{"artifacts":[{"built_by":["build"],"declared":true,"digest":"59b8b0ea7c7aa5e9362c902413eae18ed8ecbb2acbecb23a99ffcbeb8ebf8154","findings":[{"affects":"artifact","confidence":"witnessed","evidence":{"claims":[{"label":"Obfuscated toolchain bypass","process":{"argv":"xz -dc --single-stream","exe":"/usr/bin/xz","pid":9368},"role":"cause","subjects":[{"kind":"file","node":"n8","path":"/home/bb/work/xz-5.6.0/src/liblzma/.libs/liblzma_la-crc64_fast.o","role":"subject"},{"kind":"pipe","node":"n6","role":"source"}],"text":"link input /home/bb/work/xz-5.6.0/src/liblzma/liblzma_la-crc64-fast.o: copied input a pipe: Written by xz from a pipe without a recorded source compilation","type":"object.written_from_pipe","values":{"producer":"xz"}},{"label":"Input written by a non-compiler tool","process":null,"role":"support","subjects":[{"kind":"file","node":"n7","path":"/home/bb/work/xz-5.6.0/src/liblzma/liblzma_la-crc64-fast.o","role":"input"}],"text":"/home/bb/work/xz-5.6.0/src/liblzma/liblzma_la-crc64-fast.o  [dash]","type":"object.shaper_ingredient","values":{"producer":"dash"}}],"evidence":["link input /home/bb/work/xz-5.6.0/src/liblzma/liblzma_la-crc64-fast.o: copied input a pipe: Written by xz from a pipe without a recorded source compilation","/home/bb/work/xz-5.6.0/src/liblzma/liblzma_la-crc64-fast.o  [dash]"],"remediation":"Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.","witness":[{"kind":"file","label":"/home/bb/work/xz-5.6.0/tests/files/good-large_compressed.lzma","node":"n1","path":"/home/bb/work/xz-5.6.0/tests/files/good-large_compressed.lzma","role":"source","via":null},{"kind":"pipe","label":"pipe","node":"n2","path":null,"role":"hop","via":{"argv":"xz -dc ../../tests/files/good-large_compressed.lzma","exe":"/usr/bin/xz","pid":9364}},{"kind":"pipe","label":"pipe","node":"n3","path":null,"role":"hop","via":{"argv":"head -c +2048","exe":"/usr/lib/cargo/bin/coreutils/env","pid":9373}},{"kind":"pipe","label":"pipe","node":"n4","path":null,"role":"hop","via":{"argv":"sed s/\\(.\\)/\\1\\n/g","exe":"/usr/bin/sed","pid":9366}},{"kind":"pipe","label":"pipe","node":"n5","path":null,"role":"hop","via":{"argv":"awk BEGIN{FS=\"\\n\";RS=\"\\n\";ORS=\"\";m=256;for(i=0;i<m;i++){t[sprintf(\"x%c\",i)]=i;c[i]=((i*7)+5)%m;}i=0;j=0;for(l=0;l<4096;l++){i=(i+1)%m;a=c[i];j=(j+a)%m;c[i]=c[j]","exe":"/usr/bin/gawk","pid":9367}},{"kind":"pipe","label":"pipe","node":"n6","path":null,"role":"hop","via":{"argv":"xz -dc --single-stream","exe":"/usr/bin/xz","pid":9368}},{"kind":"file","label":"/home/bb/work/xz-5.6.0/src/liblzma/liblzma_la-crc64-fast.o","node":"n7","path":"/home/bb/work/xz-5.6.0/src/liblzma/liblzma_la-crc64-fast.o","role":"hop","via":{"argv":"head -c +88792","exe":"/usr/lib/cargo/bin/coreutils/env","pid":9369}},{"kind":"file","label":"/home/bb/work/xz-5.6.0/src/liblzma/.libs/liblzma_la-crc64_fast.o","node":"n8","path":"/home/bb/work/xz-5.6.0/src/liblzma/.libs/liblzma_la-crc64_fast.o","role":"subject","via":{"argv":"/usr/bin/ld --eh-frame-hdr -m elf_x86_64 --hash-style=gnu --as-needed -dynamic-linker /lib64/ld-linux-x86-64.so.2 -z relro -o .libs/liblzma_la-crc64_fast.o -r -","exe":"/usr/bin/x86_64-linux-gnu-ld.bfd","pid":9413}}]},"jobs":[{"actor":{"argv":"xz -dc --single-stream","exe":"/usr/bin/xz","pid":9368},"chain":["systemd","sshd:","sshd-session:","…","sh","xz"],"graph":null,"invoked_by":{"argv":"/usr/lib/systemd/systemd","exe":null,"pid":1},"name":"build","step":null,"writer":{"argv":"xz -dc --single-stream","chain":[{"argv":"/usr/lib/systemd/systemd","exe":null,"pid":1},{"argv":"sshd: /usr/sbin/sshd -D [listener] 0 of 10-100 startups","exe":null,"pid":1107},{"argv":"sshd-session: bb [priv]","exe":null,"pid":1737},{"argv":"sshd-session: bb@notty","exe":null,"pid":1814},{"argv":"sudo","exe":null,"pid":1815},{"argv":"sh","exe":"/usr/bin/dash","pid":1817},{"argv":"runuser -u bb -- env RPM_ARCH=x86_64 RPM_OS=linux DEB_HOST_GNU_TYPE=x86_64-linux-gnu DEB_BUILD_GNU_TYPE=x86_64-linux-gnu DEB_HOST_ARCH=amd64 DEB_BUILD_ARCH=amd6…","exe":"/usr/sbin/runuser","pid":1851},{"argv":"env RPM_ARCH=x86_64 RPM_OS=linux DEB_HOST_GNU_TYPE=x86_64-linux-gnu DEB_BUILD_GNU_TYPE=x86_64-linux-gnu DEB_HOST_ARCH=amd64 DEB_BUILD_ARCH=amd64 sh -c cd '/home…","exe":"/usr/lib/cargo/bin/coreutils/env","pid":1852},{"argv":"sh -c cd '/home/bb/work/xz-5.6.0' && ./configure --enable-shared --build=x86_64-pc-linux-gnu >'/mnt/assets/configure.log' 2>&1 && make -j4 >'/mnt/assets/make.lo…","exe":"/usr/bin/dash","pid":1852},{"argv":"make -j4","exe":"/usr/bin/make","pid":5467},{"argv":"/bin/bash -c make  all-recursive","exe":"/usr/bin/bash","pid":5470},{"argv":"make all-recursive","exe":"/usr/bin/make","pid":5470},{"argv":"/bin/bash -c fail=; \\\nif (target_option=k; case ${target_option-} in ?) ;; *) echo \"am__make_running_with_option: internal error: invalid\" \"target option '${tar…","exe":"/usr/bin/bash","pid":5471},{"argv":"make all","exe":"/usr/bin/make","pid":5476},{"argv":"/bin/bash -c fail=; \\\nif (target_option=k; case ${target_option-} in ?) ;; *) echo \"am__make_running_with_option: internal error: invalid\" \"target option '${tar…","exe":"/usr/bin/bash","pid":5477},{"argv":"make all","exe":"/usr/bin/make","pid":5482},{"argv":"/bin/bash -c fail=; \\\nif (target_option=k; case ${target_option-} in ?) ;; *) echo \"am__make_running_with_option: internal error: invalid\" \"target option '${tar…","exe":"/usr/bin/bash","pid":5483},{"argv":"make all-am","exe":"/usr/bin/make","pid":5489},{"argv":"/bin/bash -c echo -n ''; export top_srcdir='../..'; export CC='gcc'; export DEFS='-DHAVE_CONFIG_H'; export DEFAULT_INCLUDES='-I. -I../..'; export INCLUDES=''; e…","exe":"/usr/bin/bash","pid":9304},{"argv":"/bin/bash","exe":"/usr/bin/bash","pid":9308},{"argv":"/bin/sh","exe":"/usr/bin/dash","pid":9313},{"argv":"xz -dc --single-stream","exe":"/usr/bin/xz","pid":9368}],"exe":"/usr/bin/xz","pid":9368}}],"kind":"detection","rule_title":"Object file origin needs review","severity":"critical","status":null,"subject":{"kind":"path","path":"/home/bb/work/xz-5.6.0/src/liblzma/.libs/liblzma_la-crc64_fast.o","producer":"x86_64-linux-gnu-ld.bfd"},"suppressed":false,"title":"Could not verify how this object file was built"}],"graph":{"caption":["Nothing it was made from was downloaded during the build.","Packaged (xz): the finding starts here: Could not verify how this object file was built.","Object files: Could not verify how this object file was built.","Unknown files: Could not verify how this object file was built."],"edges":[{"count":160,"files":{"witnessed":81},"from":"s:compile:c","label":"named as its output by the command, wrote","rels":["requested","wrote"],"tie":"witnessed","ties":{"declared":79,"witnessed":81},"to":"t:object"},{"count":81,"files":{"witnessed":81},"from":"s:compile:c","label":"wrote","rels":["wrote"],"tie":"witnessed","ties":{"witnessed":81},"to":"t:source:asm"},{"count":1,"files":{"witnessed":1},"from":"s:copy","label":"renamed or linked by","rels":["named"],"tie":"witnessed","ties":{"witnessed":1},"to":"t:source:c"},{"count":2,"files":{"witnessed":1},"from":"s:link","label":"named as its output by the command, wrote","rels":["requested","wrote"],"tie":"witnessed","ties":{"declared":1,"witnessed":1},"to":"t:library"},{"count":4,"files":{"witnessed":2},"from":"s:link","label":"named as its output by the command, wrote","rels":["requested","wrote"],"tie":"witnessed","ties":{"declared":2,"witnessed":2},"to":"t:object"},{"count":1,"from":"s:package","label":"piped into","rels":["carried"],"tie":"process","ties":{"process":1},"to":"s:script"},{"count":1,"from":"s:package#xz","label":"piped into","rels":["carried"],"tie":"witnessed","ties":{"witnessed":1},"to":"s:script"},{"count":2,"from":"s:script","label":"piped into","rels":["carried"],"tie":"process","ties":{"process":2},"to":"s:compile:c"},{"count":1,"from":"s:script","label":"piped into","rels":["carried"],"tie":"declared","ties":{"declared":1},"to":"s:package#xz"},{"count":2,"files":{"witnessed":1},"from":"s:script","label":"wrote","rels":["wrote"],"tie":"witnessed","ties":{"witnessed":2},"to":"t:file"},{"count":2,"files":{"witnessed":1},"from":"s:script","label":"wrote","rels":["wrote"],"tie":"witnessed","ties":{"witnessed":2},"to":"t:object"},{"count":2,"files":{"witnessed":1},"from":"s:script","label":"wrote","rels":["wrote"],"tie":"witnessed","ties":{"witnessed":2},"to":"t:source:c"},{"count":1,"files":{"process":1},"from":"t:file","label":"read into","rels":["fed"],"tie":"process","ties":{"process":1},"to":"s:script"},{"count":1,"files":{"witnessed":1},"from":"t:file","label":"revised into","rels":["revises"],"tie":"witnessed","ties":{"witnessed":1},"to":"t:file"},{"count":1,"files":{"witnessed":1},"from":"t:library","label":"is","rels":["is"],"tie":"witnessed","ties":{"witnessed":1},"to":"a:artifact"},{"count":84,"files":{"declared":84},"from":"t:object","label":"read into","rels":["fed"],"tie":"declared","ties":{"declared":84},"to":"s:link"},{"count":1,"files":{"witnessed":1},"from":"t:object","label":"revised