barretenberg-rs 7.0.0-nightly.20260925

Done dynamic on Linux job 403 crates.io SBOM Findings (VEX)

The build looked up github.com.

medium

Automated verdict. Nobody reviewed it. A score is a reason to look closer, not a finding.

Evidence

Points	Signal	Where	What
10	network_lookup network · barretenberg-rs	github.com	The build looked up github.com.
10	static:downloader_pattern static · barretenberg-rs	build.rs:88	high severity downloader_pattern in build_script code: https://github.com/AztecProtocol/barretenberg/releases/download/v{}/barretenberg-static-{}.tar.gz at build.rs:88 with std::process::Command::new at build.rs:97
10	static:process_spawn static · barretenberg-rs	build.rs:97	medium severity process_spawn in build_script code (3 places): std::process::Command::new
5	exec_downloader trace · barretenberg-rs	/usr/bin/curl	The build ran /usr/bin/curl.
5	new_behavior diff · barretenberg-rs	exec:downloader	New since the previous version: exec:downloader.
5	new_behavior diff · barretenberg-rs	net:github.com	New since the previous version: net:github.com.
1	static:build_script static · barretenberg-rs	build.rs	low severity build_script in build_script code: build.rs
1	static:url_literal static · barretenberg-rs	build.rs:88	low severity url_literal in build_script code: https://github.com/AztecProtocol/barretenberg/releases/download/v{}/barretenberg-static-{}.tar.gz

Behavior

New since the previous version

exec:downloader net:github.com

Profile

exec:downloader net:github.com static:downloader_pattern static:process_spawn

Static findings

high downloader_pattern build_script 1

https://github.com/AztecProtocol/barretenberg/releases/download/v{}/barretenberg-static-{}.tar.gz at build.rs:88 with std::process::Command::new at build.rs:97 build.rs:88

medium process_spawn build_script 2

std::process::Command::new build.rs:97 build.rs:112

low build_script build_script 1

build.rs build.rs

low foreign_functions library 1

extern block src/backends/ffi.rs:33

low process_spawn library 1

std::process::Command::new src/backends/pipe.rs:27

low url_literal build_script 1

https://github.com/AztecProtocol/barretenberg/releases/download/v{}/barretenberg-static-{}.tar.gz build.rs:88

info unsafe_code library 1

4 unsafe blocks, functions or impls src/backends/ffi.rs:83

Run: full

failed

The full build covers everything the earlier cargo check run did, so only the full run is shown.

Ended: agent reported the end
Guest: exit code 101
Run time: 8.5 s
VM restore: 58 ms
Payload: 2718 files, 48.0 MiB
Files opened: 2564

Processes 43

Siblings that ran the same program with the same result and the same processes below are folded into one row, with their number. Hide the 38 compiler processes (rustc, C toolchain)

