{"artifacts":[{"built_by":["build"],"declared":true,"digest":"35e7b1f6b3ca5d5727f90de383134a04d09f335c9a195662d3ec77972e1e8ea1","findings":[{"affects":"build","confidence":"witnessed","evidence":{"claims":[{"label":"Sensitive-file read linked to a network connection","process":{"argv":"/home/bb/work/time-sync-0.2.4/target/build/debug/build/time-sync-bdcdb4cd82b77c46/build-script-build","exe":"/home/bb/work/time-sync-0.2.4/target/build/debug/build/time-sync-bdcdb4cd82b77c46/build_script_build-bdcdb4cd82b77c46","pid":2260},"role":"cause","subjects":[{"kind":"file","path":"/home/bb/work/time-sync-0.2.4/.env","role":"source"},{"direction":"out","ip":"3.166.192.53","kind":"connection","node":"n2","port":80,"proto":"tcp","role":"target"}],"text":"Credential store contents linked to this connection through build-time code: /home/bb/work/time-sync-0.2.4/.env","type":"secret.reached_peer","values":{}}],"evidence":["Credential store contents linked to this connection through build-time code: /home/bb/work/time-sync-0.2.4/.env"],"remediation":"Treat the credential as exposed: revoke or rotate it, then remove the build-time code that sent it. The witness chain names the file, the processes that carried its bytes and the destination.","witness":[{"kind":"file","label":"/home/bb/work/time-sync-0.2.4/.env","node":"n1","path":"/home/bb/work/time-sync-0.2.4/.env","role":"source","via":null},{"host":"3.166.192.53","kind":"connection","label":"3.166.192.53:80","node":"n2","path":null,"port":80,"role":"sink","via":{"argv":"/home/bb/work/time-sync-0.2.4/target/build/debug/build/time-sync-bdcdb4cd82b77c46/build-script-build","exe":"/home/bb/work/time-sync-0.2.4/target/build/debug/build/time-sync-bdcdb4cd82b77c46/build_script_build-bdcdb4cd82b77c46","pid":2260}}]},"jobs":[{"actor":{"argv":"/home/bb/work/time-sync-0.2.4/target/build/debug/build/time-sync-bdcdb4cd82b77c46/build-script-build","exe":"/home/bb/work/time-sync-0.2.4/target/build/debug/build/time-sync-bdcdb4cd82b77c46/build_script_build-bdcdb4cd82b77c46","pid":2260},"chain":["systemd","sshd:","sshd-session:","…","cargo","build-script-build"],"graph":{"file":"sha256-35e7b1f6b3ca5d5727f90de383134a04d09f335c9a195662d3ec77972e1e8ea1.json","job":0},"invoked_by":{"argv":"/usr/lib/systemd/systemd","exe":null,"pid":1},"name":"build","step":null,"writer":{"argv":"/home/bb/work/time-sync-0.2.4/target/build/debug/build/time-sync-bdcdb4cd82b77c46/build-script-build","chain":[{"argv":"/usr/lib/systemd/systemd","exe":null,"pid":1},{"argv":"sshd: /usr/sbin/sshd -D [listener] 0 of 10-100 startups","exe":null,"pid":997},{"argv":"sshd-session: bb [priv]","exe":null,"pid":2074},{"argv":"sshd-session: bb@notty","exe":null,"pid":2129},{"argv":"sudo","exe":null,"pid":2130},{"argv":"sh","exe":"/usr/bin/dash","pid":2132},{"argv":"runuser -u bb -- sh -c cd '/home/bb/work/time-sync-0.2.4' && HOME='/home/bb/work' python3 scenario.py --variant build","exe":"/usr/sbin/runuser","pid":2163},{"argv":"sh -c cd '/home/bb/work/time-sync-0.2.4' && HOME='/home/bb/work' python3 scenario.py --variant build","exe":"/usr/bin/dash","pid":2164},{"argv":"python3 scenario.py --variant build","exe":"/usr/bin/python3.14","pid":2165},{"argv":"cargo build --features build-calibration --target-dir /home/bb/work/time-sync-0.2.4/target/build -p