into","rels":["revises"],"tie":"witnessed","ties":{"witnessed":1},"to":"t:object"},{"count":81,"files":{"declared":81},"from":"t:source:asm","label":"read into","rels":["fed"],"tie":"declared","ties":{"declared":81},"to":"s:compile:c"},{"count":81,"files":{"process":1},"from":"t:source:c","label":"read into","rels":["fed"],"tie":"process","ties":{"process":81},"to":"s:compile:c"},{"count":1,"files":{"witnessed":1},"from":"t:source:c","label":"revised into","rels":["revises"],"tie":"witnessed","ties":{"witnessed":1},"to":"t:source:c"},{"count":1927,"files":{"declared":77,"process":68},"from":"u:unknown","label":"read into","rels":["fed"],"tie":"declared","ties":{"declared":77,"process":1850},"to":"s:compile:c"},{"count":1,"files":{"process":1},"from":"u:unknown","label":"read into","rels":["fed"],"tie":"process","ties":{"process":1},"to":"s:link"},{"count":1,"files":{"process":1},"from":"u:unknown","label":"read into","rels":["fed"],"tie":"process","ties":{"process":1},"to":"s:package"},{"count":15,"files":{"process":15},"from":"u:unknown","label":"read into","rels":["fed"],"tie":"process","ties":{"process":15},"to":"s:script"},{"count":1,"files":{"witnessed":1},"from":"u:unknown","label":"the finding's bytes went on to","rels":["witness"],"tie":"witnessed","ties":{"witnessed":1},"to":"t:object"}],"groups":[{"count":241,"family":"c","id":"s:compile:c","kind":"stage","label":"Compiled (C/C++)","lane":"stage","programs":{"cc1":81,"gcc":79,"x86_64-linux-gnu-as":81},"rank":5,"shared_with":["sha256:34576faf9573be998553798d05c7510124d72a1f5864bd3a9039307ba2194556","sha256:6efeabe55ddf896eaaf521ffb7ebf98e81612f203fce6b12bf554aa31833f76a","sha256:8ecf7192de93387962afdff985eb81568f4c7a6739a46837bff8c305b192e377"],"stage":"compile","sub":"cc1, x86_64-linux-gnu-as, gcc · 241 runs · also made outputs of 3 other artifacts","tone":"ok"},{"count":1,"id":"s:copy","kind":"stage","label":"Copied","lane":"stage","programs":{"mv":1},"rank":4,"stage":"copy","sub":"mv · 1 run","tone":"ok"},{"count":6,"id":"s:link","kind":"stage","label":"Linked","lane":"stage","programs":{"collect2":3,"ld":3},"rank":10,"shared_with":["sha256:34576faf9573be998553798d05c7510124d72a1f5864bd3a9039307ba2194556","sha256:6efeabe55ddf896eaaf521ffb7ebf98e81612f203fce6b12bf554aa31833f76a","sha256:8ecf7192de93387962afdff985eb81568f4c7a6739a46837bff8c305b192e377"],"stage":"link","sub":"collect2, ld · 6 runs · also made outputs of 3 other artifacts","tone":"ok"},{"count":1,"id":"s:package","kind":"stage","label":"Packaged","lane":"stage","programs":{"xz":1},"rank":8,"stage":"package","sub":"xz · 1 run","tone":"ok"},{"count":1,"findings":["Could not verify how this object file was built"],"flag":"the finding starts here: Could not verify how this object file was built","id":"s:package#xz","kind":"stage","label":"Packaged (xz)","lane":"stage","programs":{"xz":1},"rank":9,"stage":"package","sub":"xz · 1 run","tone":"flag"},{"count":318,"id":"s:script","kind":"stage","label":"Scripts","lane":"stage","programs":{"awk":1,"basename":2,"bash":198,"cat":1,"dirname":17,"expr":1,"gawk":2,"head":2,"hostname":1,"mktemp":1,"sed":90,"sh":1,"tr":1},"rank":1,"shared_with":["sha256:34576faf9573be998553798d05c7510124d72a1f5864bd3a9039307ba2194556","sha256:6efeabe55ddf896eaaf521ffb7ebf98e81612f203fce6b12bf554aa31833f76a","sha256:8ecf7192de93387962afdff985eb81568f4c7a6739a46837bff8c305b192e377"],"stage":"script","sub":"bash, sed, dirname, basename +9 more · 318 runs · also made outputs of 3 other artifacts","tone":"ok"},{"count":1,"id":"t:file","kind":"type","label":"Other files","lane":"made","rank":2,"sub":"1 file, written twice · 2 .awk","tone":"ok","type":"file","typed_by":{"untyped":1},"versions":2},{"count":1,"id":"t:library","kind":"type","label":"Libraries","lane":"made","rank":11,"sub":"1 library · stated by the linker","tone":"ok","type":"library","typed_by":{"producer":1},"versions":1},{"count":84,"findings":["Could not verify how this object file was built"],"flag":"Could not verify how this object file was built","id":"t:object","kind":"type","label":"Object files","lane":"made","rank":7,"sub":"84 objects, 85 versions · 83 stated by the commands that wrote them, 1 named by the command that read them","tone":"flag","type":"object","typed_by":{"consumer":1,"producer":83},"versions":85},{"count":81,"family":"asm","id":"t:source:asm","kind":"type","label":"Assembly sources","lane":"made","rank":6,"sub":"81 source files · stated by the compiler","tone":"ok","type":"source","typed_by":{"producer":81},"versions":81},{"count":1,"family":"c","id":"t:source:c","kind":"type","label":"C/C++ sources","lane":"made","rank":3,"sub":"1 source file, written twice · by name","tone":"ok","type":"source","typed_by":{"name":1},"versions":2},{"arrival":"cached","count":162,"findings":["Could not verify how this object file was built"],"flag":"Could not verify how this object file was built","id":"u:unknown","kind":"unit","label":"Unknown files","lane":"input","rank":0,"sub":"162 files · nothing in the capture says where they came from","tone":"flag","unit":{"kind":"unknown"},"versions":162},{"artifact_kind":"file","count":1,"id":"a:artifact","kind":"artifact","label":"liblzma.so.5.6.0","lane":"artifact","rank":12,"state":"retained","sub":"file · retained","tone":"ok"}],"schema":2,"size":{"disputed":0,"edges":3080,"hows":{"copied":2,"window":2504},"nodes":1216,"ties":{"declared":243,"process":2261,"witnessed":2},"typed_by":{"consumer":1,"name":3,"producer":165,"untyped":2}}},"groups":{"behavior":"flagged","pipeline":"clean","posture":"not checked","supply":"not checked"},"kind":"file","license":null,"name":"liblzma.so.5.6.0","role":"retained","shipments":[],"slug":"liblzma-so-5-6-0","state":"retained","vulnerabilities":[],"witnessed":true,"witnessed_size":{"objects":645,"processes":568}},{"built_by":["build"],"declared":true,"digest":"8ecf7192de93387962afdff985eb81568f4c7a6739a46837bff8c305b192e377","findings":[{"affects":"artifact","confidence":"witnessed","evidence":{"claims":[{"label":"Obfuscated toolchain bypass","process":{"argv":"xz -dc --single-stream","exe":"/usr/bin/xz","pid":9368},"role":"cause","subjects":[{"kind":"file","node":"n8","path":"/home/bb/work/xz-5.6.0/src/liblzma/.libs/liblzma_la-crc64_fast.o","role":"subject"},{"kind":"pipe","node":"n6","role":"source"}],"text":"link input /home/bb/work/xz-5.6.0/src/liblzma/liblzma_la-crc64-fast.o: copied input a pipe: Written by xz from a pipe without a recorded source compilation","type":"object.written_from_pipe","values":{"producer":"xz"}},{"label":"Input written by a non-compiler tool","process":null,"role":"support","subjects":[{"kind":"file","node":"n7","path":"/home/bb/work/xz-5.6.0/src/liblzma/liblzma_la-crc64-fast.o","role":"input"}],"text":"/home/bb/work/xz-5.6.0/src/liblzma/liblzma_la-crc64-fast.o  [dash]","type":"object.shaper_ingredient","values":{"producer":"dash"}}],"evidence":["link input /home/bb/work/xz-5.6.0/src/liblzma/liblzma_la-crc64-fast.o: copied input a pipe: Written by xz from a pipe without a recorded source compilation","/home/bb/work/xz-5.6.0/src/liblzma/liblzma_la-crc64-fast.o  [dash]"],"remediation":"Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.","witness":[{"kind":"file","label":"/home/bb/work/xz-5.6.0/tests/files/good-large_compressed.lzma","node":"n1","path":"/home/bb/work/xz-5.6.0/tests/files/good-large_compressed.lzma","role":"source","via":null},{"kind":"pipe","label":"pipe","node":"n2","path":null,"role":"hop","via":{"argv":"xz -dc ../../tests/files/good-large_compressed.lzma","exe":"/usr/bin/xz","pid":9364}},{"kind":"pipe","label":"pipe","node":"n3","path":null,"role":"hop","via":{"argv":"head -c +2048","exe":"/usr/lib/cargo/bin/coreutils/env","pid":9373}},{"kind":"pipe","label":"pipe","node":"n4","path":null,"role":"hop","via":{"argv":"sed s/\\(.