barretenberg-rs 6.0.0-rc.2

Done dynamic on Linux job 34751 crates.io SBOM Findings (VEX)

The build looked up github.com.

medium

Automated verdict. Nobody reviewed it. A score is a reason to look closer, not a finding.

Evidence

Points	Signal	Where	What
10	network_lookup network · barretenberg-rs	github.com	The build looked up github.com.
10	static:downloader_pattern static · barretenberg-rs	build.rs:88	high severity downloader_pattern in build_script code: https://github.com/AztecProtocol/barretenberg/releases/download/v{}/barretenberg-static-{}.tar.gz at build.rs:88 with std::process::Command::new at build.rs:97
10	static:process_spawn static · barretenberg-rs	build.rs:97	medium severity process_spawn in build_script code (3 places): std::process::Command::new
5	exec_downloader trace · barretenberg-rs	/usr/bin/curl	The build ran /usr/bin/curl.
5	new_behavior diff · barretenberg-rs	exec:downloader	New since the previous version: exec:downloader.
5	new_behavior diff · barretenberg-rs	net:github.com	New since the previous version: net:github.com.
1	static:build_script static · barretenberg-rs	build.rs	low severity build_script in build_script code: build.rs
1	static:url_literal static · barretenberg-rs	build.rs:88	low severity url_literal in build_script code: https://github.com/AztecProtocol/barretenberg/releases/download/v{}/barretenberg-static-{}.tar.gz

Behavior

New since the previous version

exec:downloader net:github.com

Profile

exec:downloader net:github.com static:downloader_pattern static:process_spawn

Static findings

high downloader_pattern build_script 1

https://github.com/AztecProtocol/barretenberg/releases/download/v{}/barretenberg-static-{}.tar.gz at build.rs:88 with std::process::Command::new at build.rs:97 build.rs:88

medium process_spawn build_script 2

std::process::Command::new build.rs:97 build.rs:112

low build_script build_script 1

build.rs build.rs

low foreign_functions library 1

extern block src/backends/ffi.rs:33

low process_spawn library 1

std::process::Command::new src/backends/pipe.rs:27

low url_literal build_script 1

https://github.com/AztecProtocol/barretenberg/releases/download/v{}/barretenberg-static-{}.tar.gz build.rs:88

info unsafe_code library 1

4 unsafe blocks, functions or impls src/backends/ffi.rs:83

Run: check

failed

Ended: agent reported the end
Guest: exit code 101
Run time: 10.8 s
VM restore: 66 ms
Payload: 2718 files, 48.0 MiB
Files opened: 3154

Processes 56

Siblings that ran the same program with the same result and the same processes below are folded into one row, with their number. Hide the 48 compiler processes (rustc, C toolchain)

