thruput-sys 0.58.0

Done dynamic on Linux job 294526 crates.io SBOM Findings (VEX)

high severity secret_environment_variable in build_script code: CARGO_REGISTRIES_THRUPUT_INDEX

medium

Automated verdict. Nobody reviewed it. A score is a reason to look closer, not a finding.

Evidence

Points	Signal	Where	What
30	static:secret_environment_variable static · thruput-sys	build.rs:635	high severity secret_environment_variable in build_script code: CARGO_REGISTRIES_THRUPUT_INDEX
10	network_lookup network · thruput-sys	groundhog-public-release-artifacts-017820684264.s3.us-west-2.amazonaws.com	The build looked up groundhog-public-release-artifacts-017820684264.s3.us-west-2.amazonaws.com.
5	exec_downloader trace · thruput-sys	/usr/bin/curl	The build ran /usr/bin/curl.

5 without points

Signal	Where	What
static:build_script static · thruput-sys	build.rs	low severity build_script in build_script code: build.rs
static:downloader_pattern static · thruput-sys	build.rs:12	high severity downloader_pattern in build_script code: https://github.com/thruputchain/hogd.git at build.rs:12 with std::process::Command::new at build.rs:87
static:process_spawn static · thruput-sys	build.rs:87	medium severity process_spawn in build_script code (10 places): std::process::Command::new
static:shell_command static · thruput-sys	build/download.rs:85	high severity shell_command in build_script code: curl not found or failed to execute: {e}
static:url_literal static · thruput-sys	build.rs:12	low severity url_literal in build_script code (3 places): https://github.com/thruputchain/hogd.git

Behavior

Profile

exec:downloader net:groundhog-public-release-artifacts-017820684264.s3.us-west-2.amazonaws.com static:downloader_pattern static:process_spawn static:secret_environment_variable static:shell_command

Static findings

high downloader_pattern build_script 1

https://github.com/thruputchain/hogd.git at build.rs:12 with std::process::Command::new at build.rs:87 build.rs:12

high secret_environment_variable build_script 1

CARGO_REGISTRIES_THRUPUT_INDEX build.rs:635

high shell_command build_script 1

curl not found or failed to execute: {e} build/download.rs:85

medium process_spawn build_script 10

std::process::Command::new build.rs:87 build.rs:520 build.rs:533 build.rs:563 build.rs:586 build.rs:624 build.rs:659 build.rs:860 build.rs:896 build/download.rs:34

low foreign_functions library 29

low url_literal build_script 3

https://github.com/thruputchain/hogd.git build.rs:12
sparse+https://crates.thruput.network/api/v1/crates/ build.rs:636
https://groundhog-public-release-artifacts-017820684264.s3.us-west-2.amazonaws.com/test-ffi/test-ffi-v{version}/{archive_name} build.rs:828

low build_script build_script 1

build.rs build.rs

info native_link build_script 1

links = "thruput_test_ffi" Cargo.toml

info unsafe_code library 1

2 unsafe blocks, functions or impls src/impls.rs:80

Run: check

failed

Ended: agent reported the end
Guest: exit code 101
Run time: 10.5 s
VM restore: 65 ms
Payload: 4225 files, 115.4 MiB
Files opened: 2659

Processes 54

Siblings that ran the same program with the same result and the same processes below are folded into one row, with their number. Hide the 47 compiler processes (rustc, C toolchain)