Process	Arguments	Start	Took	Exit
cargo /usr/local/bin/cargo	build --locked --offline	5 ms	8.4 s	25856
└rustc /usr/local/bin/rustc ×21	--crate-name libc --edition=2021 /cw/vendor/libc-0.2.189/src/lib.rs --error-format=json --json=diagnostic-rendered-ansi,artifacts,future-incompat --crate-type lib --emit=dep-info,metadata,link -C embed-bitcode=no -C debuginfo=2 --allow=unused_qualifications --warn=clippy::unnecessary_semicolon --allow=clippy::unnecessary_cast --warn=clippy::ptr_as_ptr --allow=clippy::non_minimal_cfg --allow=clippy::missing_safety_doc --warn=clippy::map_unwrap_or --warn=clippy::manual_assert --allow=clippy::identity_op --warn=clippy::explicit_iter_loop --cfg feature="default" --cfg feature="extra_traits" --cfg feature="std" --check-cfg cfg(docsrs,test)	209 ms	1.6 s	0
└rustc /usr/local/bin/rustc ×3	--crate-name build_script_build --edition=2021 /cw/vendor/num-traits-0.2.19/build.rs --error-format=json --json=diagnostic-rendered-ansi,artifacts,future-incompat --crate-type bin --emit=dep-info,link -C embed-bitcode=no --cfg feature="std" --check-cfg cfg(docsrs,test) --check-cfg cfg(feature, values("default", "i128", "libm", "std")) -C metadata=e0e6319d6ae871e1 -C extra-filename=-8f76fc38ea2a0840 --out-dir /work/target/debug/build/num-traits-8f76fc38ea2a0840 -L dependency=/work/target/debug/deps --extern autocfg=/work/target/debug/deps/libautocfg-bf0361778853b3f7.rlib --cap-lints allow	1.8 s	170 ms	0
└toolchain /usr/bin/cc	-m64 /work/target/debug/build/num-traits-8f76fc38ea2a0840/rustcpApJGl/symbols.o /work/target/debug/build/num-traits-8f76fc38ea2a0840/build_script_build-8f76fc38ea2a0840.build_script_build.dd12522f11e5e573-cgu.0.rcgu.o /work/target/debug/build/num-traits-8f76fc38ea2a0840/build_script_build-8f76fc38ea2a0840.7e27ebitta4wnog029455hz7o.rcgu.o -Wl,--as-needed -Wl,-Bstatic /work/target/debug/deps/libautocfg-bf0361778853b3f7.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libstd-64f5f36fb0927694.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libpanic_unwind-549498e8b2e4d924.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libobject-7ff85ea729a864ff.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libmemchr-0e3477fb2664a277.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libaddr2line-09755979c57b7e64.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libgimli-9a1fede77fbbf2f0.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libcfg_if-360da4ba13154744.rlib /	1.9 s	105 ms	0
└toolchain /usr/libexec/gcc/x86_64-linux-gnu/14/collect2	-plugin /usr/libexec/gcc/x86_64-linux-gnu/14/liblto_plugin.so -plugin-opt=/usr/libexec/gcc/x86_64-linux-gnu/14/lto-wrapper -plugin-opt=-fresolution=/tmp/ccRdY0HJ.res --build-id --eh-frame-hdr -m elf_x86_64 --hash-style=gnu --as-needed -dynamic-linker /lib64/ld-linux-x86-64.so.2 -pie -fuse-ld=lld -o /work/target/debug/build/num-traits-8f76fc38ea2a0840/build_script_build-8f76fc38ea2a0840 /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/Scrt1.o /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/crti.o /usr/lib/gcc/x86_64-linux-gnu/14/crtbeginS.o -L/work/target/debug/build/num-traits-8f76fc38ea2a0840/rustcpApJGl/raw-dylibs -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/bin/gcc-ld -L/usr/lib/gcc/x86_64-linux-gnu/14 -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../../lib -L/lib/x86_64-linux-gnu -L/lib/../lib -L/usr/lib/x86_64-linux-gnu -L/u	1.9 s	100 ms	0
└toolchain /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/bin/rust-lld	-flavor gnu -plugin /usr/libexec/gcc/x86_64-linux-gnu/14/liblto_plugin.so -plugin-opt=/usr/libexec/gcc/x86_64-linux-gnu/14/lto-wrapper -plugin-opt=-fresolution=/tmp/ccRdY0HJ.res --build-id --eh-frame-hdr -m elf_x86_64 --hash-style=gnu --as-needed -dynamic-linker /lib64/ld-linux-x86-64.so.2 -pie -o /work/target/debug/build/num-traits-8f76fc38ea2a0840/build_script_build-8f76fc38ea2a0840 /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/Scrt1.o /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/crti.o /usr/lib/gcc/x86_64-linux-gnu/14/crtbeginS.o -L/work/target/debug/build/num-traits-8f76fc38ea2a0840/rustcpApJGl/raw-dylibs -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/bin/gcc-ld -L/usr/lib/gcc/x86_64-linux-gnu/14 -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../../lib -L/lib/x86_64-linux-gnu -L/lib/../lib -L/usr/lib/x86_64-	1.9 s	96 ms	0
└build_script num-traits		2.0 s	51 ms	0
└rustc /usr/local/bin/rustc ×3	--version --verbose	2.0 s	8 ms	0
└build_script memoffset		3.1 s	25 ms	0
└rustc /usr/local/bin/rustc ×2	--version --verbose	3.1 s	7 ms	0
└build_script barretenberg-rs		8.4 s	64 ms	25856
└other /usr/bin/curl	-L -f -o /work/target/debug/build/barretenberg-rs-c4178a148e230fd1/out/barretenberg-static.tar.gz https://github.com/AztecProtocol/barretenberg/releases/download/v7.0.0-nightly.20260925/barretenberg-static-amd64-linux.tar.gz	8.4 s	63 ms	5632

Network 2

The VM has no internet. Every name it looks up resolves to 10.0.2.1, the fake internet, which accepts every connection and records what was sent. Below, it is shown by its port alone, such as :443. The name the build wanted is in the lookups, the HTTP host and the TLS SNI.