Process	Arguments	Start	Took	Exit
cargo /usr/local/bin/cargo	check --locked --offline	5 ms	10.8 s	25856
└rustc /usr/local/bin/rustc ×7	--crate-name build_script_build --edition=2021 /cw/vendor/libc-0.2.189/build.rs --error-format=json --json=diagnostic-rendered-ansi,artifacts,future-incompat --crate-type bin --emit=dep-info,link -C embed-bitcode=no --allow=unused_qualifications --warn=clippy::unnecessary_semicolon --allow=clippy::unnecessary_cast --warn=clippy::ptr_as_ptr --allow=clippy::non_minimal_cfg --allow=clippy::missing_safety_doc --warn=clippy::map_unwrap_or --warn=clippy::manual_assert --allow=clippy::identity_op --warn=clippy::explicit_iter_loop --cfg feature="default" --cfg feature="extra_traits" --cfg feature="std" --check-cfg cfg(docsrs,test) --check-cfg cfg(feature, values("align", "const-extern-fn", "default", "extra_traits", "rustc-dep-of-std", "rustc-std-workspace-core", "std", "use_std"))	195 ms	758 ms	0
└toolchain /usr/bin/cc	-m64 /work/target/debug/build/libc-28727978777c70d4/rustcaZTLYV/symbols.o /work/target/debug/build/libc-28727978777c70d4/build_script_build-28727978777c70d4.build_script_build.2bff53463a6a3b56-cgu.0.rcgu.o /work/target/debug/build/libc-28727978777c70d4/build_script_build-28727978777c70d4.build_script_build.2bff53463a6a3b56-cgu.1.rcgu.o /work/target/debug/build/libc-28727978777c70d4/build_script_build-28727978777c70d4.d1u7b9cpsbeibmn73npgk8asb.rcgu.o -Wl,--as-needed -Wl,-Bstatic /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libstd-64f5f36fb0927694.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libpanic_unwind-549498e8b2e4d924.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libobject-7ff85ea729a864ff.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libmemchr-0e3477fb2664a277.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libaddr2line-09755979c57b7e64.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libgimli-9a1fede77fbbf2f0.rlib /usr/local/lib/rustlib/x86_6	802 ms	147 ms	0
└toolchain /usr/libexec/gcc/x86_64-linux-gnu/14/collect2	-plugin /usr/libexec/gcc/x86_64-linux-gnu/14/liblto_plugin.so -plugin-opt=/usr/libexec/gcc/x86_64-linux-gnu/14/lto-wrapper -plugin-opt=-fresolution=/tmp/ccwdqoSC.res --build-id --eh-frame-hdr -m elf_x86_64 --hash-style=gnu --as-needed -dynamic-linker /lib64/ld-linux-x86-64.so.2 -pie -fuse-ld=lld -o /work/target/debug/build/libc-28727978777c70d4/build_script_build-28727978777c70d4 /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/Scrt1.o /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/crti.o /usr/lib/gcc/x86_64-linux-gnu/14/crtbeginS.o -L/work/target/debug/build/libc-28727978777c70d4/rustcaZTLYV/raw-dylibs -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/bin/gcc-ld -L/usr/lib/gcc/x86_64-linux-gnu/14 -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../../lib -L/lib/x86_64-linux-gnu -L/lib/../lib -L/usr/lib/x86_64-linux-gnu -L/usr/lib/../li	809 ms	140 ms	0
└toolchain /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/bin/rust-lld	-flavor gnu -plugin /usr/libexec/gcc/x86_64-linux-gnu/14/liblto_plugin.so -plugin-opt=/usr/libexec/gcc/x86_64-linux-gnu/14/lto-wrapper -plugin-opt=-fresolution=/tmp/ccwdqoSC.res --build-id --eh-frame-hdr -m elf_x86_64 --hash-style=gnu --as-needed -dynamic-linker /lib64/ld-linux-x86-64.so.2 -pie -o /work/target/debug/build/libc-28727978777c70d4/build_script_build-28727978777c70d4 /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/Scrt1.o /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/crti.o /usr/lib/gcc/x86_64-linux-gnu/14/crtbeginS.o -L/work/target/debug/build/libc-28727978777c70d4/rustcaZTLYV/raw-dylibs -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/bin/gcc-ld -L/usr/lib/gcc/x86_64-linux-gnu/14 -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../../lib -L/lib/x86_64-linux-gnu -L/lib/../lib -L/usr/lib/x86_64-linux-gnu -L	812 ms	136 ms	0
└build_script libc		957 ms	9 ms	0
└rustc /usr/local/bin/rustc	--version	958 ms	6 ms	0
└unknown		965 ms	0 ms	32512
└rustc /usr/local/bin/rustc ×13	--crate-name libc --edition=2021 /cw/vendor/libc-0.2.189/src/lib.rs --error-format=json --json=diagnostic-rendered-ansi,artifacts,future-incompat --crate-type lib --emit=dep-info,metadata -C embed-bitcode=no -C debuginfo=2 --allow=unused_qualifications --warn=clippy::unnecessary_semicolon --allow=clippy::unnecessary_cast --warn=clippy::ptr_as_ptr --allow=clippy::non_minimal_cfg --allow=clippy::missing_safety_doc --warn=clippy::map_unwrap_or --warn=clippy::manual_assert --allow=clippy::identity_op --warn=clippy::explicit_iter_loop --cfg feature="default" --cfg feature="extra_traits" --cfg feature="std" --check-cfg cfg(docsrs,test)	966 ms	1.1 s	0
└build_script num-traits		2.2 s	47 ms	0
└rustc /usr/local/bin/rustc ×3	--version --verbose	2.2 s	7 ms	0
└build_script memoffset		2.8 s	26 ms	0
└rustc /usr/local/bin/rustc ×2	--version --verbose	2.8 s	7 ms	0
└build_script thiserror		5.6 s	32 ms	0
└rustc /usr/local/bin/rustc	--edition=2018 --crate-name=thiserror --crate-type=lib --cap-lints=allow --emit=dep-info,metadata --out-dir /work/target/debug/build/thiserror-bf0fafdea055103f/out/probe build/probe.rs --target x86_64-unknown-linux-gnu	5.6 s	30 ms	256
└build_script barretenberg-rs		10.7 s	60 ms	25856
└other /usr/bin/curl	-L -f -o /work/target/debug/build/barretenberg-rs-60de93c4cd07fb2f/out/barretenberg-static.tar.gz https://github.com/AztecProtocol/barretenberg/releases/download/v6.0.0-rc.2/barretenberg-static-amd64-linux.tar.gz	10.7 s	59 ms	5632