Process	Arguments	Start	Took	Exit
cargo /usr/local/bin/cargo	check --locked --offline	5 ms	10.4 s	25856
└rustc /usr/local/bin/rustc ×15	--crate-name typenum --edition=2018 /cw/vendor/typenum-1.20.1/src/lib.rs --error-format=json --json=diagnostic-rendered-ansi,artifacts,future-incompat --crate-type lib --emit=dep-info,metadata,link -C embed-bitcode=no --cfg feature="const-generics" --check-cfg cfg(docsrs,test) --check-cfg cfg(feature, values("const-generics", "i128", "scale-info", "scale_info", "strict")) -C metadata=98665f2e9774125c -C extra-filename=-f1c3ee9134ede149 --out-dir /work/target/debug/deps -L dependency=/work/target/debug/deps --cap-lints allow	145 ms	1.2 s	0
└rustc /usr/local/bin/rustc ×6	--crate-name build_script_build --edition=2021 /cw/vendor/proc-macro2-1.0.107/build.rs --error-format=json --json=diagnostic-rendered-ansi,artifacts,future-incompat --crate-type bin --emit=dep-info,link -C embed-bitcode=no --cfg feature="default" --cfg feature="proc-macro" --check-cfg cfg(docsrs,test) --check-cfg cfg(feature, values("default", "nightly", "proc-macro", "span-locations")) -C metadata=a3dc8fb24392fcd4 -C extra-filename=-a411f7480bd0f42c --out-dir /work/target/debug/build/proc-macro2-a411f7480bd0f42c -L dependency=/work/target/debug/deps --cap-lints allow	1.7 s	291 ms	0
└toolchain /usr/bin/cc	-m64 /work/target/debug/build/proc-macro2-a411f7480bd0f42c/rustcgs9YMT/symbols.o /work/target/debug/build/proc-macro2-a411f7480bd0f42c/build_script_build-a411f7480bd0f42c.build_script_build.dd8d7f624ad1d48e-cgu.0.rcgu.o /work/target/debug/build/proc-macro2-a411f7480bd0f42c/build_script_build-a411f7480bd0f42c.cnca5igddme2fkrf01fktrtaw.rcgu.o -Wl,--as-needed -Wl,-Bstatic /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libstd-64f5f36fb0927694.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libpanic_unwind-549498e8b2e4d924.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libobject-7ff85ea729a864ff.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libmemchr-0e3477fb2664a277.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libaddr2line-09755979c57b7e64.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libgimli-9a1fede77fbbf2f0.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libcfg_if-360da4ba13154744.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/lib	1.9 s	126 ms	0
└toolchain /usr/libexec/gcc/x86_64-linux-gnu/14/collect2	-plugin /usr/libexec/gcc/x86_64-linux-gnu/14/liblto_plugin.so -plugin-opt=/usr/libexec/gcc/x86_64-linux-gnu/14/lto-wrapper -plugin-opt=-fresolution=/tmp/cc5mHyNQ.res --build-id --eh-frame-hdr -m elf_x86_64 --hash-style=gnu --as-needed -dynamic-linker /lib64/ld-linux-x86-64.so.2 -pie -fuse-ld=lld -o /work/target/debug/build/proc-macro2-a411f7480bd0f42c/build_script_build-a411f7480bd0f42c /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/Scrt1.o /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/crti.o /usr/lib/gcc/x86_64-linux-gnu/14/crtbeginS.o -L/work/target/debug/build/proc-macro2-a411f7480bd0f42c/rustcgs9YMT/raw-dylibs -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/bin/gcc-ld -L/usr/lib/gcc/x86_64-linux-gnu/14 -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../../lib -L/lib/x86_64-linux-gnu -L/lib/../lib -L/usr/lib/x86_64-linux-gnu -L	1.9 s	120 ms	0
└toolchain /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/bin/rust-lld	-flavor gnu -plugin /usr/libexec/gcc/x86_64-linux-gnu/14/liblto_plugin.so -plugin-opt=/usr/libexec/gcc/x86_64-linux-gnu/14/lto-wrapper -plugin-opt=-fresolution=/tmp/cc5mHyNQ.res --build-id --eh-frame-hdr -m elf_x86_64 --hash-style=gnu --as-needed -dynamic-linker /lib64/ld-linux-x86-64.so.2 -pie -o /work/target/debug/build/proc-macro2-a411f7480bd0f42c/build_script_build-a411f7480bd0f42c /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/Scrt1.o /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/crti.o /usr/lib/gcc/x86_64-linux-gnu/14/crtbeginS.o -L/work/target/debug/build/proc-macro2-a411f7480bd0f42c/rustcgs9YMT/raw-dylibs -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/bin/gcc-ld -L/usr/lib/gcc/x86_64-linux-gnu/14 -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../../lib -L/lib/x86_64-linux-gnu -L/lib/../lib -L/usr/lib/x86_6	1.9 s	115 ms	0
└build_script proc-macro2		2.0 s	83 ms	0
└rustc /usr/local/bin/rustc ×3	--version	2.0 s	7 ms	0
└rustc /usr/local/bin/rustc	--cfg=procmacro2_build_probe --edition=2021 --crate-name=proc_macro2 --crate-type=lib --cap-lints=allow --emit=dep-info,metadata --out-dir /work/target/debug/build/proc-macro2-4f3f927bd5485a92/out/probe src/probe/proc_macro_span.rs --target x86_64-unknown-linux-gnu	2.0 s	32 ms	256
└build_script quote		2.6 s	10 ms	0
└rustc /usr/local/bin/rustc	--version	2.6 s	8 ms	0
└build_script libc		3.1 s	10 ms	0
└rustc /usr/local/bin/rustc	--version	3.1 s	8 ms	0
└build_script thiserror		8.5 s	32 ms	0
└rustc /usr/local/bin/rustc	--edition=2018 --crate-name=thiserror --crate-type=lib --cap-lints=allow --emit=dep-info,metadata --out-dir /work/target/debug/build/thiserror-8658b25ef1050b90/out/probe build/probe.rs --target x86_64-unknown-linux-gnu	8.5 s	18 ms	256
└rustc /usr/local/bin/rustc	--version	8.5 s	9 ms	0
└build_script thruput-sys		10.3 s	62 ms	256
└other /usr/bin/curl	--fail -L -o /work/target/debug/build/thruput-sys-bf0fe50959b2849f/out/test_ffi_download_cache/test-ffi-v0.42.0/libtest_ffi-linux-x86_64.tar.tmp -w %{http_code} https://groundhog-public-release-artifacts-017820684264.s3.us-west-2.amazonaws.com/test-ffi/test-ffi-v0.42.0/libtest_ffi-linux-x86_64.tar.gz	10.3 s	61 ms	5632

Network 2

The VM has no internet. Every name it looks up resolves to 10.0.2.1, the fake internet, which accepts every connection and records what was sent. Below, it is shown by its port alone, such as :443. The name the build wanted is in the lookups, the HTTP host and the TLS SNI.

