected-resource src/mcp/transport.rs:1071
https://resource.example.com/resource1 src/mcp/transport.rs:1074 src/mcp/transport.rs:1080
https://resource.example.com/ src/mcp/transport.rs:1093
https://resource.example.com/mcp/ src/mcp/transport.rs:1098
https://resource.example.com/mcp src/mcp/transport.rs:1099
HTTPS://Resource.Example.COM:8443/MCP src/mcp/transport.rs:1116
https://resource.example.com:8443/MCP src/mcp/transport.rs:1118
ftp://sipnab.example.com/mcp src/mcp/transport.rs:1135
https://user:pw@sipnab.test/mcp src/mcp/transport.rs:1136
https://sipnab.test/mcp?tenant=1 src/mcp/transport.rs:1137
https://sipnab.test/mcp#frag src/mcp/transport.rs:1138
https://sipnab.test/{tenant} src/mcp/transport.rs:1139
https://sipnab.test/a//b src/mcp/transport.rs:1140
https://sipnab.test/a b src/mcp/transport.rs:1141
https://sipnab.example.com/mcp src/mcp/transport.rs:1162 src/mcp/transport.rs:1165 src/mcp/transport.rs:1211 src/mcp/transport.rs:1310
Bearer realm="sipnab", resource_metadata="https://sipnab.example.com/.well-known/oauth-protected-resource/mcp" src/mcp/transport.rs:1221
https://sipnab.com/problems/ src/output/api.rs:104
https://sipnab.com/problems/bad-request src/output/api.rs:7873
https://sipnab.com/problems/not-found src/output/api.rs:7914
https://sipnab.com/problems/bad-gateway src/output/api.rs:14999
Identity: eyJhbGciOiJFUzI1NiJ9.eyJhdHRlc3QiOiJBIn0.SIGNATURE;info=<https://example.com/cert.pem>;alg=ES256;ppt=shaken src/output/vcon.rs:6665
{token};info=<https://x/c.pem>;alg=ES256;ppt=shaken src/output/vcon.rs:7025
;info=<https://x/c.pem> src/output/vcon.rs:7045
Identity: {header}.{payload}.c2ln;info=<https://cert.example/c.pem>;alg=ES256;ppt=shaken src/output/vcon.rs:9916
https://example.invalid/schema src/output/vcon_schema.rs:995
https://example.com/x src/output/vcon_schema.rs:1150
this tfps_ctl has no JSON mode: TFPS gained --json in sippulse/tfps#6, merged into master on 2026-09-18 and in no tagged release yet (v0.2.1 rejects it); build TFPS from master, https://github.com/sip… src/security/tfps.rs:575
https://www.rfc-editor.org/rfc/rfc{}.html#section-{} src/sip/lint/finding.rs:161
https://www.rfc-editor.org/rfc/rfc3261.html#section-8.1.1.7 src/sip/lint/finding.rs:1033
this-is-not-a-passport;info=<https://c.example/c.pem> src/sip/stir_shaken.rs:382
{"alg":"ES256","ppt":"shaken","typ":"passport","x5u":"https://cert.example.com/cert.pem"} src/sip/stir_shaken.rs:453
{header_b64}.{payload_b64}.{sig_b64};info=<https://cert.example.com/cert.pem>;alg=ES256;ppt=shaken src/sip/stir_shaken.rs:459
<!DOCTYPE html>\u{a}<html lang="en">\u{a}<head>\u{a}<meta charset="utf-8">\u{a}<title>sipnab — Call Flow Diagram</title>\u{a}<style>\u{a} body {{ background: #0d1117; color: #c9d1d9; font-family: s… src/tui/call_flow/export.rs:42

info unsafe_code library 32

4 unsafe blocks, functions or impls src/app/bootstrap.rs:1623 src/capture/live.rs:116 src/capture/next_ex.rs:87 src/process_isolation/worker_process.rs:502
5 unsafe blocks, functions or impls src/app/run_provenance.rs:185
1 unsafe blocks, functions or impls src/capture/archive/password.rs:1333 src/capture/fanout.rs:92 src/capture/hep.rs:3885 src/capture/libpcap.rs:153 src/capture/uprobe/bpf.rs:121 src/capture/uprobe/mod.rs:145 src/output/cli_print.rs:249 src/security/tfps.rs:796 src/signals.rs:90 src/tui/controllers/file_open.rs:1427
7 unsafe blocks, functions or impls src/capture/archive/tty.rs:113
12 unsafe blocks, functions or impls src/capture/keylog_source.rs:200
3 unsafe blocks, functions or impls src/capture/mapped.rs:173 src/seccomp.rs:791
2 unsafe blocks, functions or impls src/capture/uprobe/bpf_record.rs:187 src/capture/writer.rs:1364 src/clock.rs:114 src/crash.rs:170 src/mcp/server.rs:3088 src/names.rs:645 src/security/alerting.rs:1097
10 unsafe blocks, functions or impls src/capture/uprobe/perf.rs:121
9 unsafe blocks, functions or impls src/crash/frames.rs:255 src/sandbox.rs:512
21 unsafe blocks, functions or impls src/privilege.rs:291
8 unsafe blocks, functions or impls src/process_isolation.rs:120
13 unsafe blocks, functions or impls src/rtp/playback.rs:111

info environment_enumeration library 1

std::env::vars_os, keys only src/process_isolation/worker_process.rs:812

Run: check

failed

Ended: agent reported the end
Guest: exit code 101
Run time: 351 ms
VM restore: 82 ms
Payload: 17014 files, 423.4 MiB
Files opened: 680

Processes 1

Siblings that ran the same program with the same result and the same processes below are folded into one row, with their number.

Process	Arguments	Start	Took	Exit
cargo /usr/local/bin/cargo	check --locked --offline	5 ms	343 ms	25856

Network 0

No network activity.

Files 0

Secrets opened

None.

Written outside the build directories

None.

Scratch disk 0

Files: 7
Directories: 12
Size: 56.6 KiB
Compiled units: 0

Nothing outside the build areas.

Output

Standard error

error: rustc 1.98.1 is not supported by the following packages:
  sipnab@0.5.231 requires rustc 1.99
  sipnab@0.5.231 requires rustc 1.99
  sipnab@0.5.231 requires rustc 1.99
  sipnab-bpf-types@0.1.3 requires rustc 1.99
Either upgrade rustc or select compatible dependency versions with
`cargo update <name>@<current-ver> --precise <compatible-ver>`
where `<compatible-ver>` is the latest version supporting rustc 1.98.1

Timeline

When	From	To	Event	Worker
2026-10-28 00:39 UTC	Discovered	Fetched	fetched	fetcher-12688
2026-10-28 00:39 UTC	Fetched	ReadyForSandbox	static_analysis_completed	static-12726
2026-10-28 00:39 UTC	ReadyForSandbox	Running	sandbox_started	orchestrator-12760-slot0
2026-10-28 00:39 UTC	Running	DynamicallyAnalyzed	sandbox_completed	orchestrator-12760-slot0
2026-10-28 00:39 UTC	DynamicallyAnalyzed	Scored	scored	analyzer-12816
2026-10-28 00:39 UTC	Scored	Done	finalized	analyzer-12816