Looked up github.com

Destination	Protocol	What was sent	Bytes
:443	tls	SNI github.com, inside TLS: GET /AztecProtocol/barretenberg/releases/download/v7.0.0-nightly.20260925/barretenberg-static-amd64-linux.tar.gz, host github.com, agent curl/8.14.1	1.5 KiB

Sockets in the trace 3

When	Program	How	Address	Type
8.4 s	/usr/bin/curl	connect	unix:/var/run/nscd/socket	stream
8.4 s	/usr/bin/curl	connect	:53	datagram
8.4 s	/usr/bin/curl	connect	:443	stream

Files 0

Secrets opened

None.

Written outside the build directories

None.

Scratch disk 0

Files: 206
Directories: 68
Size: 131.2 MiB
Compiled units: 42

Nothing outside the build areas.

Output

Standard error

   Compiling libc v0.2.189
   Compiling num-traits v0.2.19
   Compiling cfg-if v1.0.5
   Compiling memoffset v0.9.1
   Compiling smallvec v1.16.2
   Compiling scopeguard v1.2.0
   Compiling lock_api v0.4.14
   Compiling parking_lot_core v0.9.12
   Compiling rmp v0.8.15
   Compiling serde_core v1.0.229
   Compiling errno v0.3.14
   Compiling once_cell v1.21.4
   Compiling pin-project-lite v0.2.17
   Compiling tracing-core v0.1.36
   Compiling signal-hook-registry v1.4.8
   Compiling serde v1.0.229
   Compiling parking_lot v0.12.5
   Compiling socket2 v0.6.5
   Compiling mio v1.2.3
   Compiling bytes v1.12.1
   Compiling bitflags v2.13.2
   Compiling barretenberg-rs v7.0.0-nightly.20260925
warning: barretenberg-rs@7.0.0-nightly.20260925: Downloading barretenberg static library from https://github.com/AztecProtocol/barretenberg/releases/download/v7.0.0-nightly.20260925/barretenberg-static-amd64-linux.tar.gz
error: failed to run custom build command for `barretenberg-rs v7.0.0-nightly.20260925`

Caused by:
  process didn't exit successfully: `/work/target/debug/build/barretenberg-rs-1ffdf5f16d7461b4/build-script-build` (exit status: 101)
  --- stdout
  cargo:warning=Downloading barretenberg static library from https://github.com/AztecProtocol/barretenberg/releases/download/v7.0.0-nightly.20260925/barretenberg-static-amd64-linux.tar.gz

  --- stderr
    % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                   Dload  Upload   Total   Spent    Left  Speed
  
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
  curl: (22) The requested URL returned error: 404

  thread 'main' (820) panicked at /cw/vendor/barretenberg-rs-7.0.0-nightly.20260925/build.rs:105:9:
  Failed to download barretenberg static library from https://github.com/AztecProtocol/barretenberg/releases/download/v7.0.0-nightly.20260925/barretenberg-static-amd64-linux.tar.gz. Make sure version v7.0.0-nightly.20260925 exists as a GitHub release.
  note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace

Timeline

When	From	To	Event	Worker
2026-09-25 11:42 UTC	Discovered	Fetched	fetched	fetcher-318571
2026-09-25 11:42 UTC	Fetched	ReadyForSandbox	static_analysis_completed	static-318573
2026-09-25 12:01 UTC	ReadyForSandbox	Running	sandbox_started	orchestrator-347367-slot0
2026-09-25 12:01 UTC	Running	DynamicallyAnalyzed	sandbox_completed	orchestrator-347367-slot0
2026-09-25 14:15 UTC	ReadyForSandbox	Running	sandbox_started	orchestrator-372394-slot2
2026-09-25 14:16 UTC	Running	DynamicallyAnalyzed	sandbox_completed	orchestrator-372394-slot2
2026-09-25 16:34 UTC	DynamicallyAnalyzed	ReadyForSandbox	scored	analyzer-414217
2026-09-25 17:25 UTC	ReadyForSandbox	Running	sandbox_started	orchestrator-418420-slot0
2026-09-25 17:26 UTC	Running	DynamicallyAnalyzed	sandbox_completed	orchestrator-418420-slot0
2026-09-25 17:26 UTC	DynamicallyAnalyzed	Scored	scored	analyzer-416522
2026-09-25 17:26 UTC	Scored	Done	finalized	analyzer-416522