time-sync-demo","exe":"/usr/lib/rust-1.93/bin/cargo","pid":2166},{"argv":"/home/bb/work/time-sync-0.2.4/target/build/debug/build/time-sync-bdcdb4cd82b77c46/build-script-build","exe":"/home/bb/work/time-sync-0.2.4/target/build/debug/build/time-sync-bdcdb4cd82b77c46/build_script_build-bdcdb4cd82b77c46","pid":2260}],"exe":"/home/bb/work/time-sync-0.2.4/target/build/debug/build/time-sync-bdcdb4cd82b77c46/build_script_build-bdcdb4cd82b77c46","pid":2260}}],"kind":"detection","rule_title":"Possible credential exposure","severity":"critical","status":null,"subject":{"host":"3.166.192.53","kind":"net","port":80},"suppressed":false,"title":"Credential store contents reached a network peer"},{"affects":"build","confidence":"witnessed","evidence":{"claims":[{"label":"What a build script's fetch became","process":null,"role":"support","subjects":[],"text":"nothing came down that the build kept","type":"fetch.kept","values":{"built":[],"files":0,"ran":[]}},{"label":"Connection outside the process’s allowed destinations","process":{"argv":"/home/bb/work/time-sync-0.2.4/target/build/debug/build/time-sync-bdcdb4cd82b77c46/build-script-build","exe":"/home/bb/work/time-sync-0.2.4/target/build/debug/build/time-sync-bdcdb4cd82b77c46/build_script_build-bdcdb4cd82b77c46","pid":2260},"role":"cause","subjects":[{"direction":"out","ip":"3.166.192.53","kind":"connection","node":"n1","port":80,"proto":"tcp","role":"subject"}],"text":"connection to 3.166.192.53:80, opened by build_script_build-bdcdb4cd82b77c46","type":"egress.unentitled_connection","values":{"entitlement":"none"}},{"label":"Connection opened by a build script or child process","process":null,"role":"support","subjects":[],"text":"the opener is the build script at /home/bb/work/time-sync-0.2.4/target/build/debug/build/time-sync-bdcdb4cd82b77c46/build_script_build-bdcdb4cd82b77c46","type":"buildscript.connected","values":{"build_script":"/home/bb/work/time-sync-0.2.4/target/build/debug/build/time-sync-bdcdb4cd82b77c46/build_script_build-bdcdb4cd82b77c46","crate":"time-sync"}}],"evidence":["nothing came down that the build kept","connection to 3.166.192.53:80, opened by build_script_build-bdcdb4cd82b77c46","the opener is the build script at /home/bb/work/time-sync-0.2.4/target/build/debug/build/time-sync-bdcdb4cd82b77c46/build_script_build-bdcdb4cd82b77c46"],"remediation":"The build script connected to the network while compiling. Nothing it downloaded was compiled, linked or run. Build the crate from what the registry ships, or accept the download after reviewing it.","witness":[]},"jobs":[{"actor":{"argv":"/home/bb/work/time-sync-0.2.4/target/build/debug/build/time-sync-bdcdb4cd82b77c46/build-script-build","exe":"/home/bb/work/time-sync-0.2.4/target/build/debug/build/time-sync-bdcdb4cd82b77c46/build_script_build-bdcdb4cd82b77c46","pid":2260},"chain":["systemd","sshd:","sshd-session:","…","cargo","build-script-build"],"graph":{"file":"sha256-35e7b1f6b3ca5d5727f90de383134a04d09f335c9a195662d3ec77972e1e8ea1.json","job":0},"invoked_by":{"argv":"/usr/lib/systemd/systemd","exe":null,"pid":1},"name":"build","step":null,"writer":{"argv":"/home/bb/work/time-sync-0.2.4/target/build/debug/build/time-sync-bdcdb4cd82b77c46/build-script-build","chain":[{"argv":"/usr/lib/systemd/systemd","exe":null,"pid":1},{"argv":"sshd: /usr/sbin/sshd -D [listener] 0 of 10-100 startups","exe":null,"pid":997},{"argv":"sshd-session: bb [priv]","exe":null,"pid":2074},{"argv":"sshd-session: bb@notty","exe":null,"pid":2129},{"argv":"sudo","exe":null,"pid":2130},{"argv":"sh","exe":"/usr/bin/dash","pid":2132},{"argv":"runuser -u bb -- sh -c cd '/home/bb/work/time-sync-0.2.4' && HOME='/home/bb/work' python3 scenario.py --variant build","exe":"/usr/sbin/runuser","pid":2163},{"argv":"sh -c cd '/home/bb/work/time-sync-0.2.4' && HOME='/home/bb/work' python3 scenario.py --variant build","exe":"/usr/bin/dash","pid":2164},{"argv":"python3 scenario.py --variant build","exe":"/usr/bin/python3.14","pid":2165},{"argv":"cargo build --features build-calibration --target-dir /home/bb/work/time-sync-0.2.4/target/build -p time-sync-demo","exe":"/usr/lib/rust-1.93/bin/cargo","pid":2166},{"argv":"/home/bb/work/time-sync-0.2.4/target/build/debug/build/time-sync-bdcdb4cd82b77c46/build-script-build","exe":"/home/bb/work/time-sync-0.2.4/target/build/debug/build/time-sync-bdcdb4cd82b77c46/build_script_build-bdcdb4cd82b77c46","pid":2260}],"exe":"/home/bb/work/time-sync-0.2.4/target/build/debug/build/time-sync-bdcdb4cd82b77c46/build_script_build-bdcdb4cd82b77c46","pid":2260}}],"kind":"detection","rule_title":"Unexpected network connection","severity":"medium","status":null,"subject":{"kind":"crate","name":"time-sync","version":"0.2.4"},"suppressed":false,"title":"Build script reached 3.166.192.53"}],"graph":{"caption":["Built from time-sync-0.2.4. Nothing it was made from was downloaded during the build.","Build script: time-sync: the finding starts here: Credential store contents reached a network peer.","time-sync-0.2.4: Credential store contents reached a network peer.","3.166.192.53:80: Credential store contents reached a network peer."],"edges":[{"count":1,"from":"s:build-script:time-sync#build-script-build","label":"configured the compile of","rels":["configured"],"tie":"declared","ties":{"declared":1},"to":"s:compile:rust"},{"count":2,"from":"s:build-script:time-sync#build-script-build","label":"sent to","rels":["sent"],"tie":"witnessed","ties":{"witnessed":2},"to":"u:unresolved:3.166.192.53"},{"count":2,"files":{"witnessed":2},"from":"s:compile:rust","label":"wrote","rels":["wrote"],"tie":"witnessed","ties":{"witnessed":2},"to":"t:archive"},{"count":4,"files":{"witnessed":4},"from":"s:compile:rust","label":"wrote","rels":["wrote"],"tie":"witnessed","ties":{"witnessed":4},"to":"t:file"},{"count":9,"files":{"witnessed":9},"from":"s:compile:rust","label":"wrote","rels":["wrote"],"tie":"witnessed","ties":{"witnessed":9},"to":"t:object"},{"count":2,"files":{"witnessed":1},"from":"s:link","label":"named as its output by the command, wrote","rels":["requested","wrote"],"tie":"witnessed","ties":{"declared":1,"witnessed":1},"to":"t:executable"},{"count":2,"files":{"declared":1,"process":1},"from":"t:archive","label":"read into","rels":["fed"],"tie":"declared","ties":{"declared":1,"process":1},"to":"s:compile:rust"},{"count":1,"files":{"declared":1},"from":"t:archive","label":"read into","rels":["fed"],"tie":"declared","ties":{"declared":1},"to":"s:link"},{"count":1,"files":{"witnessed":1},"from":"t:executable","label":"is","rels":["is"],"tie":"witnessed","ties":{"witnessed":1},"to":"a:artifact"},{"count":4,"files":{"process":4},"from":"t:file","label":"read