Network 2

The VM has no internet. Every name it looks up resolves to 10.0.2.1, the fake internet, which accepts every connection and records what was sent. Below, it is shown by its port alone, such as :443. The name the build wanted is in the lookups, the HTTP host and the TLS SNI.

Looked up github.com

Destination	Protocol	What was sent	Bytes
:443	tls	SNI github.com, inside TLS: GET /AztecProtocol/barretenberg/releases/download/v6.0.0-rc.2/barretenberg-static-amd64-linux.tar.gz, host github.com, agent curl/8.14.1	1.5 KiB

Sockets in the trace 3

When	Program	How	Address	Type
10.7 s	/usr/bin/curl	connect	unix:/var/run/nscd/socket	stream
10.7 s	/usr/bin/curl	connect	:53	datagram
10.7 s	/usr/bin/curl	connect	:443	stream

Files 0

Secrets opened

None.

Written outside the build directories

None.

Scratch disk 0

Files: 170
Directories: 66
Size: 123.4 MiB
Compiled units: 15

Nothing outside the build areas.

Output

Standard error

   Compiling libc v0.2.189
   Compiling num-traits v0.2.19
   Compiling memoffset v0.9.1
    Checking parking_lot_core v0.9.12
    Checking rmp v0.8.15
   Compiling serde_derive v1.0.229
    Checking errno v0.3.14
   Compiling thiserror v1.0.69
    Checking signal-hook-registry v1.4.8
    Checking serde v1.0.229
    Checking parking_lot v0.12.5
   Compiling thiserror-impl v1.0.69
    Checking mio v1.2.3
    Checking socket2 v0.6.5
   Compiling barretenberg-rs v6.0.0-rc.2
    Checking nix v0.27.1
    Checking tokio v1.53.1
warning: barretenberg-rs@6.0.0-rc.2: Downloading barretenberg static library from https://github.com/AztecProtocol/barretenberg/releases/download/v6.0.0-rc.2/barretenberg-static-amd64-linux.tar.gz
error: failed to run custom build command for `barretenberg-rs v6.0.0-rc.2`

Caused by:
  process didn't exit successfully: `/work/target/debug/build/barretenberg-rs-6934f1260deb7cff/build-script-build` (exit status: 101)
  --- stdout
  cargo:warning=Downloading barretenberg static library from https://github.com/AztecProtocol/barretenberg/releases/download/v6.0.0-rc.2/barretenberg-static-amd64-linux.tar.gz

  --- stderr
    % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                   Dload  Upload   Total   Spent    Left  Speed
  
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
  curl: (22) The requested URL returned error: 404

  thread 'main' (793) panicked at /cw/vendor/barretenberg-rs-6.0.0-rc.2/build.rs:105:9:
  Failed to download barretenberg static library from https://github.com/AztecProtocol/barretenberg/releases/download/v6.0.0-rc.2/barretenberg-static-amd64-linux.tar.gz. Make sure version v6.0.0-rc.2 exists as a GitHub release.
  note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace

Timeline

When	From	To	Event	Worker
2026-09-29 22:08 UTC	Discovered	Fetched	fetched	fetcher-627152
2026-09-29 22:08 UTC	Fetched	ReadyForSandbox	static_analysis_completed	static-450252
2026-09-29 22:08 UTC	ReadyForSandbox	Running	sandbox_started	orchestrator-639812-slot1
2026-09-29 22:08 UTC	Running	DynamicallyAnalyzed	sandbox_completed	orchestrator-639812-slot1
2026-09-29 22:08 UTC	DynamicallyAnalyzed	Scored	scored	analyzer-523934
2026-09-29 22:08 UTC	Scored	Done	finalized	analyzer-523934