\\)/\\1\\n/g","exe":"/usr/bin/sed","pid":9366}},{"kind":"pipe","label":"pipe","node":"n5","path":null,"role":"hop","via":{"argv":"awk BEGIN{FS=\"\\n\";RS=\"\\n\";ORS=\"\";m=256;for(i=0;i<m;i++){t[sprintf(\"x%c\",i)]=i;c[i]=((i*7)+5)%m;}i=0;j=0;for(l=0;l<4096;l++){i=(i+1)%m;a=c[i];j=(j+a)%m;c[i]=c[j]","exe":"/usr/bin/gawk","pid":9367}},{"kind":"pipe","label":"pipe","node":"n6","path":null,"role":"hop","via":{"argv":"xz -dc --single-stream","exe":"/usr/bin/xz","pid":9368}},{"kind":"file","label":"/home/bb/work/xz-5.6.0/src/liblzma/liblzma_la-crc64-fast.o","node":"n7","path":"/home/bb/work/xz-5.6.0/src/liblzma/liblzma_la-crc64-fast.o","role":"hop","via":{"argv":"head -c +88792","exe":"/usr/lib/cargo/bin/coreutils/env","pid":9369}},{"kind":"file","label":"/home/bb/work/xz-5.6.0/src/liblzma/.libs/liblzma_la-crc64_fast.o","node":"n8","path":"/home/bb/work/xz-5.6.0/src/liblzma/.libs/liblzma_la-crc64_fast.o","role":"subject","via":{"argv":"/usr/bin/ld --eh-frame-hdr -m elf_x86_64 --hash-style=gnu --as-needed -dynamic-linker /lib64/ld-linux-x86-64.so.2 -z relro -o .libs/liblzma_la-crc64_fast.o -r -","exe":"/usr/bin/x86_64-linux-gnu-ld.bfd","pid":9413}}]},"jobs":[{"actor":{"argv":"xz -dc --single-stream","exe":"/usr/bin/xz","pid":9368},"chain":["systemd","sshd:","sshd-session:","…","sh","xz"],"graph":null,"invoked_by":{"argv":"/usr/lib/systemd/systemd","exe":null,"pid":1},"name":"build","step":null,"writer":{"argv":"xz -dc --single-stream","chain":[{"argv":"/usr/lib/systemd/systemd","exe":null,"pid":1},{"argv":"sshd: /usr/sbin/sshd -D [listener] 0 of 10-100 startups","exe":null,"pid":1107},{"argv":"sshd-session: bb [priv]","exe":null,"pid":1737},{"argv":"sshd-session: bb@notty","exe":null,"pid":1814},{"argv":"sudo","exe":null,"pid":1815},{"argv":"sh","exe":"/usr/bin/dash","pid":1817},{"argv":"runuser -u bb -- env RPM_ARCH=x86_64 RPM_OS=linux DEB_HOST_GNU_TYPE=x86_64-linux-gnu DEB_BUILD_GNU_TYPE=x86_64-linux-gnu DEB_HOST_ARCH=amd64 DEB_BUILD_ARCH=amd6…","exe":"/usr/sbin/runuser","pid":1851},{"argv":"env RPM_ARCH=x86_64 RPM_OS=linux DEB_HOST_GNU_TYPE=x86_64-linux-gnu DEB_BUILD_GNU_TYPE=x86_64-linux-gnu DEB_HOST_ARCH=amd64 DEB_BUILD_ARCH=amd64 sh -c cd '/home…","exe":"/usr/lib/cargo/bin/coreutils/env","pid":1852},{"argv":"sh -c cd '/home/bb/work/xz-5.6.0' && ./configure --enable-shared --build=x86_64-pc-linux-gnu >'/mnt/assets/configure.log' 2>&1 && make -j4 >'/mnt/assets/make.lo…","exe":"/usr/bin/dash","pid":1852},{"argv":"make -j4","exe":"/usr/bin/make","pid":5467},{"argv":"/bin/bash -c make  all-recursive","exe":"/usr/bin/bash","pid":5470},{"argv":"make all-recursive","exe":"/usr/bin/make","pid":5470},{"argv":"/bin/bash -c fail=; \\\nif (target_option=k; case ${target_option-} in ?) ;; *) echo \"am__make_running_with_option: internal error: invalid\" \"target option '${tar…","exe":"/usr/bin/bash","pid":5471},{"argv":"make all","exe":"/usr/bin/make","pid":5476},{"argv":"/bin/bash -c fail=; \\\nif (target_option=k; case ${target_option-} in ?) ;; *) echo \"am__make_running_with_option: internal error: invalid\" \"target option '${tar…","exe":"/usr/bin/bash","pid":5477},{"argv":"make all","exe":"/usr/bin/make","pid":5482},{"argv":"/bin/bash -c fail=; \\\nif (target_option=k; case ${target_option-} in ?) ;; *) echo \"am__make_running_with_option: internal error: invalid\" \"target option '${tar…","exe":"/usr/bin/bash","pid":5483},{"argv":"make all-am","exe":"/usr/bin/make","pid":5489},{"argv":"/bin/bash -c echo -n ''; export top_srcdir='../..'; export CC='gcc'; export DEFS='-DHAVE_CONFIG_H'; export DEFAULT_INCLUDES='-I. -I../..'; export INCLUDES=''; e…","exe":"/usr/bin/bash","pid":9304},{"argv":"/bin/bash","exe":"/usr/bin/bash","pid":9308},{"argv":"/bin/sh","exe":"/usr/bin/dash","pid":9313},{"argv":"xz -dc --single-stream","exe":"/usr/bin/xz","pid":9368}],"exe":"/usr/bin/xz","pid":9368}}],"kind":"detection","rule_title":"Object file origin needs review","severity":"critical","status":null,"subject":{"kind":"path","path":"/home/bb/work/xz-5.6.0/src/liblzma/.libs/liblzma_la-crc64_fast.o","producer":"x86_64-linux-gnu-ld.bfd"},"suppressed":false,"title":"Could not verify how this object file was built"}],"graph":{"caption":["Nothing it was made from was downloaded during the build.","Packaged (xz): the finding starts here: Could not verify how this object file was built.","Object files: Could not verify how this object file was built.","Unknown files: Could not verify how this object file was built."],"edges":[{"count":166,"files":{"witnessed":84},"from":"s:compile:c","label":"named as its output by the command, wrote","rels":["requested","wrote"],"tie":"witnessed","ties":{"declared":82,"witnessed":84},"to":"t:object"},{"count":84,"files":{"witnessed":84},"from":"s:compile:c","label":"wrote","rels":["wrote"],"tie":"witnessed","ties":{"witnessed":84},"to":"t:source:asm"},{"count":1,"files":{"witnessed":1},"from":"s:copy","label":"renamed or linked by","rels":["named"],"tie":"witnessed","ties":{"witnessed":1},"to":"t:source:c"},{"count":2,"files":{"witnessed":1},"from":"s:link","label":"named as its output by the command, wrote","rels":["requested","wrote"],"tie":"witnessed","ties":{"declared":1,"witnessed":1},"to":"t:executable"},{"count":2,"files":{"witnessed":1},"from":"s:link","label":"named as its output by the command, wrote","rels":["requested","wrote"],"tie":"witnessed","ties":{"declared":1,"witnessed":1},"to":"t:library"},{"count":4,"files":{"witnessed":2},"from":"s:link","label":"named as its output by the command, wrote","rels":["requested","wrote"],"tie":"witnessed","ties":{"declared":2,"witnessed":2},"to":"t:object"},{"count":1,"from":"s:package","label":"piped into","rels":["carried"],"tie":"process","ties":{"process":1},"to":"s:script"},{"count":1,"from":"s:package#xz","label":"piped into","rels":["carried"],"tie":"witnessed","ties":{"witnessed":1},"to":"s:script"},{"count":2,"from":"s:script","label":"piped into","rels":["carried"],"tie":"process","ties":{"process":2},"to":"s:compile:c"},{"count":1,"from":"s:script","label":"piped into","rels":["carried"],"tie":"declared","ties":{"declared":1},"to":"s:package#xz"},{"count":2,"files":{"witnessed":1},"from":"s:script","label":"wrote","rels":["wrote"],"tie":"witnessed","ties":{"witnessed":2},"to":"t:file"},{"count":2,"files":{"witnessed":1},"from":"s:script","label":"wrote","rels":["wrote"],"tie":"witnessed","ties":{"witnessed":2},"to":"t:object"},{"count":2,"files":{"witnessed":1},"from":"s:script","label":"wrote","rels":["wrote"],"tie":"witnessed","ties":{"witnessed":2},"to":"t:source:c"},{"count":1,"files":{"witnessed":1},"from":"t:executable","label":"is","rels":["is"],"tie":"witnessed","ties":{"witnessed":1},"to":"a:artifact"},{"count":1,"files":{"process":1},"from":"t:file","label":"read into","rels":["fed"],"tie":"process","ties":{"process":1},"to":"s:script"},{"count":1,"files":{"witnessed":1},"from":"t:file","label":"revised into","rels":["revises"],"tie":"witnessed","ties":{"witnessed":1},"to":"t:file"},{"count":1,"files":{"named":1},"from":"t:library","label":"read into","rels":["fed"],"tie":"named","ties":{"named":1},"to":"s:link"},{"count":87,"files":{"declared":87},"from":"t:object","label":"read into","rels":["fed"],"tie":"declared","ties":{"declared":87},"to":"s:link"},{"count":1,"files":{"witnessed":1},"from":"t:object","label":"revised into","rels":["revises"],"tie":"witnessed","ties":{"witnessed":1},"to":"t:object"},{"count":84,"files":{"declared":84},"from":"t:source:asm","label":"read into","rels":["fed"],"tie":"declared","ties":{"declared":84},"to":"s:compile:c"},{"count":84,"files":{"process":1},"from":"t:source:c","label":"read into","rels":["fed"],"tie":"process","ties":{"process":84},"to":"s:compile:c"},{"count":1,"files":{"witnessed":1},"from":"t:source:c","label":"revised into","rels":["revises"],"tie":"witnessed","ties":{"witnessed":1},"to":"t:source:c"},{"count":1961,"files":{"declared":78,"process":73},"from":"u:unknown","label":"read into","rels":["fed"],"tie":"declared","ties":{"declared":78,"process":1883},"to":"s:compile:c"},{"count":1,"files":{"process":1},"from":"u:unknown","label":"read into","rels":["fed"],"tie":"process","ties":{"process":1},"to":"s:link"},{"count":1,"files":{"process":1},"from":"u:unknown","label":"read into","rels":["fed"],"tie":"process","ties":{"process":1},"to":"s:package"},{"count":15,"files":{"process":15},"from":"u:unknown","label":"read into","rels":["fed"],"tie":"process","ties":{"process":15},"to":"s:script"},{"count":1,"files":{"witnessed":1},"from":"u:unknown","label":"the finding's bytes went on to","rels":["witness"],"tie":"witnessed","ties":{"witnessed":1},"to":"t:object"}],"groups":[{"count":250,"family":"c","id":"s:compile:c","kind":"stage","label":"Compiled (C/C++)","lane":"stage","programs":{"cc1":84,"gcc":82,"x86_64-linux-gnu-as":84},"rank":5,"shared_with":["sha256:34576faf9573be998553798d05c7510124d72a1f5864bd3a9039307ba2194556","sha256:59b8b0ea7c7aa5e9362c902413eae18ed8ecbb2acbecb23a99ffcbeb8ebf8154","sha256:6efeabe55ddf896eaaf521ffb7ebf98e81612f203fce6b12bf554aa31833f76a"],"stage":"compile","sub":"cc1, x86_64-linux-gnu-as, gcc · 250 runs · also made outputs of 3 other artifacts","tone":"ok"},{"count":1,"id":"s:copy","kind":"stage","label":"Copied","lane":"stage","programs":{"mv":1},"rank":4,"stage":"copy","sub":"mv · 1 run","tone":"ok"},{"count":8,"id":"s:link","kind":"stage","label":"Linked","lane":"stage","programs":{"collect2":4,"ld":4},"rank":10,"shared_with":["sha256:34576faf9573be998553798d05c7510124d72a1f5864bd3a9039307ba2194556","sha256:59b8b0ea7c7aa5e9362c902413eae18ed8ecbb2acbecb23a99ffcbeb8ebf8154","sha256:6efeabe55ddf896eaaf521ffb7ebf98e81612f203fce6b12bf554aa31833f76a"],"stage":"link","sub":"collect2, ld · 8 runs · also made outputs of 3 other artifacts","tone":"ok"},{"count":1,"id":"s:package","kind":"stage","label":"Packaged","lane":"stage","programs":{"xz":1},"rank":8,"stage":"package","sub":"xz · 1 run","tone":"ok"},{"count":1,"findings":["Could not verify how this object file was built"],"flag":"the finding starts here: Could not verify how this object file was built","id":"s:package#xz","kind":"stage","label":"Packaged (xz)","lane":"stage","programs":{"xz":1},"rank":9,"stage":"package","sub":"xz · 1 