into","rels":["fed"],"tie":"process","ties":{"process":4},"to":"s:compile:rust"},{"count":9,"files":{"declared":9},"from":"t:object","label":"read into","rels":["fed"],"tie":"declared","ties":{"declared":9},"to":"s:link"},{"count":3,"files":{"declared":3},"from":"u:checkout","label":"read into","rels":["fed"],"tie":"declared","ties":{"declared":3},"to":"s:compile:rust"},{"count":1,"files":{"witnessed":1},"from":"u:checkout","label":"the finding's bytes went on to","rels":["witness"],"tie":"witnessed","ties":{"witnessed":1},"to":"u:unresolved:3.166.192.53"},{"count":1,"from":"u:unresolved:3.166.192.53","label":"received from","rels":["received"],"tie":"witnessed","ties":{"witnessed":1},"to":"s:build-script:time-sync#build-script-build"}],"groups":[{"count":1,"findings":["Credential store contents reached a network peer","Build script reached 3.166.192.53"],"flag":"the finding starts here: Credential store contents reached a network peer","id":"s:build-script:time-sync#build-script-build","kind":"stage","label":"Build script: time-sync","lane":"stage","programs":{"build-script-build":1},"rank":1,"stage":"build-script","sub":"build-script-build · 1 run","tone":"flag"},{"count":2,"family":"rust","id":"s:compile:rust","kind":"stage","label":"Compiled (Rust)","lane":"stage","programs":{"rustc":2},"rank":3,"records":{"declared":3,"units":2,"witnessed":3},"stage":"compile","sub":"rustc · 2 runs","tone":"ok"},{"count":2,"id":"s:link","kind":"stage","label":"Linked","lane":"stage","programs":{"collect2":1,"ld":1},"rank":7,"stage":"link","sub":"collect2, ld · 2 runs","tone":"ok"},{"count":2,"id":"t:archive","kind":"type","label":"Archives","lane":"made","rank":5,"sub":"2 archives · 1 stated by the compiler, 1 by name","tone":"ok","type":"archive","typed_by":{"name":1,"producer":1},"versions":2},{"count":1,"id":"t:executable","kind":"type","label":"Programs","lane":"made","rank":8,"sub":"1 program · stated by the linker","tone":"ok","type":"executable","typed_by":{"producer":1},"versions":1},{"count":4,"id":"t:file","kind":"type","label":"Other files","lane":"made","rank":4,"sub":"4 files · 2 .bin, 2 no extension","tone":"ok","type":"file","typed_by":{"untyped":4},"versions":4},{"count":9,"id":"t:object","kind":"type","label":"Object files","lane":"made","rank":6,"sub":"9 objects · named by the command that read them","tone":"ok","type":"object","typed_by":{"consumer":9},"versions":9},{"arrival":"checkout","count":4,"findings":["Credential store contents reached a network peer"],"flag":"Credential store contents reached a network peer","id":"u:checkout","kind":"unit","label":"time-sync-0.2.4","lane":"input","rank":0,"sub":"4 files · from the checkout","tone":"flag","unit":{"kind":"checkout"},"versions":4},{"count":1,"findings":["Credential store contents reached a network peer","Build script reached 3.166.192.53"],"flag":"Credential store contents reached a network peer","host":"3.166.192.53","id":"u:unresolved:3.166.192.53","kind":"host","label":"3.166.192.53:80","lane":"peer","ports":[80],"rank":2,"received":true,"sent":true,"sub":"1 connection during this build · sent and