Looked up groundhog-public-release-artifacts-017820684264.s3.us-west-2.amazonaws.com

Destination	Protocol	What was sent	Bytes
:443	tls	SNI groundhog-public-release-artifacts-017820684264.s3.us-west-2.amazonaws.com, inside TLS: GET /test-ffi/test-ffi-v0.42.0/libtest_ffi-linux-x86_64.tar.gz, host groundhog-public-release-artifacts-017820684264.s3.us-west-2.amazonaws.com, agent curl/8.14.1	1.6 KiB

Sockets in the trace 3

When	Program	How	Address	Type
10.4 s	/usr/bin/curl	connect	unix:/var/run/nscd/socket	stream
10.4 s	/usr/bin/curl	connect	:53	datagram
10.4 s	/usr/bin/curl	connect	:443	stream

Files 0

Secrets opened

None.

Written outside the build directories

None.

Scratch disk 0

Files: 182
Directories: 61
Size: 86.0 MiB
Compiled units: 30

Nothing outside the build areas.

Output

Standard error

   Compiling typenum v1.20.1
   Compiling hybrid-array v0.4.15
   Compiling proc-macro2 v1.0.107
   Compiling libc v0.2.191
   Compiling unicode-ident v1.0.27
   Compiling quote v1.0.47
   Compiling block-buffer v0.12.1
   Compiling crypto-common v0.2.2
   Compiling digest v0.11.3
   Compiling cfg-if v1.0.5
   Compiling cpufeatures v0.3.1
   Compiling sha2 v0.11.1
   Compiling syn v3.0.9
   Compiling fslock v0.2.1
   Compiling thiserror v2.0.21
   Compiling thruput-sys v0.58.0
   Compiling thiserror-impl v2.0.21
warning: thruput-sys@0.58.0: Downloading Archive from: https://groundhog-public-release-artifacts-017820684264.s3.us-west-2.amazonaws.com/test-ffi/test-ffi-v0.42.0/libtest_ffi-linux-x86_64.tar.gz
error: failed to run custom build command for `thruput-sys v0.58.0`

Caused by:
  process didn't exit successfully: `/work/target/debug/build/thruput-sys-7ccf3667e5683275/build-script-build` (exit status: 1)
  --- stdout
  cargo:rerun-if-env-changed=HOGD_FFI_BUILD
  cargo:rerun-if-env-changed=HOGD_FFI_LIB_DIR
  cargo:rerun-if-env-changed=HOGD_SRC
  cargo:rerun-if-env-changed=NATIVE_EXEC_ALWAYS_CONFIGURE
  cargo:rerun-if-env-changed=DOCS_RS
  cargo:rustc-check-cfg=cfg(thruput_sys_docs_rs_archive)
  cargo:warning=Downloading Archive from: https://groundhog-public-release-artifacts-017820684264.s3.us-west-2.amazonaws.com/test-ffi/test-ffi-v0.42.0/libtest_ffi-linux-x86_64.tar.gz

  --- stderr
    % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                   Dload  Upload   Total   Spent    Left  Speed
  
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
  curl: (22) The requested URL returned error: 404
  error: Archive download failed: the server returned HTTP 404; not retrying
    file:    libtest_ffi-linux-x86_64.tar.gz
    version: test-ffi v0.42.0
    url:     https://groundhog-public-release-artifacts-017820684264.s3.us-west-2.amazonaws.com/test-ffi/test-ffi-v0.42.0/libtest_ffi-linux-x86_64.tar.gz
  To build without downloading, set one of:
    HOGD_FFI_LIB_DIR=<dir> : use libtest_ffi and bindings.rs from <dir>
    HOGD_FFI_BUILD=1       : build from source (requires `--features source-build`)

Timeline

When	From	To	Event	Worker
2026-10-28 01:14 UTC	Discovered	Fetched	fetched	fetcher-12688
2026-10-28 01:14 UTC	Fetched	ReadyForSandbox	static_analysis_completed	static-12726
2026-10-28 01:14 UTC	ReadyForSandbox	Running	sandbox_started	orchestrator-12760-slot1
2026-10-28 01:15 UTC	Running	DynamicallyAnalyzed	sandbox_completed	orchestrator-12760-slot1
2026-10-28 01:15 UTC	DynamicallyAnalyzed	Scored	scored	analyzer-12816
2026-10-28 01:15 UTC	Scored	Done	finalized	analyzer-12816