run","tone":"flag"},{"count":318,"id":"s:script","kind":"stage","label":"Scripts","lane":"stage","programs":{"awk":1,"basename":2,"bash":198,"cat":1,"dirname":17,"expr":1,"gawk":2,"head":2,"hostname":1,"mktemp":1,"sed":90,"sh":1,"tr":1},"rank":1,"shared_with":["sha256:34576faf9573be998553798d05c7510124d72a1f5864bd3a9039307ba2194556","sha256:59b8b0ea7c7aa5e9362c902413eae18ed8ecbb2acbecb23a99ffcbeb8ebf8154","sha256:6efeabe55ddf896eaaf521ffb7ebf98e81612f203fce6b12bf554aa31833f76a"],"stage":"script","sub":"bash, sed, dirname, basename +9 more · 318 runs · also made outputs of 3 other artifacts","tone":"ok"},{"count":1,"id":"t:executable","kind":"type","label":"Programs","lane":"made","rank":12,"sub":"1 program · stated by the linker","tone":"ok","type":"executable","typed_by":{"producer":1},"versions":1},{"count":1,"id":"t:file","kind":"type","label":"Other files","lane":"made","rank":2,"sub":"1 file, written twice · 2 .awk","tone":"ok","type":"file","typed_by":{"untyped":1},"versions":2},{"count":1,"id":"t:library","kind":"type","label":"Libraries","lane":"made","rank":11,"sub":"1 library · stated by the linker","tone":"ok","type":"library","typed_by":{"producer":1},"versions":1},{"count":87,"findings":["Could not verify how this object file was built"],"flag":"Could not verify how this object file was built","id":"t:object","kind":"type","label":"Object files","lane":"made","rank":7,"sub":"87 objects, 88 versions · 86 stated by the commands that wrote them, 1 named by the command that read them","tone":"flag","type":"object","typed_by":{"consumer":1,"producer":86},"versions":88},{"count":84,"family":"asm","id":"t:source:asm","kind":"type","label":"Assembly sources","lane":"made","rank":6,"sub":"84 source files · stated by the compiler","tone":"ok","type":"source","typed_by":{"producer":84},"versions":84},{"count":1,"family":"c","id":"t:source:c","kind":"type","label":"C/C++ sources","lane":"made","rank":3,"sub":"1 source file, written twice · by name","tone":"ok","type":"source","typed_by":{"name":1},"versions":2},{"arrival":"cached","count":168,"findings":["Could not verify how this object file was built"],"flag":"Could not verify how this object file was built","id":"u:unknown","kind":"unit","label":"Unknown files","lane":"input","rank":0,"sub":"168 files · nothing in the capture says where they came from","tone":"flag","unit":{"kind":"unknown"},"versions":168},{"artifact_kind":"file","count":1,"id":"a:artifact","kind":"artifact","label":"lzmainfo","lane":"artifact","rank":13,"state":"retained","sub":"file · retained","tone":"ok"}],"schema":2,"size":{"disputed":0,"edges":3135,"hows":{"copied":2,"window":2548},"nodes":1240,"ties":{"declared":250,"named":1,"process":2297,"witnessed":2},"typed_by":{"consumer":1,"name":3,"producer":172,"untyped":2}}},"groups":{"behavior":"flagged","pipeline":"clean","posture":"not checked","supply":"not checked"},"kind":"file","license":null,"name":"lzmainfo","role":"retained","shipments":[],"slug":"lzmainfo","state":"retained","vulnerabilities":[],"witnessed":true,"witnessed_size":{"objects":658,"processes":579}},{"built_by":["build"],"declared":true,"digest":"6efeabe55ddf896eaaf521ffb7ebf98e81612f203fce6b12bf554aa31833f76a","findings":[{"affects":"artifact","confidence":"witnessed","evidence":{"claims":[{"label":"Obfuscated toolchain bypass","process":{"argv":"xz -dc --single-stream","exe":"/usr/bin/xz","pid":9368},"role":"cause","subjects":[{"kind":"file","node":"n8","path":"/home/bb/work/xz-5.6.0/src/liblzma/.libs/liblzma_la-crc64_fast.o","role":"subject"},{"kind":"pipe","node":"n6","role":"source"}],"text":"link input /home/bb/work/xz-5.6.0/src/liblzma/liblzma_la-crc64-fast.o: copied input a pipe: Written by xz from a pipe without a recorded source compilation","type":"object.written_from_pipe","values":{"producer":"xz"}},{"label":"Input written by a non-compiler tool","process":null,"role":"support","subjects":[{"kind":"file","node":"n7","path":"/home/bb/work/xz-5.6.0/src/liblzma/liblzma_la-crc64-fast.o","role":"input"}],"text":"/home/bb/work/xz-5.6.0/src/liblzma/liblzma_la-crc64-fast.o  [dash]","type":"object.shaper_ingredient","values":{"producer":"dash"}}],"evidence":["link input /home/bb/work/xz-5.6.0/src/liblzma/liblzma_la-crc64-fast.o: copied input a pipe: Written by xz from a pipe without a recorded source compilation","/home/bb/work/xz-5.6.0/src/liblzma/liblzma_la-crc64-fast.o  [dash]"],"remediation":"Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.","witness":[{"kind":"file","label":"/home/bb/work/xz-5.6.0/tests/files/good-large_compressed.lzma","node":"n1","path":"/home/bb/work/xz-5.6.0/tests/files/good-large_compressed.lzma","role":"source","via":null},{"kind":"pipe","label":"pipe","node":"n2","path":null,"role":"hop","via":{"argv":"xz -dc ../../tests/files/good-large_compressed.lzma","exe":"/usr/bin/xz","pid":9364}},{"kind":"pipe","label":"pipe","node":"n3","path":null,"role":"hop","via":{"argv":"head -c +2048","exe":"/usr/lib/cargo/bin/coreutils/env","pid":9373}},{"kind":"pipe","label":"pipe","node":"n4","path":null,"role":"hop","via":{"argv":"sed s/\\(.\\)/\\1\\n/g","exe":"/usr/bin/sed","pid":9366}},{"kind":"pipe","label":"pipe","node":"n5","path":null,"role":"hop","via":{"argv":"awk BEGIN{FS=\"\\n\";RS=\"\\n\";ORS=\"\";m=256;for(i=0;i<m;i++){t[sprintf(\"x%c\",i)]=i;c[i]=((i*7)+5)%m;}i=0;j=0;for(l=0;l<4096;l++){i=(i+1)%m;a=c[i];j=(j+a)%m;c[i]=c[j]","exe":"/usr/bin/gawk","pid":9367}},{"kind":"pipe","label":"pipe","node":"n6","path":null,"role":"hop","via":{"argv":"xz -dc --single-stream","exe":"/usr/bin/xz","pid":9368}},{"kind":"file","label":"/home/bb/work/xz-5.6.0/src/liblzma/liblzma_la-crc64-fast.o","node":"n7","path":"/home/bb/work/xz-5.6.0/src/liblzma/liblzma_la-crc64-fast.o","role":"hop","via":{"argv":"head -c +88792","exe":"/usr/lib/cargo/bin/coreutils/env","pid":9369}},{"kind":"file","label":"/home/bb/work/xz-5.6.0/src/liblzma/.libs/liblzma_la-crc64_fast.o","node":"n8","path":"/home/bb/work/xz-5.6.0/src/liblzma/.libs/liblzma_la-crc64_fast.o","role":"subject","via":{"argv":"/usr/bin/ld --eh-frame-hdr -m elf_x86_64 --hash-style=gnu --as-needed -dynamic-linker /lib64/ld-linux-x86-64.so.2 -z relro -o .libs/liblzma_la-crc64_fast.o -r -","exe":"/usr/bin/x86_64-linux-gnu-ld.bfd","pid":9413}}]},"jobs":[{"actor":{"argv":"xz -dc --single-stream","exe":"/usr/bin/xz","pid":9368},"chain":["systemd","sshd:","sshd-session:","…","sh","xz"],"graph":null,"invoked_by":{"argv":"/usr/lib/systemd/systemd","exe":null,"pid":1},"name":"build","step":null,"writer":{"argv":"xz -dc --single-stream","chain":[{"argv":"/usr/lib/systemd/systemd","exe":null,"pid":1},{"argv":"sshd: /usr/sbin/sshd -D [listener] 0 of 10-100 startups","exe":null,"pid":1107},{"argv":"sshd-session: bb [priv]","exe":null,"pid":1737},{"argv":"sshd-session: bb@notty","exe":null,"pid":1814},{"argv":"sudo","exe":null,"pid":1815},{"argv":"sh","exe":"/usr/bin/dash","pid":1817},{"argv":"runuser -u bb -- env RPM_ARCH=x86_64 RPM_OS=linux DEB_HOST_GNU_TYPE=x86_64-linux-gnu DEB_BUILD_GNU_TYPE=x86_64-linux-gnu DEB_HOST_ARCH=amd64 DEB_BUILD_ARCH=amd6…","exe":"/usr/sbin/runuser","pid":1851},{"argv":"env RPM_ARCH=x86_64 RPM_OS=linux DEB_HOST_GNU_TYPE=x86_64-linux-gnu DEB_BUILD_GNU_TYPE=x86_64-linux-gnu DEB_HOST_ARCH=amd64 DEB_BUILD_ARCH=amd64 sh -c cd '/home…","exe":"/usr/lib/cargo/bin/coreutils/env","pid":1852},{"argv":"sh -c cd '/home/bb/work/xz-5.6.0' && ./configure --enable-shared --build=x86_64-pc-linux-gnu >'/mnt/assets/configure.log' 2>&1 && make -j4 >'/mnt/assets/make.lo…","exe":"/usr/bin/dash","pid":1852},{"argv":"make -j4","exe":"/usr/bin/make","pid":5467},{"argv":"/bin/bash -c make  all-recursive","exe":"/usr/bin/bash","pid":5470},{"argv":"make all-recursive","exe":"/usr/bin/make","pid":5470},{"argv":"/bin/bash -c fail=; \\\nif (target_option=k; case ${target_option-} in ?) ;; *) echo \"am__make_running_with_option: internal error: invalid\" \"target option '${tar…","exe":"/usr/bin/bash","pid":5471},{"argv":"make all","exe":"/usr/bin/make","pid":5476},{"argv":"/bin/bash -c fail=; \\\nif (target_option=k; case ${target_option-} in ?) ;; *) echo \"am__make_running_with_option: internal error: invalid\" \"target option '${tar…","exe":"/usr/bin/bash","pid":5477},{"argv":"make all","exe":"/usr/bin/make","pid":5482},{"argv":"/bin/bash -c fail=; \\\nif (target_option=k; case ${target_option-} in ?) ;; *) echo \"am__make_running_with_option: internal error: invalid\" \"target option '${tar…","exe":"/usr/bin/bash","pid":5483},{"argv":"make all-am","exe":"/usr/bin/make","pid":5489},{"argv":"/bin/bash -c echo -n ''; export top_srcdir='../..'; export CC='gcc'; export DEFS='-DHAVE_CONFIG_H'; export DEFAULT_INCLUDES='-I. -I../..'; export INCLUDES=''; e…","exe":"/usr/bin/bash","pid":9304},{"argv":"/bin/bash","exe":"/usr/bin/bash","pid":9308},{"argv":"/bin/sh","exe":"/usr/bin/dash","pid":9313},{"argv":"xz -dc --single-stream","exe":"/usr/bin/xz","pid":9368}],"exe":"/usr/bin/xz","pid":9368}}],"kind":"detection","rule_title":"Object file origin needs review","severity":"critical","status":null,"subject":{"kind":"path","path":"/home/bb/work/xz-5.6.0/src/liblzma/.libs/liblzma_la-crc64_fast.o","producer":"x86_64-linux-gnu-ld.bfd"},"suppressed":false,"title":"Could not verify how this object file was