received","tone":"flag","unit":{"kind":"unresolved","name":"3.166.192.53"}},{"artifact_kind":"binary","count":1,"id":"a:artifact","kind":"artifact","label":"time_sync_demo-bcd94760e7a49833","lane":"artifact","rank":9,"state":"retained","sub":"binary · retained","tone":"ok"}],"schema":2,"size":{"disputed":0,"edges":41,"hows":{"window":19},"nodes":26,"ties":{"declared":14,"process":5},"typed_by":{"consumer":9,"name":1,"producer":2,"untyped":4}}},"groups":{"behavior":"flagged","pipeline":"clean","posture":"not checked","supply":"clean"},"kind":"binary","license":{"classes":{},"compatibility":null,"declared_state":"none","inherited":null,"product":null,"restrictive":[],"undetermined":{}},"name":"time_sync_demo","role":"product","shipments":[],"slug":"time-sync-demo","state":"retained","vulnerabilities":[],"witnessed":true,"witnessed_size":{"objects":82,"processes":4}}],"built":true,"checks":[{"description":"Network activity","examined":{"connections":1,"processes":1},"group":"behavior","group_label":"Build behavior","jobs":1,"jobs_unchecked":0,"key":"network-activity","state":"findings"},{"description":"Sensitive data access and transfer","examined":{"flows":589},"group":"behavior","group_label":"Build behavior","jobs":1,"jobs_unchecked":0,"key":"sensitive-data","state":"findings"},{"description":"Cross-process access","examined":{"operations":0,"processes":107},"group":"behavior","group_label":"Build behavior","jobs":1,"jobs_unchecked":0,"key":"process-interaction","state":"clean"},{"description":"Build file changes","examined":{"trees":1},"group":"behavior","group_label":"Build behavior","jobs":1,"jobs_unchecked":0,"key":"tree-integrity","state":"clean"},{"description":"Build script activity","examined":{"scripts":1},"group":"behavior","group_label":"Build behavior","jobs":1,"jobs_unchecked":0,"key":"build-time-code","state":"clean"},{"description":"Data flow analysis","examined":{"objects":143},"group":"behavior","group_label":"Build behavior","jobs":1,"jobs_unchecked":0,"key":"output-provenance","state":"clean"},{"description":"Filesystem writes","examined":{"trees":7,"writes":16},"group":"behavior","group_label":"Build behavior","jobs":1,"jobs_unchecked":0,"key":"filesystem-writes","state":"clean"},{"description":"Context collection","examined":{"processes":107},"group":"behavior","group_label":"Build behavior","jobs":1,"jobs_unchecked":0,"key":"environment","state":"clean"},{"description":"Known vulnerabilities","examined":{"feeds":0,"packages":2},"group":"supply","group_label":"Supply chain","jobs":0,"jobs_unchecked":1,"key":"known-vulnerabilities","state":"not checked"},{"description":"Build-time dependency advisories","examined":{"feeds":0,"scripts":1},"group":"supply","group_label":"Supply chain","jobs":0,"jobs_unchecked":1,"key":"build-time-advisories","state":"not checked"},{"description":"Dependency advisories","examined":{"feeds":0,"packages":2},"group":"supply","group_label":"Supply chain","jobs":0,"jobs_unchecked":1,"key":"dependency-notices","state":"not checked"},{"description":"Declared and observed dependencies","examined":{"lockfiles":1,"packages":2},"group":"supply","group_label":"Supply chain","jobs":1,"jobs_unchecked":0,"key":"declared-dependencies","state":"clean"},{"description":"Dependency and toolchain versions","examined":{"packages":2,"sources":0},"group":"supply","group_label":"Supply