barretenberg-rs 5.3.0-nightly.20260930

Done dynamic on Linux job 36704 crates.io SBOM Findings (VEX)

The build looked up github.com.

medium

False positive. A person reviewed this verdict and found the crate benign. The evidence below is what the analysis saw.

Evidence

Points	Signal	Where	What
10	network_lookup network · barretenberg-rs	github.com	The build looked up github.com.
10	static:downloader_pattern static · barretenberg-rs	build.rs:88	high severity downloader_pattern in build_script code: https://github.com/AztecProtocol/barretenberg/releases/download/v{}/barretenberg-static-{}.tar.gz at build.rs:88 with std::process::Command::new at build.rs:97
10	static:process_spawn static · barretenberg-rs	build.rs:97	medium severity process_spawn in build_script code (3 places): std::process::Command::new
5	exec_downloader trace · barretenberg-rs	/usr/bin/curl	The build ran /usr/bin/curl.
5	new_behavior diff · barretenberg-rs	exec:downloader	New since the previous version: exec:downloader.
5	new_behavior diff · barretenberg-rs	net:github.com	New since the previous version: net:github.com.
1	static:build_script static · barretenberg-rs	build.rs	low severity build_script in build_script code: build.rs
1	static:url_literal static · barretenberg-rs	build.rs:88	low severity url_literal in build_script code: https://github.com/AztecProtocol/barretenberg/releases/download/v{}/barretenberg-static-{}.tar.gz

Behavior

New since the previous version

exec:downloader net:github.com

Profile

exec:downloader net:github.com static:downloader_pattern static:process_spawn

Static findings

high downloader_pattern build_script 1

https://github.com/AztecProtocol/barretenberg/releases/download/v{}/barretenberg-static-{}.tar.gz at build.rs:88 with std::process::Command::new at build.rs:97 build.rs:88

medium process_spawn build_script 2

std::process::Command::new build.rs:97 build.rs:112

low build_script build_script 1

build.rs build.rs

low foreign_functions library 1

extern block src/backends/ffi.rs:33

low process_spawn library 1

std::process::Command::new src/backends/pipe.rs:27

low url_literal build_script 1

https://github.com/AztecProtocol/barretenberg/releases/download/v{}/barretenberg-static-{}.tar.gz build.rs:88

info unsafe_code library 1

4 unsafe blocks, functions or impls src/backends/ffi.rs:83

Run: full

failed

The full build covers everything the earlier cargo check run did, so only the full run is shown.

Ended: agent reported the end
Guest: exit code 101
Run time: 16.3 s
VM restore: 89 ms
Payload: 2718 files, 48.0 MiB
Files opened: 3971

Processes 66

Siblings that ran the same program with the same result and the same processes below are folded into one row, with their number. Hide the 58 compiler processes (rustc, C toolchain)

