barretenberg-rs 7.0.0-nightly.20261007

Done dynamic on Linux job 88310 crates.io SBOM Findings (VEX)

The build looked up github.com.

medium

False positive. A person reviewed this verdict and found the crate benign. The evidence below is what the analysis saw.

Evidence

Points	Signal	Where	What
10	network_lookup network · barretenberg-rs	github.com	The build looked up github.com.
10	static:downloader_pattern static · barretenberg-rs	build.rs:88	high severity downloader_pattern in build_script code: https://github.com/AztecProtocol/barretenberg/releases/download/v{}/barretenberg-static-{}.tar.gz at build.rs:88 with std::process::Command::new at build.rs:97
10	static:process_spawn static · barretenberg-rs	build.rs:97	medium severity process_spawn in build_script code (3 places): std::process::Command::new
5	exec_downloader trace · barretenberg-rs	/usr/bin/curl	The build ran /usr/bin/curl.
5	new_behavior diff · barretenberg-rs	exec:downloader	New since the previous version: exec:downloader.
5	new_behavior diff · barretenberg-rs	net:github.com	New since the previous version: net:github.com.
1	static:build_script static · barretenberg-rs	build.rs	low severity build_script in build_script code: build.rs
1	static:url_literal static · barretenberg-rs	build.rs:88	low severity url_literal in build_script code: https://github.com/AztecProtocol/barretenberg/releases/download/v{}/barretenberg-static-{}.tar.gz

Behavior

New since the previous version

exec:downloader net:github.com

Profile

exec:downloader net:github.com static:downloader_pattern static:process_spawn

Static findings

high downloader_pattern build_script 1

https://github.com/AztecProtocol/barretenberg/releases/download/v{}/barretenberg-static-{}.tar.gz at build.rs:88 with std::process::Command::new at build.rs:97 build.rs:88

medium process_spawn build_script 2

std::process::Command::new build.rs:97 build.rs:112

low build_script build_script 1

build.rs build.rs

low foreign_functions library 1

extern block src/backends/ffi.rs:33

low process_spawn library 1

std::process::Command::new src/backends/pipe.rs:27

low url_literal build_script 1

https://github.com/AztecProtocol/barretenberg/releases/download/v{}/barretenberg-static-{}.tar.gz build.rs:88

info unsafe_code library 1

4 unsafe blocks, functions or impls src/backends/ffi.rs:83

Run: full

failed

The full build covers everything the earlier cargo check run did, so only the full run is shown.

Ended: agent reported the end
Guest: exit code 101
Run time: 20.9 s
VM restore: 53 ms
Payload: 2765 files, 48.1 MiB
Files opened: 5664

Processes 110

Siblings that ran the same program with the same result and the same processes below are folded into one row, with their number. Hide the 98 compiler processes (rustc, C toolchain)