built"}],"graph":{"caption":["Nothing it was made from was downloaded during the build.","Packaged (xz): the finding starts here: Could not verify how this object file was built.","Object files: Could not verify how this object file was built.","Unknown files: Could not verify how this object file was built."],"edges":[{"count":196,"files":{"witnessed":99},"from":"s:compile:c","label":"named as its output by the command, wrote","rels":["requested","wrote"],"tie":"witnessed","ties":{"declared":97,"witnessed":99},"to":"t:object"},{"count":99,"files":{"witnessed":99},"from":"s:compile:c","label":"wrote","rels":["wrote"],"tie":"witnessed","ties":{"witnessed":99},"to":"t:source:asm"},{"count":1,"files":{"witnessed":1},"from":"s:copy","label":"renamed or linked by","rels":["named"],"tie":"witnessed","ties":{"witnessed":1},"to":"t:source:c"},{"count":2,"files":{"witnessed":1},"from":"s:link","label":"named as its output by the command, wrote","rels":["requested","wrote"],"tie":"witnessed","ties":{"declared":1,"witnessed":1},"to":"t:executable"},{"count":2,"files":{"witnessed":1},"from":"s:link","label":"named as its output by the command, wrote","rels":["requested","wrote"],"tie":"witnessed","ties":{"declared":1,"witnessed":1},"to":"t:library"},{"count":4,"files":{"witnessed":2},"from":"s:link","label":"named as its output by the command, wrote","rels":["requested","wrote"],"tie":"witnessed","ties":{"declared":2,"witnessed":2},"to":"t:object"},{"count":1,"from":"s:package","label":"piped into","rels":["carried"],"tie":"process","ties":{"process":1},"to":"s:script"},{"count":1,"from":"s:package#xz","label":"piped into","rels":["carried"],"tie":"witnessed","ties":{"witnessed":1},"to":"s:script"},{"count":2,"from":"s:script","label":"piped into","rels":["carried"],"tie":"process","ties":{"process":2},"to":"s:compile:c"},{"count":1,"from":"s:script","label":"piped into","rels":["carried"],"tie":"declared","ties":{"declared":1},"to":"s:package#xz"},{"count":2,"files":{"witnessed":1},"from":"s:script","label":"wrote","rels":["wrote"],"tie":"witnessed","ties":{"witnessed":2},"to":"t:file"},{"count":2,"files":{"witnessed":1},"from":"s:script","label":"wrote","rels":["wrote"],"tie":"witnessed","ties":{"witnessed":2},"to":"t:object"},{"count":2,"files":{"witnessed":1},"from":"s:script","label":"wrote","rels":["wrote"],"tie":"witnessed","ties":{"witnessed":2},"to":"t:source:c"},{"count":1,"files":{"witnessed":1},"from":"t:executable","label":"is","rels":["is"],"tie":"witnessed","ties":{"witnessed":1},"to":"a:artifact"},{"count":1,"files":{"process":1},"from":"t:file","label":"read into","rels":["fed"],"tie":"process","ties":{"process":1},"to":"s:script"},{"count":1,"files":{"witnessed":1},"from":"t:file","label":"revised into","rels":["revises"],"tie":"witnessed","ties":{"witnessed":1},"to":"t:file"},{"count":1,"files":{"named":1},"from":"t:library","label":"read into","rels":["fed"],"tie":"named","ties":{"named":1},"to":"s:link"},{"count":102,"files":{"declared":102},"from":"t:object","label":"read into","rels":["fed"],"tie":"declared","ties":{"declared":102},"to":"s:link"},{"count":1,"files":{"witnessed":1},"from":"t:object","label":"revised into","rels":["revises"],"tie":"witnessed","ties":{"witnessed":1},"to":"t:object"},{"count":99,"files":{"declared":99},"from":"t:source:asm","label":"read into","rels":["fed"],"tie":"declared","ties":{"declared":99},"to":"s:compile:c"},{"count":99,"files":{"process":1},"from":"t:source:c","label":"read into","rels":["fed"],"tie":"process","ties":{"process":99},"to":"s:compile:c"},{"count":1,"files":{"witnessed":1},"from":"t:source:c","label":"revised into","rels":["revises"],"tie":"witnessed","ties":{"witnessed":1},"to":"t:source:c"},{"count":2450,"files":{"declared":90,"process":92},"from":"u:unknown","label":"read into","rels":["fed"],"tie":"declared","ties":{"declared":90,"process":2360},"to":"s:compile:c"},{"count":1,"files":{"process":1},"from":"u:unknown","label":"read into","rels":["fed"],"tie":"process","ties":{"process":1},"to":"s:link"},{"count":1,"files":{"process":1},"from":"u:unknown","label":"read into","rels":["fed"],"tie":"process","ties":{"process":1},"to":"s:package"},{"count":15,"files":{"process":15},"from":"u:unknown","label":"read into","rels":["fed"],"tie":"process","ties":{"process":15},"to":"s:script"},{"count":1,"files":{"witnessed":1},"from":"u:unknown","label":"the finding's bytes went on to","rels":["witness"],"tie":"witnessed","ties":{"witnessed":1},"to":"t:object"}],"groups":[{"count":295,"family":"c","id":"s:compile:c","kind":"stage","label":"Compiled (C/C++)","lane":"stage","programs":{"cc1":99,"gcc":97,"x86_64-linux-gnu-as":99},"rank":5,"shared_with":["sha256:34576faf9573be998553798d05c7510124d72a1f5864bd3a9039307ba2194556","sha256:59b8b0ea7c7aa5e9362c902413eae18ed8ecbb2acbecb23a99ffcbeb8ebf8154","sha256:8ecf7192de93387962afdff985eb81568f4c7a6739a46837bff8c305b192e377"],"stage":"compile","sub":"cc1, x86_64-linux-gnu-as, gcc · 295 runs · also made outputs of 3 other artifacts","tone":"ok"},{"count":1,"id":"s:copy","kind":"stage","label":"Copied","lane":"stage","programs":{"mv":1},"rank":4,"stage":"copy","sub":"mv · 1 run","tone":"ok"},{"count":8,"id":"s:link","kind":"stage","label":"Linked","lane":"stage","programs":{"collect2":4,"ld":4},"rank":10,"shared_with":["sha256:34576faf9573be998553798d05c7510124d72a1f5864bd3a9039307ba2194556","sha256:59b8b0ea7c7aa5e9362c902413eae18ed8ecbb2acbecb23a99ffcbeb8ebf8154","sha256:8ecf7192de93387962afdff985eb81568f4c7a6739a46837bff8c305b192e377"],"stage":"link","sub":"collect2, ld · 8 runs · also made outputs of 3 other artifacts","tone":"ok"},{"count":1,"id":"s:package","kind":"stage","label":"Packaged","lane":"stage","programs":{"xz":1},"rank":8,"stage":"package","sub":"xz · 1 run","tone":"ok"},{"count":1,"findings":["Could not verify how this object file was built"],"flag":"the finding starts here: Could not verify how this object file was built","id":"s:package#xz","kind":"stage","label":"Packaged (xz)","lane":"stage","programs":{"xz":1},"rank":9,"stage":"package","sub":"xz · 1 run","tone":"flag"},{"count":318,"id":"s:script","kind":"stage","label":"Scripts","lane":"stage","programs":{"awk":1,"basename":2,"bash":198,"cat":1,"dirname":17,"expr":1,"gawk":2,"head":2,"hostname":1,"mktemp":1,"sed":90,"sh":1,"tr":1},"rank":1,"shared_with":["sha256:34576faf9573be998553798d05c7510124d72a1f5864bd3a9039307ba2194556","sha256:59b8b0ea7c7aa5e9362c902413eae18ed8ecbb2acbecb23a99ffcbeb8ebf8154","sha256:8ecf7192de93387962afdff985eb81568f4c7a6739a46837bff8c305b192e377"],"stage":"script","sub":"bash, sed, dirname, basename +9 more · 318 runs · also made outputs of 3 other artifacts","tone":"ok"},{"count":1,"id":"t:executable","kind":"type","label":"Programs","lane":"made","rank":12,"sub":"1 program · stated by the linker","tone":"ok","type":"executable","typed_by":{"producer":1},"versions":1},{"count":1,"id":"t:file","kind":"type","label":"Other files","lane":"made","rank":2,"sub":"1 file, written twice · 2 .awk","tone":"ok","type":"file","typed_by":{"untyped":1},"versions":2},{"count":1,"id":"t:library","kind":"type","label":"Libraries","lane":"made","rank":11,"sub":"1 library · stated by the linker","tone":"ok","type":"library","typed_by":{"producer":1},"versions":1},{"count":102,"findings":["Could not verify how this object file was built"],"flag":"Could not verify how this object file was built","id":"t:object","kind":"type","label":"Object files","lane":"made","rank":7,"sub":"102 objects, 103 versions · 101 stated by the commands that wrote them, 1 named by the command that read them","tone":"flag","type":"object","typed_by":{"consumer":1,"producer":101},"versions":103},{"count":99,"family":"asm","id":"t:source:asm","kind":"type","label":"Assembly sources","lane":"made","rank":6,"sub":"99 source files · stated by the compiler","tone":"ok","type":"source","typed_by":{"producer":99},"versions":99},{"count":1,"family":"c","id":"t:source:c","kind":"type","label":"C/C++ sources","lane":"made","rank":3,"sub":"1 source file, written twice · by name","tone":"ok","type":"source","typed_by":{"name":1},"versions":2},{"arrival":"cached","count":199,"findings":["Could not verify how this object file was built"],"flag":"Could not verify how this object file was built","id":"u:unknown","kind":"unit","label":"Unknown files","lane":"input","rank":0,"sub":"199 files · nothing in the capture says where they came from","tone":"flag","unit":{"kind":"unknown"},"versions":199},{"artifact_kind":"file","count":1,"id":"a:artifact","kind":"artifact","label":"xz","lane":"artifact","rank":13,"state":"retained","sub":"file · retained","tone":"ok"}],"schema":2,"size":{"disputed":0,"edges":3714,"hows":{"copied":2,"window":3082},"nodes":1346,"ties":{"declared":292,"named":1,"process":2789,"witnessed":2},"typed_by":{"consumer":1,"name":3,"producer":202,"untyped":2}}},"groups":{"behavior":"flagged","pipeline":"clean","posture":"not checked","supply":"not