Process	Arguments	Start	Took	Exit
cargo /usr/local/bin/cargo	build --locked --offline	8 ms	16.1 s	25856
└rustc /usr/local/bin/rustc ×7	--crate-name build_script_build --edition=2021 /cw/vendor/libc-0.2.189/build.rs --error-format=json --json=diagnostic-rendered-ansi,artifacts,future-incompat --crate-type bin --emit=dep-info,link -C embed-bitcode=no --allow=unused_qualifications --warn=clippy::unnecessary_semicolon --allow=clippy::unnecessary_cast --warn=clippy::ptr_as_ptr --allow=clippy::non_minimal_cfg --allow=clippy::missing_safety_doc --warn=clippy::map_unwrap_or --warn=clippy::manual_assert --allow=clippy::identity_op --warn=clippy::explicit_iter_loop --cfg feature="default" --cfg feature="extra_traits" --cfg feature="std" --check-cfg cfg(docsrs,test) --check-cfg cfg(feature, values("align", "const-extern-fn", "default", "extra_traits", "rustc-dep-of-std", "rustc-std-workspace-core", "std", "use_std"))	206 ms	742 ms	0
└toolchain /usr/bin/cc	-m64 /work/target/debug/build/libc-28727978777c70d4/rustcm0A4Xq/symbols.o /work/target/debug/build/libc-28727978777c70d4/build_script_build-28727978777c70d4.build_script_build.2bff53463a6a3b56-cgu.0.rcgu.o /work/target/debug/build/libc-28727978777c70d4/build_script_build-28727978777c70d4.build_script_build.2bff53463a6a3b56-cgu.1.rcgu.o /work/target/debug/build/libc-28727978777c70d4/build_script_build-28727978777c70d4.d1u7b9cpsbeibmn73npgk8asb.rcgu.o -Wl,--as-needed -Wl,-Bstatic /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libstd-64f5f36fb0927694.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libpanic_unwind-549498e8b2e4d924.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libobject-7ff85ea729a864ff.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libmemchr-0e3477fb2664a277.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libaddr2line-09755979c57b7e64.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libgimli-9a1fede77fbbf2f0.rlib /usr/local/lib/rustlib/x86_6	782 ms	163 ms	0
└toolchain /usr/libexec/gcc/x86_64-linux-gnu/14/collect2	-plugin /usr/libexec/gcc/x86_64-linux-gnu/14/liblto_plugin.so -plugin-opt=/usr/libexec/gcc/x86_64-linux-gnu/14/lto-wrapper -plugin-opt=-fresolution=/tmp/cc23DZ3m.res --build-id --eh-frame-hdr -m elf_x86_64 --hash-style=gnu --as-needed -dynamic-linker /lib64/ld-linux-x86-64.so.2 -pie -fuse-ld=lld -o /work/target/debug/build/libc-28727978777c70d4/build_script_build-28727978777c70d4 /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/Scrt1.o /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/crti.o /usr/lib/gcc/x86_64-linux-gnu/14/crtbeginS.o -L/work/target/debug/build/libc-28727978777c70d4/rustcm0A4Xq/raw-dylibs -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/bin/gcc-ld -L/usr/lib/gcc/x86_64-linux-gnu/14 -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../../lib -L/lib/x86_64-linux-gnu -L/lib/../lib -L/usr/lib/x86_64-linux-gnu -L/usr/lib/../li	789 ms	156 ms	0
└toolchain /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/bin/rust-lld	-flavor gnu -plugin /usr/libexec/gcc/x86_64-linux-gnu/14/liblto_plugin.so -plugin-opt=/usr/libexec/gcc/x86_64-linux-gnu/14/lto-wrapper -plugin-opt=-fresolution=/tmp/cc23DZ3m.res --build-id --eh-frame-hdr -m elf_x86_64 --hash-style=gnu --as-needed -dynamic-linker /lib64/ld-linux-x86-64.so.2 -pie -o /work/target/debug/build/libc-28727978777c70d4/build_script_build-28727978777c70d4 /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/Scrt1.o /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/crti.o /usr/lib/gcc/x86_64-linux-gnu/14/crtbeginS.o -L/work/target/debug/build/libc-28727978777c70d4/rustcm0A4Xq/raw-dylibs -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/bin/gcc-ld -L/usr/lib/gcc/x86_64-linux-gnu/14 -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../../lib -L/lib/x86_64-linux-gnu -L/lib/../lib -L/usr/lib/x86_64-linux-gnu -L	791 ms	153 ms	0
└build_script libc		952 ms	8 ms	0
└rustc /usr/local/bin/rustc	--version	953 ms	6 ms	0
└unknown		960 ms	0 ms	32512
└rustc /usr/local/bin/rustc ×23	--crate-name libc --edition=2021 /cw/vendor/libc-0.2.189/src/lib.rs --error-format=json --json=diagnostic-rendered-ansi,artifacts,future-incompat --crate-type lib --emit=dep-info,metadata,link -C embed-bitcode=no -C debuginfo=2 --allow=unused_qualifications --warn=clippy::unnecessary_semicolon --allow=clippy::unnecessary_cast --warn=clippy::ptr_as_ptr --allow=clippy::non_minimal_cfg --allow=clippy::missing_safety_doc --warn=clippy::map_unwrap_or --warn=clippy::manual_assert --allow=clippy::identity_op --warn=clippy::explicit_iter_loop --cfg feature="default" --cfg feature="extra_traits" --cfg feature="std" --check-cfg cfg(docsrs,test)	961 ms	1.1 s	0
└build_script num-traits		2.1 s	44 ms	0
└rustc /usr/local/bin/rustc ×3	--version --verbose	2.1 s	7 ms	0
└build_script memoffset		3.1 s	22 ms	0
└rustc /usr/local/bin/rustc ×2	--version --verbose	3.1 s	6 ms	0
└build_script thiserror		7.5 s	31 ms	0
└rustc /usr/local/bin/rustc	--edition=2018 --crate-name=thiserror --crate-type=lib --cap-lints=allow --emit=dep-info,metadata --out-dir /work/target/debug/build/thiserror-bf0fafdea055103f/out/probe build/probe.rs --target x86_64-unknown-linux-gnu	7.5 s	28 ms	256
└build_script barretenberg-rs		16.0 s	58 ms	25856
└other /usr/bin/curl	-L -f -o /work/target/debug/build/barretenberg-rs-c4d6404323effea8/out/barretenberg-static.tar.gz https://github.com/AztecProtocol/barretenberg/releases/download/v5.3.0-nightly.20260930/barretenberg-static-amd64-linux.tar.gz	16.0 s	57 ms	5632

Network 2

The VM has no internet. Every name it looks up resolves to 10.0.2.1, the fake internet, which accepts every connection and records what was sent. Below, it is shown by its port alone, such as :443. The name the build wanted is in the lookups, the HTTP host and the TLS SNI.