Process	Arguments	Start	Took	Exit
cargo /usr/local/bin/cargo	build --locked --offline	5 ms	20.9 s	25856
└rustc /usr/local/bin/rustc ×14	--crate-name build_script_build --edition=2021 /cw/vendor/proc-macro2-1.0.107/build.rs --error-format=json --json=diagnostic-rendered-ansi,artifacts,future-incompat --crate-type bin --emit=dep-info,link -C embed-bitcode=no --cfg feature="default" --cfg feature="proc-macro" --check-cfg cfg(docsrs,test) --check-cfg cfg(feature, values("default", "nightly", "proc-macro", "span-locations")) -C metadata=a3dc8fb24392fcd4 -C extra-filename=-a411f7480bd0f42c --out-dir /work/target/debug/build/proc-macro2-a411f7480bd0f42c -L dependency=/work/target/debug/deps --cap-lints allow	154 ms	704 ms	0
└toolchain /usr/bin/cc	-m64 /work/target/debug/build/proc-macro2-a411f7480bd0f42c/rustcDlCpZh/symbols.o /work/target/debug/build/proc-macro2-a411f7480bd0f42c/build_script_build-a411f7480bd0f42c.build_script_build.dd8d7f624ad1d48e-cgu.0.rcgu.o /work/target/debug/build/proc-macro2-a411f7480bd0f42c/build_script_build-a411f7480bd0f42c.cnca5igddme2fkrf01fktrtaw.rcgu.o -Wl,--as-needed -Wl,-Bstatic /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libstd-64f5f36fb0927694.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libpanic_unwind-549498e8b2e4d924.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libobject-7ff85ea729a864ff.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libmemchr-0e3477fb2664a277.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libaddr2line-09755979c57b7e64.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libgimli-9a1fede77fbbf2f0.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libcfg_if-360da4ba13154744.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/lib	710 ms	145 ms	0
└toolchain /usr/libexec/gcc/x86_64-linux-gnu/14/collect2	-plugin /usr/libexec/gcc/x86_64-linux-gnu/14/liblto_plugin.so -plugin-opt=/usr/libexec/gcc/x86_64-linux-gnu/14/lto-wrapper -plugin-opt=-fresolution=/tmp/cc9fyptK.res --build-id --eh-frame-hdr -m elf_x86_64 --hash-style=gnu --as-needed -dynamic-linker /lib64/ld-linux-x86-64.so.2 -pie -fuse-ld=lld -o /work/target/debug/build/proc-macro2-a411f7480bd0f42c/build_script_build-a411f7480bd0f42c /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/Scrt1.o /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/crti.o /usr/lib/gcc/x86_64-linux-gnu/14/crtbeginS.o -L/work/target/debug/build/proc-macro2-a411f7480bd0f42c/rustcDlCpZh/raw-dylibs -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/bin/gcc-ld -L/usr/lib/gcc/x86_64-linux-gnu/14 -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../../lib -L/lib/x86_64-linux-gnu -L/lib/../lib -L/usr/lib/x86_64-linux-gnu -L	718 ms	136 ms	0
└toolchain /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/bin/rust-lld	-flavor gnu -plugin /usr/libexec/gcc/x86_64-linux-gnu/14/liblto_plugin.so -plugin-opt=/usr/libexec/gcc/x86_64-linux-gnu/14/lto-wrapper -plugin-opt=-fresolution=/tmp/cc9fyptK.res --build-id --eh-frame-hdr -m elf_x86_64 --hash-style=gnu --as-needed -dynamic-linker /lib64/ld-linux-x86-64.so.2 -pie -o /work/target/debug/build/proc-macro2-a411f7480bd0f42c/build_script_build-a411f7480bd0f42c /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/Scrt1.o /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/crti.o /usr/lib/gcc/x86_64-linux-gnu/14/crtbeginS.o -L/work/target/debug/build/proc-macro2-a411f7480bd0f42c/rustcDlCpZh/raw-dylibs -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/bin/gcc-ld -L/usr/lib/gcc/x86_64-linux-gnu/14 -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../../lib -L/lib/x86_64-linux-gnu -L/lib/../lib -L/usr/lib/x86_6	720 ms	133 ms	0
└build_script proc-macro2		862 ms	82 ms	0
└rustc /usr/local/bin/rustc ×3	--version	863 ms	7 ms	0
└rustc /usr/local/bin/rustc	--cfg=procmacro2_build_probe --edition=2021 --crate-name=proc_macro2 --crate-type=lib --cap-lints=allow --emit=dep-info,metadata --out-dir /work/target/debug/build/proc-macro2-4f3f927bd5485a92/out/probe src/probe/proc_macro_span.rs --target x86_64-unknown-linux-gnu	872 ms	33 ms	256
└rustc /usr/local/bin/rustc ×28	--crate-name unicode_ident --edition=2021 /cw/vendor/unicode-ident-1.0.26/src/lib.rs --error-format=json --json=diagnostic-rendered-ansi,artifacts,future-incompat --crate-type lib --emit=dep-info,metadata,link -C embed-bitcode=no --check-cfg cfg(docsrs,test) --check-cfg cfg(feature, values()) -C metadata=f65c548d1bdebf35 -C extra-filename=-76fddff3086055f2 --out-dir /work/target/debug/deps -L dependency=/work/target/debug/deps --cap-lints allow	944 ms	48 ms	0
└build_script quote		1.1 s	9 ms	0
└rustc /usr/local/bin/rustc	--version	1.1 s	7 ms	0
└build_script libc		2.1 s	9 ms	0
└rustc /usr/local/bin/rustc	--version	2.1 s	6 ms	0
└build_script num-traits		5.9 s	42 ms	0
└rustc /usr/local/bin/rustc ×3	--version --verbose	5.9 s	7 ms	0
└build_script serde_core		9.4 s	8 ms	0
└rustc /usr/local/bin/rustc	--version	9.4 s	6 ms	0
└build_script parking_lot_core		9.4 s	1 ms	0
└build_script serde		10.3 s	8 ms	0
└rustc /usr/local/bin/rustc	--version	10.3 s	6 ms	0
└build_script memoffset		10.5 s	23 ms	0
└rustc /usr/local/bin/rustc ×2	--version --verbose	10.5 s	7 ms	0
└build_script thiserror		14.9 s	28 ms	0
└rustc /usr/local/bin/rustc	--edition=2018 --crate-name=thiserror --crate-type=lib --cap-lints=allow --emit=dep-info,metadata --out-dir /work/target/debug/build/thiserror-bf0fafdea055103f/out/probe build/probe.rs --target x86_64-unknown-linux-gnu	14.9 s	24 ms	256
└build_script barretenberg-rs		20.8 s	86 ms	25856
└other /usr/bin/curl	-L -f -o /work/target/debug/build/barretenberg-rs-5b59dd4c39adb344/out/barretenberg-static.tar.gz https://github.com/AztecProtocol/barretenberg/releases/download/v7.0.0-nightly.20261007/barretenberg-static-amd64-linux.tar.gz	20.8 s	84 ms	5632

Network 2

The VM has no internet. Every name it looks up resolves to 10.0.2.1, the fake internet, which accepts every connection and records what was sent. Below, it is shown by its port alone, such as :443. The name the build wanted is in the lookups, the HTTP host and the TLS SNI.