checked"},"kind":"file","license":null,"name":"xz","role":"retained","shipments":[],"slug":"xz","state":"retained","vulnerabilities":[],"witnessed":true,"witnessed_size":{"objects":719,"processes":624}},{"built_by":["build"],"declared":true,"digest":"34576faf9573be998553798d05c7510124d72a1f5864bd3a9039307ba2194556","findings":[{"affects":"artifact","confidence":"witnessed","evidence":{"claims":[{"label":"Obfuscated toolchain bypass","process":{"argv":"xz -dc --single-stream","exe":"/usr/bin/xz","pid":9368},"role":"cause","subjects":[{"kind":"file","node":"n8","path":"/home/bb/work/xz-5.6.0/src/liblzma/.libs/liblzma_la-crc64_fast.o","role":"subject"},{"kind":"pipe","node":"n6","role":"source"}],"text":"link input /home/bb/work/xz-5.6.0/src/liblzma/liblzma_la-crc64-fast.o: copied input a pipe: Written by xz from a pipe without a recorded source compilation","type":"object.written_from_pipe","values":{"producer":"xz"}},{"label":"Input written by a non-compiler tool","process":null,"role":"support","subjects":[{"kind":"file","node":"n7","path":"/home/bb/work/xz-5.6.0/src/liblzma/liblzma_la-crc64-fast.o","role":"input"}],"text":"/home/bb/work/xz-5.6.0/src/liblzma/liblzma_la-crc64-fast.o  [dash]","type":"object.shaper_ingredient","values":{"producer":"dash"}}],"evidence":["link input /home/bb/work/xz-5.6.0/src/liblzma/liblzma_la-crc64-fast.o: copied input a pipe: Written by xz from a pipe without a recorded source compilation","/home/bb/work/xz-5.6.0/src/liblzma/liblzma_la-crc64-fast.o  [dash]"],"remediation":"Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.","witness":[{"kind":"file","label":"/home/bb/work/xz-5.6.0/tests/files/good-large_compressed.lzma","node":"n1","path":"/home/bb/work/xz-5.6.0/tests/files/good-large_compressed.lzma","role":"source","via":null},{"kind":"pipe","label":"pipe","node":"n2","path":null,"role":"hop","via":{"argv":"xz -dc ../../tests/files/good-large_compressed.lzma","exe":"/usr/bin/xz","pid":9364}},{"kind":"pipe","label":"pipe","node":"n3","path":null,"role":"hop","via":{"argv":"head -c +2048","exe":"/usr/lib/cargo/bin/coreutils/env","pid":9373}},{"kind":"pipe","label":"pipe","node":"n4","path":null,"role":"hop","via":{"argv":"sed s/\\(.\\)/\\1\\n/g","exe":"/usr/bin/sed","pid":9366}},{"kind":"pipe","label":"pipe","node":"n5","path":null,"role":"hop","via":{"argv":"awk BEGIN{FS=\"\\n\";RS=\"\\n\";ORS=\"\";m=256;for(i=0;i<m;i++){t[sprintf(\"x%c\",i)]=i;c[i]=((i*7)+5)%m;}i=0;j=0;for(l=0;l<4096;l++){i=(i+1)%m;a=c[i];j=(j+a)%m;c[i]=c[j]","exe":"/usr/bin/gawk","pid":9367}},{"kind":"pipe","label":"pipe","node":"n6","path":null,"role":"hop","via":{"argv":"xz -dc --single-stream","exe":"/usr/bin/xz","pid":9368}},{"kind":"file","label":"/home/bb/work/xz-5.6.0/src/liblzma/liblzma_la-crc64-fast.o","node":"n7","path":"/home/bb/work/xz-5.6.0/src/liblzma/liblzma_la-crc64-fast.o","role":"hop","via":{"argv":"head -c +88792","exe":"/usr/lib/cargo/bin/coreutils/env","pid":9369}},{"kind":"file","label":"/home/bb/work/xz-5.6.0/src/liblzma/.libs/liblzma_la-crc64_fast.o","node":"n8","path":"/home/bb/work/xz-5.6.0/src/liblzma/.libs/liblzma_la-crc64_fast.o","role":"subject","via":{"argv":"/usr/bin/ld --eh-frame-hdr -m elf_x86_64 --hash-style=gnu --as-needed -dynamic-linker /lib64/ld-linux-x86-64.so.2 -z relro -o .libs/liblzma_la-crc64_fast.o -r -","exe":"/usr/bin/x86_64-linux-gnu-ld.bfd","pid":9413}}]},"jobs":[{"actor":{"argv":"xz -dc --single-stream","exe":"/usr/bin/xz","pid":9368},"chain":["systemd","sshd:","sshd-session:","…","sh","xz"],"graph":null,"invoked_by":{"argv":"/usr/lib/systemd/systemd","exe":null,"pid":1},"name":"build","step":null,"writer":{"argv":"xz -dc --single-stream","chain":[{"argv":"/usr/lib/systemd/systemd","exe":null,"pid":1},{"argv":"sshd: /usr/sbin/sshd -D [listener] 0 of 10-100 startups","exe":null,"pid":1107},{"argv":"sshd-session: bb [priv]","exe":null,"pid":1737},{"argv":"sshd-session: bb@notty","exe":null,"pid":1814},{"argv":"sudo","exe":null,"pid":1815},{"argv":"sh","exe":"/usr/bin/dash","pid":1817},{"argv":"runuser -u bb -- env RPM_ARCH=x86_64 RPM_OS=linux DEB_HOST_GNU_TYPE=x86_64-linux-gnu DEB_BUILD_GNU_TYPE=x86_64-linux-gnu DEB_HOST_ARCH=amd64 DEB_BUILD_ARCH=amd6…","exe":"/usr/sbin/runuser","pid":1851},{"argv":"env RPM_ARCH=x86_64 RPM_OS=linux DEB_HOST_GNU_TYPE=x86_64-linux-gnu DEB_BUILD_GNU_TYPE=x86_64-linux-gnu DEB_HOST_ARCH=amd64 DEB_BUILD_ARCH=amd64 sh -c cd '/home…","exe":"/usr/lib/cargo/bin/coreutils/env","pid":1852},{"argv":"sh -c cd '/home/bb/work/xz-5.6.0' && ./configure --enable-shared --build=x86_64-pc-linux-gnu >'/mnt/assets/configure.log' 2>&1 && make -j4 >'/mnt/assets/make.lo…","exe":"/usr/bin/dash","pid":1852},{"argv":"make -j4","exe":"/usr/bin/make","pid":5467},{"argv":"/bin/bash -c make  all-recursive","exe":"/usr/bin/bash","pid":5470},{"argv":"make all-recursive","exe":"/usr/bin/make","pid":5470},{"argv":"/bin/bash -c fail=; \\\nif (target_option=k; case ${target_option-} in ?) ;; *) echo \"am__make_running_with_option: internal error: invalid\" \"target option '${tar…","exe":"/usr/bin/bash","pid":5471},{"argv":"make all","exe":"/usr/bin/make","pid":5476},{"argv":"/bin/bash -c fail=; \\\nif (target_option=k; case ${target_option-} in ?) ;; *) echo \"am__make_running_with_option: internal error: invalid\" \"target option '${tar…","exe":"/usr/bin/bash","pid":5477},{"argv":"make all","exe":"/usr/bin/make","pid":5482},{"argv":"/bin/bash -c fail=; \\\nif (target_option=k; case ${target_option-} in ?) ;; *) echo \"am__make_running_with_option: internal error: invalid\" \"target option '${tar…","exe":"/usr/bin/bash","pid":5483},{"argv":"make all-am","exe":"/usr/bin/make","pid":5489},{"argv":"/bin/bash -c echo -n ''; export top_srcdir='../..'; export CC='gcc'; export DEFS='-DHAVE_CONFIG_H'; export DEFAULT_INCLUDES='-I. -I../..'; export INCLUDES=''; e…","exe":"/usr/bin/bash","pid":9304},{"argv":"/bin/bash","exe":"/usr/bin/bash","pid":9308},{"argv":"/bin/sh","exe":"/usr/bin/dash","pid":9313},{"argv":"xz -dc --single-stream","exe":"/usr/bin/xz","pid":9368}],"exe":"/usr/bin/xz","pid":9368}}],"kind":"detection","rule_title":"Object file origin needs review","severity":"critical","status":null,"subject":{"kind":"path","path":"/home/bb/work/xz-5.6.0/src/liblzma/.libs/liblzma_la-crc64_fast.o","producer":"x86_64-linux-gnu-ld.bfd"},"suppressed":false,"title":"Could not verify how this object file was built"}],"graph":{"caption":["Nothing it was made from was downloaded during the build.","Packaged (xz): the finding starts here: Could not verify how this object file was built.","Object files: Could not verify how this object file was built.","Unknown files: Could not verify how this object file was built."],"edges":[{"count":166,"files":{"witnessed":84},"from":"s:compile:c","label":"named as its output by the command, wrote","rels":["requested","wrote"],"tie":"witnessed","ties":{"declared":82,"witnessed":84},"to":"t:object"},{"count":84,"files":{"witnessed":84},"from":"s:compile:c","label":"wrote","rels":["wrote"],"tie":"witnessed","ties":{"witnessed":84},"to":"t:source:asm"},{"count":1,"files":{"witnessed":1},"from":"s:copy","label":"renamed or linked by","rels":["named"],"tie":"witnessed","ties":{"witnessed":1},"to":"t:source:c"},{"count":2,"files":{"witnessed":1},"from":"s:link","label":"named as its output by the command, wrote","rels":["requested","wrote"],"tie":"witnessed","ties":{"declared":1,"witnessed":1},"to":"t:executable"},{"count":2,"files":{"witnessed":1},"from":"s:link","label":"named as its output by the command, wrote","rels":["requested","wrote"],"tie":"witnessed","ties":{"declared":1,"witnessed":1},"to":"t:library"},{"count":4,"files":{"witnessed":2},"from":"s:link","label":"named as its output by the command, wrote","rels":["requested","wrote"],"tie":"witnessed","ties":{"declared":2,"witnessed":2},"to":"t:object"},{"count":1,"from":"s:package","label":"piped into","rels":["carried"],"tie":"process","ties":{"process":1},"to":"s:script"},{"count":1,"from":"s:package#xz","label":"piped into","rels":["carried"],"tie":"witnessed","ties":{"witnessed":1},"to":"s:script"},{"count":2,"from":"s:script","label":"piped into","rels":["carried"],"tie":"process","ties":{"process":2},"to":"s:compile:c"},{"count":1,"from":"s:script","label":"piped into","rels":["carried"],"tie":"declared","ties":{"declared":1},"to":"s:package#xz"},{"count":2,"files":{"witnessed":1},"from":"s:script","label":"wrote","rels":["wrote"],"tie":"witnessed","ties":{"witnessed":2},"to":"t:file"},{"count":2,"files":{"witnessed":1},"from":"s:script","label":"wrote","rels":["wrote"],"tie":"witnessed","ties":{"witnessed":2},"to":"t:object"},{"count":2,"files":{"witnessed":1},"from":"s:script","label":"wrote","rels":["wrote"],"tie":"witnessed","ties":{"witnessed":2},"to":"t:source:c"},{"count":1,"files":{"witnessed":1},"from":"t:executable","label":"is","rels":["is"],"tie":"witnessed","ties":{"witnessed":1},"to":"a:artifact"},{"count":1,"files":{"process":1},"from":"t:file","label":"read into","rels":["fed"],"tie":"process","ties":{"process":1},"to":"s:script"},{"count":1,"files":{"witnessed":1},"from":"t:file","label":"revised into","rels":["revises"],"tie":"witnessed","ties":{"witnessed":1},"to":"t:file"},{"count":1,"files":{"named":1},"from":"t:library","label":"read