chain","jobs":1,"jobs_unchecked":0,"key":"source-pinning","state":"clean"},{"description":"Pipeline coverage","examined":{"captured":1,"jobs":0},"group":"pipeline","group_label":"Pipeline","jobs":1,"jobs_unchecked":0,"key":"pipeline-coverage","state":"clean"}],"counts":{"detections":2,"discrepancies":0,"posture":0,"suppressed":0,"vulnerabilities":0},"coverage":{"captured":1,"declared":0,"missing":[]},"findings":[{"affects":"build","check":"sensitive-data","confidence":"witnessed","evidence":{"claims":[{"label":"Sensitive-file read linked to a network connection","process":{"argv":"/home/bb/work/time-sync-0.2.4/target/build/debug/build/time-sync-bdcdb4cd82b77c46/build-script-build","exe":"/home/bb/work/time-sync-0.2.4/target/build/debug/build/time-sync-bdcdb4cd82b77c46/build_script_build-bdcdb4cd82b77c46","pid":2260},"role":"cause","subjects":[{"kind":"file","path":"/home/bb/work/time-sync-0.2.4/.env","role":"source"},{"direction":"out","ip":"3.166.192.53","kind":"connection","node":"n2","port":80,"proto":"tcp","role":"target"}],"text":"Credential store contents linked to this connection through build-time code: /home/bb/work/time-sync-0.2.4/.env","type":"secret.reached_peer","values":{}}],"evidence":["Credential store contents linked to this connection through build-time code: /home/bb/work/time-sync-0.2.4/.env"],"remediation":"Treat the credential as exposed: revoke or rotate it, then remove the build-time code that sent it. The witness chain names the file, the processes that carried its bytes and the destination.","witness":[{"kind":"file","label":"/home/bb/work/time-sync-0.2.4/.env","node":"n1","path":"/home/bb/work/time-sync-0.2.4/.env","role":"source","via":null},{"host":"3.166.192.53","kind":"connection","label":"3.166.192.53:80","node":"n2","path":null,"port":80,"role":"sink","via":{"argv":"/home/bb/work/time-sync-0.2.4/target/build/debug/build/time-sync-bdcdb4cd82b77c46/build-script-build","exe":"/home/bb/work/time-sync-0.2.4/target/build/debug/build/time-sync-bdcdb4cd82b77c46/build_script_build-bdcdb4cd82b77c46","pid":2260}}]},"jobs":[{"actor":{"argv":"/home/bb/work/time-sync-0.2.4/target/build/debug/build/time-sync-bdcdb4cd82b77c46/build-script-build","exe":"/home/bb/work/time-sync-0.2.4/target/build/debug/build/time-sync-bdcdb4cd82b77c46/build_script_build-bdcdb4cd82b77c46","pid":2260},"chain":["systemd","sshd:","sshd-session:","…","cargo","build-script-build"],"graph":{"file":"sha256-35e7b1f6b3ca5d5727f90de383134a04d09f335c9a195662d3ec77972e1e8ea1.json","job":0},"invoked_by":{"argv":"/usr/lib/systemd/systemd","exe":null,"pid":1},"name":"build","step":null,"writer":{"argv":"/home/bb/work/time-sync-0.2.4/target/build/debug/build/time-sync-bdcdb4cd82b77c46/build-script-build","chain":[{"argv":"/usr/lib/systemd/systemd","exe":null,"pid":1},{"argv":"sshd: /usr/sbin/sshd -D [listener] 0 of 10-100 startups","exe":null,"pid":997},{"argv":"sshd-session: bb [priv]","exe":null,"pid":2074},{"argv":"sshd-session: bb@notty","exe":null,"pid":2129},{"argv":"sudo","exe":null,"pid":2130},{"argv":"sh","exe":"/usr/bin/dash","pid":2132},{"argv":"runuser -u bb -- sh -c cd '/home/bb/work/time-sync-0.2.4' && HOME='/home/bb/work' python3 scenario.py --variant build","exe":"/usr/sbin/runuser","pid":2163},{"argv":"sh -c cd '/home/bb/work/time-sync-0.2.4' && HOME='/home/bb/work' python3 