Looked up github.com

Destination	Protocol	What was sent	Bytes
:443	tls	SNI github.com, inside TLS: GET /AztecProtocol/barretenberg/releases/download/v7.0.0-nightly.20261007/barretenberg-static-amd64-linux.tar.gz, host github.com, agent curl/8.14.1	1.5 KiB

Sockets in the trace 3

When	Program	How	Address	Type
20.9 s	/usr/bin/curl	connect	unix:/var/run/nscd/socket	stream
20.9 s	/usr/bin/curl	connect	:53	datagram
20.9 s	/usr/bin/curl	connect	:443	stream

Files 0

Secrets opened

None.

Written outside the build directories

None.

Scratch disk 0

Files: 358
Directories: 106
Size: 202.1 MiB
Compiled units: 60

Nothing outside the build areas.

Output

Standard error

   Compiling proc-macro2 v1.0.107
   Compiling unicode-ident v1.0.26
   Compiling quote v1.0.47
   Compiling autocfg v1.5.1
   Compiling libc v0.2.190
   Compiling num-traits v0.2.19
   Compiling syn v3.0.6
   Compiling syn v2.0.119
   Compiling parking_lot_core v0.9.12
   Compiling cfg-if v1.0.5
   Compiling serde_core v1.0.229
   Compiling memoffset v0.9.1
   Compiling smallvec v1.16.2
   Compiling scopeguard v1.2.0
   Compiling serde v1.0.229
   Compiling lock_api v0.4.14
   Compiling rmp v0.8.15
   Compiling serde_derive v1.0.229
   Compiling errno v0.3.14
   Compiling pin-project-lite v0.2.17
   Compiling once_cell v1.21.4
   Compiling thiserror v1.0.69
   Compiling tracing-core v0.1.36
   Compiling signal-hook-registry v1.4.8
   Compiling parking_lot v0.12.5
   Compiling thiserror-impl v1.0.69
   Compiling tracing-attributes v0.1.31
   Compiling tokio-macros v2.7.2
   Compiling socket2 v0.6.5
   Compiling mio v1.2.4
   Compiling bytes v1.12.1
   Compiling barretenberg-rs v7.0.0-nightly.20261007
   Compiling bitflags v2.13.2
   Compiling nix v0.27.1
warning: barretenberg-rs@7.0.0-nightly.20261007: Downloading barretenberg static library from https://github.com/AztecProtocol/barretenberg/releases/download/v7.0.0-nightly.20261007/barretenberg-static-amd64-linux.tar.gz
error: failed to run custom build command for `barretenberg-rs v7.0.0-nightly.20261007`

Caused by:
  process didn't exit successfully: `/work/target/debug/build/barretenberg-rs-460d76d0e36bf487/build-script-build` (exit status: 101)
  --- stdout
  cargo:warning=Downloading barretenberg static library from https://github.com/AztecProtocol/barretenberg/releases/download/v7.0.0-nightly.20261007/barretenberg-static-amd64-linux.tar.gz

  --- stderr
    % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                   Dload  Upload   Total   Spent    Left  Speed
  
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
  curl: (22) The requested URL returned error: 404

  thread 'main' (1126) panicked at /cw/vendor/barretenberg-rs-7.0.0-nightly.20261007/build.rs:105:9:
  Failed to download barretenberg static library from https://github.com/AztecProtocol/barretenberg/releases/download/v7.0.0-nightly.20261007/barretenberg-static-amd64-linux.tar.gz. Make sure version v7.0.0-nightly.20261007 exists as a GitHub release.
  note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace

Timeline

When	From	To	Event	Worker
2026-10-07 04:38 UTC	Discovered	Fetched	fetched	fetcher-799714
2026-10-07 04:38 UTC	Fetched	ReadyForSandbox	static_analysis_completed	static-799757
2026-10-07 07:12 UTC	ReadyForSandbox	Running	sandbox_started	orchestrator-800051-slot0
2026-10-07 07:12 UTC	Running	DynamicallyAnalyzed	sandbox_completed	orchestrator-800051-slot0
2026-10-07 07:12 UTC	DynamicallyAnalyzed	ReadyForSandbox	scored	analyzer-800083
2026-10-07 07:12 UTC	ReadyForSandbox	Running	sandbox_started	orchestrator-800051-slot0
2026-10-07 07:13 UTC	Running	DynamicallyAnalyzed	sandbox_completed	orchestrator-800051-slot0
2026-10-07 07:13 UTC	DynamicallyAnalyzed	Scored	scored	analyzer-800083
2026-10-07 07:13 UTC	Scored	Done	finalized	analyzer-800083