into","rels":["fed"],"tie":"named","ties":{"named":1},"to":"s:link"},{"count":87,"files":{"declared":87},"from":"t:object","label":"read into","rels":["fed"],"tie":"declared","ties":{"declared":87},"to":"s:link"},{"count":1,"files":{"witnessed":1},"from":"t:object","label":"revised into","rels":["revises"],"tie":"witnessed","ties":{"witnessed":1},"to":"t:object"},{"count":84,"files":{"declared":84},"from":"t:source:asm","label":"read into","rels":["fed"],"tie":"declared","ties":{"declared":84},"to":"s:compile:c"},{"count":84,"files":{"process":1},"from":"t:source:c","label":"read into","rels":["fed"],"tie":"process","ties":{"process":84},"to":"s:compile:c"},{"count":1,"files":{"witnessed":1},"from":"t:source:c","label":"revised into","rels":["revises"],"tie":"witnessed","ties":{"witnessed":1},"to":"t:source:c"},{"count":1960,"files":{"declared":78,"process":73},"from":"u:unknown","label":"read into","rels":["fed"],"tie":"declared","ties":{"declared":78,"process":1882},"to":"s:compile:c"},{"count":1,"files":{"process":1},"from":"u:unknown","label":"read into","rels":["fed"],"tie":"process","ties":{"process":1},"to":"s:link"},{"count":1,"files":{"process":1},"from":"u:unknown","label":"read into","rels":["fed"],"tie":"process","ties":{"process":1},"to":"s:package"},{"count":15,"files":{"process":15},"from":"u:unknown","label":"read into","rels":["fed"],"tie":"process","ties":{"process":15},"to":"s:script"},{"count":1,"files":{"witnessed":1},"from":"u:unknown","label":"the finding's bytes went on to","rels":["witness"],"tie":"witnessed","ties":{"witnessed":1},"to":"t:object"}],"groups":[{"count":250,"family":"c","id":"s:compile:c","kind":"stage","label":"Compiled (C/C++)","lane":"stage","programs":{"cc1":84,"gcc":82,"x86_64-linux-gnu-as":84},"rank":5,"shared_with":["sha256:59b8b0ea7c7aa5e9362c902413eae18ed8ecbb2acbecb23a99ffcbeb8ebf8154","sha256:6efeabe55ddf896eaaf521ffb7ebf98e81612f203fce6b12bf554aa31833f76a","sha256:8ecf7192de93387962afdff985eb81568f4c7a6739a46837bff8c305b192e377"],"stage":"compile","sub":"cc1, x86_64-linux-gnu-as, gcc · 250 runs · also made outputs of 3 other artifacts","tone":"ok"},{"count":1,"id":"s:copy","kind":"stage","label":"Copied","lane":"stage","programs":{"mv":1},"rank":4,"stage":"copy","sub":"mv · 1 run","tone":"ok"},{"count":8,"id":"s:link","kind":"stage","label":"Linked","lane":"stage","programs":{"collect2":4,"ld":4},"rank":10,"shared_with":["sha256:59b8b0ea7c7aa5e9362c902413eae18ed8ecbb2acbecb23a99ffcbeb8ebf8154","sha256:6efeabe55ddf896eaaf521ffb7ebf98e81612f203fce6b12bf554aa31833f76a","sha256:8ecf7192de93387962afdff985eb81568f4c7a6739a46837bff8c305b192e377"],"stage":"link","sub":"collect2, ld · 8 runs · also made outputs of 3 other artifacts","tone":"ok"},{"count":1,"id":"s:package","kind":"stage","label":"Packaged","lane":"stage","programs":{"xz":1},"rank":8,"stage":"package","sub":"xz · 1 run","tone":"ok"},{"count":1,"findings":["Could not verify how this object file was built"],"flag":"the finding starts here: Could not verify how this object file was built","id":"s:package#xz","kind":"stage","label":"Packaged (xz)","lane":"stage","programs":{"xz":1},"rank":9,"stage":"package","sub":"xz · 1 run","tone":"flag"},{"count":318,"id":"s:script","kind":"stage","label":"Scripts","lane":"stage","programs":{"awk":1,"basename":2,"bash":198,"cat":1,"dirname":17,"expr":1,"gawk":2,"head":2,"hostname":1,"mktemp":1,"sed":90,"sh":1,"tr":1},"rank":1,"shared_with":["sha256:59b8b0ea7c7aa5e9362c902413eae18ed8ecbb2acbecb23a99ffcbeb8ebf8154","sha256:6efeabe55ddf896eaaf521ffb7ebf98e81612f203fce6b12bf554aa31833f76a","sha256:8ecf7192de93387962afdff985eb81568f4c7a6739a46837bff8c305b192e377"],"stage":"script","sub":"bash, sed, dirname, basename +9 more · 318 runs · also made outputs of 3 other artifacts","tone":"ok"},{"count":1,"id":"t:executable","kind":"type","label":"Programs","lane":"made","rank":12,"sub":"1 program · stated by the linker","tone":"ok","type":"executable","typed_by":{"producer":1},"versions":1},{"count":1,"id":"t:file","kind":"type","label":"Other files","lane":"made","rank":2,"sub":"1 file, written twice · 2 .awk","tone":"ok","type":"file","typed_by":{"untyped":1},"versions":2},{"count":1,"id":"t:library","kind":"type","label":"Libraries","lane":"made","rank":11,"sub":"1 library · stated by the linker","tone":"ok","type":"library","typed_by":{"producer":1},"versions":1},{"count":87,"findings":["Could not verify how this object file was built"],"flag":"Could not verify how this object file was built","id":"t:object","kind":"type","label":"Object files","lane":"made","rank":7,"sub":"87 objects, 88 versions · 86 stated by the commands that wrote them, 1 named by the command that read them","tone":"flag","type":"object","typed_by":{"consumer":1,"producer":86},"versions":88},{"count":84,"family":"asm","id":"t:source:asm","kind":"type","label":"Assembly sources","lane":"made","rank":6,"sub":"84 source files · stated by the compiler","tone":"ok","type":"source","typed_by":{"producer":84},"versions":84},{"count":1,"family":"c","id":"t:source:c","kind":"type","label":"C/C++ sources","lane":"made","rank":3,"sub":"1 source file, written twice · by name","tone":"ok","type":"source","typed_by":{"name":1},"versions":2},{"arrival":"cached","count":168,"findings":["Could not verify how this object file was built"],"flag":"Could not verify how this object file was built","id":"u:unknown","kind":"unit","label":"Unknown files","lane":"input","rank":0,"sub":"168 files · nothing in the capture says where they came from","tone":"flag","unit":{"kind":"unknown"},"versions":168},{"artifact_kind":"file","count":1,"id":"a:artifact","kind":"artifact","label":"xzdec","lane":"artifact","rank":13,"state":"retained","sub":"file · retained","tone":"ok"}],"schema":2,"size":{"disputed":0,"edges":3134,"hows":{"copied":2,"window":2547},"nodes":1240,"ties":{"declared":250,"named":1,"process":2296,"witnessed":2},"typed_by":{"consumer":1,"name":3,"producer":172,"untyped":2}}},"groups":{"behavior":"flagged","pipeline":"clean","posture":"not checked","supply":"not checked"},"kind":"file","license":null,"name":"xzdec","role":"retained","shipments":[],"slug":"xzdec","state":"retained","vulnerabilities":[],"witnessed":true,"witnessed_size":{"objects":658,"processes":579}}],"built":true,"checks":[{"description":"Network activity","examined":{"connections":0,"processes":0},"group":"behavior","group_label":"Build behavior","jobs":1,"jobs_unchecked":0,"key":"network-activity","state":"clean"},{"description":"Sensitive data access and transfer","examined":{"flows":20084},"group":"behavior","group_label":"Build behavior","jobs":1,"jobs_unchecked":0,"key":"sensitive-data","state":"clean"},{"description":"Cross-process access","examined":{"operations":0,"processes":1792},"group":"behavior","group_label":"Build behavior","jobs":1,"jobs_unchecked":0,"key":"process-interaction","state":"clean"},{"description":"Build file changes","examined":{"trees":0},"group":"behavior","group_label":"Build behavior","jobs":1,"jobs_unchecked":0,"key":"tree-integrity","state":"findings"},{"description":"Data flow analysis","examined":{"objects":189},"group":"behavior","group_label":"Build behavior","jobs":1,"jobs_unchecked":0,"key":"output-provenance","state":"findings"},{"description":"Filesystem writes","examined":{"trees":3,"writes":1442},"group":"behavior","group_label":"Build behavior","jobs":0,"jobs_unchecked":1,"key":"filesystem-writes","state":"not checked"},{"description":"Context collection","examined":{"processes":1792},"group":"behavior","group_label":"Build behavior","jobs":1,"jobs_unchecked":0,"key":"environment","state":"clean"},{"description":"Pipeline coverage","examined":{"captured":1,"jobs":0},"group":"pipeline","group_label":"Pipeline","jobs":1,"jobs_unchecked":0,"key":"pipeline-coverage","state":"clean"}],"counts":{"detections":2,"discrepancies":0,"posture":0,"suppressed":0,"vulnerabilities":0},"coverage":{"captured":1,"declared":0,"missing":[]},"findings":[{"affects":"artifact","check":"output-provenance","confidence":"witnessed","evidence":{"claims":[{"label":"Obfuscated toolchain bypass","process":{"argv":"xz -dc --single-stream","exe":"/usr/bin/xz","pid":9368},"role":"cause","subjects":[{"kind":"file","node":"n8","path":"/home/bb/work/xz-5.6.0/src/liblzma/.libs/liblzma_la-crc64_fast.o","role":"subject"},{"kind":"pipe","node":"n6","role":"source"}],"text":"link input /home/bb/work/xz-5.6.0/src/liblzma/liblzma_la-crc64-fast.o: copied input a pipe: Written by xz from a pipe without a recorded source compilation","type":"object.written_from_pipe","values":{"producer":"xz"}},{"label":"Input written by a non-compiler tool","process":null,"role":"support","subjects":[{"kind":"file","node":"n7","path":"/home/bb/work/xz-5.6.0/src/liblzma/liblzma_la-crc64-fast.o","role":"input"}],"text":"/home/bb/work/xz-5.6.0/src/liblzma/liblzma_la-crc64-fast.o  [dash]","type":"object.shaper_ingredient","values":{"producer":"dash"}}],"evidence":["link input /home/bb/work/xz-5.6.0/src/liblzma/liblzma_la-crc64-fast.o: copied input a pipe: Written by xz from a pipe without a recorded source compilation","/home/bb/work/xz-5.6.0/src/liblzma/liblzma_la-crc64-fast.o  [dash]"],"remediation":"Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.","witness":[{"kind":"file","label":"/home/bb/work/xz-5.6.0/tests/files/good-large_compressed.lzma","node":"n1","path":"/home/bb/work/xz-5.6.0/tests/files/good-large_compressed.lzma","role":"source","via":null},{"kind":"pipe","label":"pipe","node":"n2","path":null,"role":"hop","via":{"argv":"xz -dc ../../tests/files/good-large_compressed.lzma","exe":"/usr/bin/xz","pid":9364}},{"kind":"pipe","label":"pipe","node":"n3","path":null,"role":"hop","via":{"argv":"head -c +2048","exe":"/usr/lib/cargo/bin/coreutils/env","pid":9373}},{"kind":"pipe","label":"pipe","node":"n4","path":null,"role":"hop","via":{"argv":"sed s/\\(.