scenario.py --variant build","exe":"/usr/bin/dash","pid":2164},{"argv":"python3 scenario.py --variant build","exe":"/usr/bin/python3.14","pid":2165},{"argv":"cargo build --features build-calibration --target-dir /home/bb/work/time-sync-0.2.4/target/build -p time-sync-demo","exe":"/usr/lib/rust-1.93/bin/cargo","pid":2166},{"argv":"/home/bb/work/time-sync-0.2.4/target/build/debug/build/time-sync-bdcdb4cd82b77c46/build-script-build","exe":"/home/bb/work/time-sync-0.2.4/target/build/debug/build/time-sync-bdcdb4cd82b77c46/build_script_build-bdcdb4cd82b77c46","pid":2260}],"exe":"/home/bb/work/time-sync-0.2.4/target/build/debug/build/time-sync-bdcdb4cd82b77c46/build_script_build-bdcdb4cd82b77c46","pid":2260}}],"kind":"detection","reach":[{"how":"build","name":"time_sync_demo-bcd94760e7a49833"}],"rule_title":"Possible credential exposure","severity":"critical","status":null,"subject":{"host":"3.166.192.53","kind":"net","port":80},"suppressed":false,"title":"Credential store contents reached a network peer"},{"affects":"build","check":"network-activity","confidence":"witnessed","evidence":{"claims":[{"label":"What a build script's fetch became","process":null,"role":"support","subjects":[],"text":"nothing came down that the build kept","type":"fetch.kept","values":{"built":[],"files":0,"ran":[]}},{"label":"Connection outside the process’s allowed destinations","process":{"argv":"/home/bb/work/time-sync-0.2.4/target/build/debug/build/time-sync-bdcdb4cd82b77c46/build-script-build","exe":"/home/bb/work/time-sync-0.2.4/target/build/debug/build/time-sync-bdcdb4cd82b77c46/build_script_build-bdcdb4cd82b77c46","pid":2260},"role":"cause","subjects":[{"direction":"out","ip":"3.166.192.53","kind":"connection","node":"n1","port":80,"proto":"tcp","role":"subject"}],"text":"connection to 3.166.192.53:80, opened by build_script_build-bdcdb4cd82b77c46","type":"egress.unentitled_connection","values":{"entitlement":"none"}},{"label":"Connection opened by a build script or child process","process":null,"role":"support","subjects":[],"text":"the opener is the build script at /home/bb/work/time-sync-0.2.4/target/build/debug/build/time-sync-bdcdb4cd82b77c46/build_script_build-bdcdb4cd82b77c46","type":"buildscript.connected","values":{"build_script":"/home/bb/work/time-sync-0.2.4/target/build/debug/build/time-sync-bdcdb4cd82b77c46/build_script_build-bdcdb4cd82b77c46","crate":"time-sync"}}],"evidence":["nothing came down that the build kept","connection to 3.166.192.53:80, opened by build_script_build-bdcdb4cd82b77c46","the opener is the build script at /home/bb/work/time-sync-0.2.4/target/build/debug/build/time-sync-bdcdb4cd82b77c46/build_script_build-bdcdb4cd82b77c46"],"remediation":"The build script connected to the network while compiling. Nothing it downloaded was compiled, linked or run. Build the crate from what the registry ships, or accept the download after reviewing