Looked up github.com

Destination	Protocol	What was sent	Bytes
:443	tls	SNI github.com, inside TLS: GET /AztecProtocol/barretenberg/releases/download/v5.3.0-nightly.20260930/barretenberg-static-amd64-linux.tar.gz, host github.com, agent curl/8.14.1	1.5 KiB

Sockets in the trace 3

When	Program	How	Address	Type
16.1 s	/usr/bin/curl	connect	unix:/var/run/nscd/socket	stream
16.1 s	/usr/bin/curl	connect	:53	datagram
16.1 s	/usr/bin/curl	connect	:443	stream

Files 0

Secrets opened

None.

Written outside the build directories

None.

Scratch disk 0

Files: 254
Directories: 78
Size: 194.9 MiB
Compiled units: 48
Scan: stopped at a limit

Nothing outside the build areas.

Output

Standard error

   Compiling libc v0.2.189
   Compiling num-traits v0.2.19
   Compiling cfg-if v1.0.5
   Compiling memoffset v0.9.1
   Compiling smallvec v1.16.2
   Compiling scopeguard v1.2.0
   Compiling lock_api v0.4.14
   Compiling parking_lot_core v0.9.12
   Compiling rmp v0.8.15
   Compiling serde_core v1.0.229
   Compiling serde_derive v1.0.229
   Compiling errno v0.3.14
   Compiling thiserror v1.0.69
   Compiling pin-project-lite v0.2.17
   Compiling once_cell v1.21.4
   Compiling tracing-core v0.1.36
   Compiling signal-hook-registry v1.4.8
   Compiling serde v1.0.229
   Compiling parking_lot v0.12.5
   Compiling thiserror-impl v1.0.69
   Compiling socket2 v0.6.5
   Compiling mio v1.2.3
   Compiling barretenberg-rs v5.3.0-nightly.20260930
   Compiling bytes v1.12.1
   Compiling bitflags v2.13.2
   Compiling nix v0.27.1
   Compiling tokio v1.53.1
warning: barretenberg-rs@5.3.0-nightly.20260930: Downloading barretenberg static library from https://github.com/AztecProtocol/barretenberg/releases/download/v5.3.0-nightly.20260930/barretenberg-static-amd64-linux.tar.gz
error: failed to run custom build command for `barretenberg-rs v5.3.0-nightly.20260930`

Caused by:
  process didn't exit successfully: `/work/target/debug/build/barretenberg-rs-0c57f543b0afca66/build-script-build` (exit status: 101)
  --- stdout
  cargo:warning=Downloading barretenberg static library from https://github.com/AztecProtocol/barretenberg/releases/download/v5.3.0-nightly.20260930/barretenberg-static-amd64-linux.tar.gz

  --- stderr
    % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                   Dload  Upload   Total   Spent    Left  Speed
  
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
  curl: (22) The requested URL returned error: 404

  thread 'main' (938) panicked at /cw/vendor/barretenberg-rs-5.3.0-nightly.20260930/build.rs:105:9:
  Failed to download barretenberg static library from https://github.com/AztecProtocol/barretenberg/releases/download/v5.3.0-nightly.20260930/barretenberg-static-amd64-linux.tar.gz. Make sure version v5.3.0-nightly.20260930 exists as a GitHub release.
  note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace

Timeline

When	From	To	Event	Worker
2026-09-30 04:22 UTC	Discovered	Fetched	fetched	fetcher-627152
2026-09-30 04:22 UTC	Fetched	ReadyForSandbox	static_analysis_completed	static-450252
2026-09-30 04:22 UTC	ReadyForSandbox	Running	sandbox_started	orchestrator-639812-slot0
2026-09-30 04:22 UTC	Running	DynamicallyAnalyzed	sandbox_completed	orchestrator-639812-slot0
2026-09-30 04:22 UTC	DynamicallyAnalyzed	ReadyForSandbox	scored	analyzer-523934
2026-09-30 04:22 UTC	ReadyForSandbox	Running	sandbox_started	orchestrator-639812-slot1
2026-09-30 04:22 UTC	Running	DynamicallyAnalyzed	sandbox_completed	orchestrator-639812-slot1
2026-09-30 04:22 UTC	DynamicallyAnalyzed	Scored	scored	analyzer-523934
2026-09-30 04:22 UTC	Scored	Done	finalized	analyzer-523934