it.","witness":[]},"jobs":[{"actor":{"argv":"/home/bb/work/time-sync-0.2.4/target/build/debug/build/time-sync-bdcdb4cd82b77c46/build-script-build","exe":"/home/bb/work/time-sync-0.2.4/target/build/debug/build/time-sync-bdcdb4cd82b77c46/build_script_build-bdcdb4cd82b77c46","pid":2260},"chain":["systemd","sshd:","sshd-session:","…","cargo","build-script-build"],"graph":{"file":"sha256-35e7b1f6b3ca5d5727f90de383134a04d09f335c9a195662d3ec77972e1e8ea1.json","job":0},"invoked_by":{"argv":"/usr/lib/systemd/systemd","exe":null,"pid":1},"name":"build","step":null,"writer":{"argv":"/home/bb/work/time-sync-0.2.4/target/build/debug/build/time-sync-bdcdb4cd82b77c46/build-script-build","chain":[{"argv":"/usr/lib/systemd/systemd","exe":null,"pid":1},{"argv":"sshd: /usr/sbin/sshd -D [listener] 0 of 10-100 startups","exe":null,"pid":997},{"argv":"sshd-session: bb [priv]","exe":null,"pid":2074},{"argv":"sshd-session: bb@notty","exe":null,"pid":2129},{"argv":"sudo","exe":null,"pid":2130},{"argv":"sh","exe":"/usr/bin/dash","pid":2132},{"argv":"runuser -u bb -- sh -c cd '/home/bb/work/time-sync-0.2.4' && HOME='/home/bb/work' python3 scenario.py --variant build","exe":"/usr/sbin/runuser","pid":2163},{"argv":"sh -c cd '/home/bb/work/time-sync-0.2.4' && HOME='/home/bb/work' python3 scenario.py --variant build","exe":"/usr/bin/dash","pid":2164},{"argv":"python3 scenario.py --variant build","exe":"/usr/bin/python3.14","pid":2165},{"argv":"cargo build --features build-calibration --target-dir /home/bb/work/time-sync-0.2.4/target/build -p time-sync-demo","exe":"/usr/lib/rust-1.93/bin/cargo","pid":2166},{"argv":"/home/bb/work/time-sync-0.2.4/target/build/debug/build/time-sync-bdcdb4cd82b77c46/build-script-build","exe":"/home/bb/work/time-sync-0.2.4/target/build/debug/build/time-sync-bdcdb4cd82b77c46/build_script_build-bdcdb4cd82b77c46","pid":2260}],"exe":"/home/bb/work/time-sync-0.2.4/target/build/debug/build/time-sync-bdcdb4cd82b77c46/build_script_build-bdcdb4cd82b77c46","pid":2260}}],"kind":"detection","reach":[{"how":"member","name":"time_sync_demo-bcd94760e7a49833"}],"rule_title":"Unexpected network connection","severity":"medium","status":null,"subject":{"kind":"crate","name":"time-sync","version":"0.2.4"},"suppressed":false,"title":"Build script reached 3.166.192.53"}],"generated_at_ms":1792023154232,"groups":{"behavior":"flagged","pipeline":"clean","posture":"not checked","supply":"clean"},"jobs":[{"analyzed":true,"conclusion":"success","job":"build","name":"build","status":"analyzed","verdict":"flagged"}],"network":{"fetches":[],"peers":[{"actors":[{"by":"project","class":"undeclared","component":"time-sync-0.2.4","exe":"build_script_build-bdcdb4cd82b77c46","jobs":["build"],"package":null,"processes":1,"threads":[{"job":"build","name":"build"}],"verdicts":["build-flagged"],"vias":[]}],"asn":null,"class":"undeclared","host":"3.166.192.53","jobs":[{"job":"build","name":"build","status":"flagged"}],"org":null,"port":80,"status":"flagged"}]},"pipeline_id":"time-sync-0.2.4","report":"report.json","repository":"incidents/cargo/time-sync","run":{"analyzed_ts_ms":1792027798682,"branch":"","built":true,"groups":null,"pipeline_id":"time-sync-0.2.4","ref":"refs/tags/0.2.4","revision":"","started_ts_ms":1792027796463,"status":"complete","verdict":"flagged"},"schema":1,"stats":{"analyzed":{"artifacts":1,"compiler_invocations":2,"feeds":0,"lockfiles":1,"packages":5},"checks":{"clean":9,"findings":2,"not_applicable":1,"not_checked":3,"run":15},"observed":{"connections":1,"interactions":3304,"jobs":1,"objects":508,"operations":1755,"processes":107,"wall_s":0}},"status":"open","tarp_version":"0.1.0+gba4904b311dc.dirty","verdict":"flagged"}