\\)/\\1\\n/g","exe":"/usr/bin/sed","pid":9366}},{"kind":"pipe","label":"pipe","node":"n5","path":null,"role":"hop","via":{"argv":"awk BEGIN{FS=\"\\n\";RS=\"\\n\";ORS=\"\";m=256;for(i=0;i<m;i++){t[sprintf(\"x%c\",i)]=i;c[i]=((i*7)+5)%m;}i=0;j=0;for(l=0;l<4096;l++){i=(i+1)%m;a=c[i];j=(j+a)%m;c[i]=c[j]","exe":"/usr/bin/gawk","pid":9367}},{"kind":"pipe","label":"pipe","node":"n6","path":null,"role":"hop","via":{"argv":"xz -dc --single-stream","exe":"/usr/bin/xz","pid":9368}},{"kind":"file","label":"/home/bb/work/xz-5.6.0/src/liblzma/liblzma_la-crc64-fast.o","node":"n7","path":"/home/bb/work/xz-5.6.0/src/liblzma/liblzma_la-crc64-fast.o","role":"hop","via":{"argv":"head -c +88792","exe":"/usr/lib/cargo/bin/coreutils/env","pid":9369}},{"kind":"file","label":"/home/bb/work/xz-5.6.0/src/liblzma/.libs/liblzma_la-crc64_fast.o","node":"n8","path":"/home/bb/work/xz-5.6.0/src/liblzma/.libs/liblzma_la-crc64_fast.o","role":"subject","via":{"argv":"/usr/bin/ld --eh-frame-hdr -m elf_x86_64 --hash-style=gnu --as-needed -dynamic-linker /lib64/ld-linux-x86-64.so.2 -z relro -o .libs/liblzma_la-crc64_fast.o -r -","exe":"/usr/bin/x86_64-linux-gnu-ld.bfd","pid":9413}}]},"jobs":[{"actor":{"argv":"xz -dc --single-stream","exe":"/usr/bin/xz","pid":9368},"chain":["systemd","sshd:","sshd-session:","…","sh","xz"],"graph":null,"invoked_by":{"argv":"/usr/lib/systemd/systemd","exe":null,"pid":1},"name":"build","step":null,"writer":{"argv":"xz -dc --single-stream","chain":[{"argv":"/usr/lib/systemd/systemd","exe":null,"pid":1},{"argv":"sshd: /usr/sbin/sshd -D [listener] 0 of 10-100 startups","exe":null,"pid":1107},{"argv":"sshd-session: bb [priv]","exe":null,"pid":1737},{"argv":"sshd-session: bb@notty","exe":null,"pid":1814},{"argv":"sudo","exe":null,"pid":1815},{"argv":"sh","exe":"/usr/bin/dash","pid":1817},{"argv":"runuser -u bb -- env RPM_ARCH=x86_64 RPM_OS=linux DEB_HOST_GNU_TYPE=x86_64-linux-gnu DEB_BUILD_GNU_TYPE=x86_64-linux-gnu DEB_HOST_ARCH=amd64 DEB_BUILD_ARCH=amd6…","exe":"/usr/sbin/runuser","pid":1851},{"argv":"env RPM_ARCH=x86_64 RPM_OS=linux DEB_HOST_GNU_TYPE=x86_64-linux-gnu DEB_BUILD_GNU_TYPE=x86_64-linux-gnu DEB_HOST_ARCH=amd64 DEB_BUILD_ARCH=amd64 sh -c cd '/home…","exe":"/usr/lib/cargo/bin/coreutils/env","pid":1852},{"argv":"sh -c cd '/home/bb/work/xz-5.6.0' && ./configure --enable-shared --build=x86_64-pc-linux-gnu >'/mnt/assets/configure.log' 2>&1 && make -j4 >'/mnt/assets/make.lo…","exe":"/usr/bin/dash","pid":1852},{"argv":"make -j4","exe":"/usr/bin/make","pid":5467},{"argv":"/bin/bash -c make  all-recursive","exe":"/usr/bin/bash","pid":5470},{"argv":"make all-recursive","exe":"/usr/bin/make","pid":5470},{"argv":"/bin/bash -c fail=; \\\nif (target_option=k; case ${target_option-} in ?) ;; *) echo \"am__make_running_with_option: internal error: invalid\" \"target option '${tar…","exe":"/usr/bin/bash","pid":5471},{"argv":"make all","exe":"/usr/bin/make","pid":5476},{"argv":"/bin/bash -c fail=; \\\nif (target_option=k; case ${target_option-} in ?) ;; *) echo \"am__make_running_with_option: internal error: invalid\" \"target option '${tar…","exe":"/usr/bin/bash","pid":5477},{"argv":"make all","exe":"/usr/bin/make","pid":5482},{"argv":"/bin/bash -c fail=; \\\nif (target_option=k; case ${target_option-} in ?) ;; *) echo \"am__make_running_with_option: internal error: invalid\" \"target option '${tar…","exe":"/usr/bin/bash","pid":5483},{"argv":"make all-am","exe":"/usr/bin/make","pid":5489},{"argv":"/bin/bash -c echo -n ''; export top_srcdir='../..'; export CC='gcc'; export DEFS='-DHAVE_CONFIG_H'; export DEFAULT_INCLUDES='-I. -I../..'; export INCLUDES=''; e…","exe":"/usr/bin/bash","pid":9304},{"argv":"/bin/bash","exe":"/usr/bin/bash","pid":9308},{"argv":"/bin/sh","exe":"/usr/bin/dash","pid":9313},{"argv":"xz -dc --single-stream","exe":"/usr/bin/xz","pid":9368}],"exe":"/usr/bin/xz","pid":9368}}],"kind":"detection","reach":[{"how":"member","name":"liblzma.so.5.6.0"},{"how":"member","name":"lzmainfo"},{"how":"member","name":"xz"},{"how":"member","name":"xzdec"}],"rule_title":"Object file origin needs review","severity":"critical","status":null,"subject":{"kind":"path","path":"/home/bb/work/xz-5.6.0/src/liblzma/.libs/liblzma_la-crc64_fast.o","producer":"x86_64-linux-gnu-ld.bfd"},"suppressed":false,"title":"Could not verify how this object file was built"},{"affects":"build","check":"tree-integrity","confidence":"witnessed","evidence":{"claims":[{"label":"Generated file edited in place","process":{"argv":"sed -i /^ACLOCAL_M4 = $(top_srcdir)\\/aclocal.m4/iam__test = bad-3-corrupt_lzma2.xz src/liblzma/Makefile","exe":"/usr/bin/sed","pid":5421},"role":"cause","subjects":[{"kind":"file","node":"n1","path":"/home/bb/work/xz-5.6.0/src/liblzma/Makefile","role":"subject"}],"text":"Edited in place by: sed -i /^ACLOCAL_M4 = $(top_srcdir)\\/aclocal.m4/iam__test = bad-3-corrupt_lzma2.xz src/liblzma/Makefile","type":"file.edited_in_place","values":{}},{"label":"Read after the edit","process":null,"role":"support","subjects":[{"kind":"file","node":"n1","path":"/home/bb/work/xz-5.6.0/src/liblzma/Makefile","role":"subject"}],"text":"The file was read 1 times after the edit.","type":"file.read_after_edit","values":{"reads":1}}],"evidence":["Edited in place by: sed -i /^ACLOCAL_M4 = $(top_srcdir)\\/aclocal.m4/iam__test = bad-3-corrupt_lzma2.xz src/liblzma/Makefile","The file was read 1 times after the edit."],"remediation":"Compare the file with its generated version. Review added commands, rules, and inputs; remove unexpected changes.","witness":[]},"jobs":[{"actor":{"argv":"sed -i /^LTLIBRARIES = $(lib_LTLIBRARIES)/iLTDEPS='$(lib_LTDEPS)'; \\\\\\n    export top_srcdir='$(top_srcdir)'; \\\\\\n    export CC='$(CC)'; \\\\\\n    export DEFS='$(…","exe":"/usr/bin/sed","pid":5433},"chain":["systemd","sshd:","sshd-session:","…","sh","sed"],"graph":null,"invoked_by":{"argv":"/usr/lib/systemd/systemd","exe":null,"pid":1},"name":"build","step":null,"writer":{"argv":"sed -i /^LTLIBRARIES = $(lib_LTLIBRARIES)/iLTDEPS='$(lib_LTDEPS)'; \\\\\\n    export top_srcdir='$(top_srcdir)'; \\\\\\n    export CC='$(CC)'; \\\\\\n    export DEFS='$(…","chain":[{"argv":"/usr/lib/systemd/systemd","exe":null,"pid":1},{"argv":"sshd: /usr/sbin/sshd -D [listener] 0 of 10-100 startups","exe":null,"pid":1107},{"argv":"sshd-session: bb [priv]","exe":null,"pid":1737},{"argv":"sshd-session: bb@notty","exe":null,"pid":1814},{"argv":"sudo","exe":null,"pid":1815},{"argv":"sh","exe":"/usr/bin/dash","pid":1817},{"argv":"runuser -u bb -- env RPM_ARCH=x86_64 RPM_OS=linux DEB_HOST_GNU_TYPE=x86_64-linux-gnu DEB_BUILD_GNU_TYPE=x86_64-linux-gnu DEB_HOST_ARCH=amd64 DEB_BUILD_ARCH=amd6…","exe":"/usr/sbin/runuser","pid":1851},{"argv":"env RPM_ARCH=x86_64 RPM_OS=linux DEB_HOST_GNU_TYPE=x86_64-linux-gnu DEB_BUILD_GNU_TYPE=x86_64-linux-gnu DEB_HOST_ARCH=amd64 DEB_BUILD_ARCH=amd64 sh -c cd '/home…","exe":"/usr/lib/cargo/bin/coreutils/env","pid":1852},{"argv":"sh -c cd '/home/bb/work/xz-5.6.0' && ./configure --enable-shared --build=x86_64-pc-linux-gnu >'/mnt/assets/configure.log' 2>&1 && make -j4 >'/mnt/assets/make.lo…","exe":"/usr/bin/dash","pid":1852},{"argv":"/bin/sh ./configure --enable-shared --build=x86_64-pc-linux-gnu","exe":"/home/bb/work/xz-5.6.0/configure","pid":1853},{"argv":"/bin/bash ./configure --enable-shared --build=x86_64-pc-linux-gnu","exe":"/usr/bin/bash","pid":1853},{"argv":"/bin/bash ./configure --enable-shared --build=x86_64-pc-linux-gnu","exe":"/usr/bin/bash","pid":1853},{"argv":"/bin/bash ./config.status","exe":"/usr/bin/bash","pid":4346},{"argv":"/bin/bash","exe":"/usr/bin/bash","pid":5344},{"argv":"/bin/sh","exe":"/usr/bin/dash","pid":5353},{"argv":"sed -i /^LTLIBRARIES = $(lib_LTLIBRARIES)/iLTDEPS='$(lib_LTDEPS)'; \\\\\\n    export top_srcdir='$(top_srcdir)'; \\\\\\n    export CC='$(CC)'; \\\\\\n    export DEFS='$(…","exe":"/usr/bin/sed","pid":5433}],"exe":"/usr/bin/sed","pid":5433}}],"kind":"detection","reach":[],"rule_title":"Build file tampered","severity":"high","status":null,"subject":{"kind":"path","path":"/home/bb/work/xz-5.6.0/src/liblzma/Makefile","producer":"sed"},"suppressed":false,"title":"Build file tampered"}],"generated_at_ms":1791932654334,"groups":{"behavior":"flagged","pipeline":"clean","posture":"not checked","supply":"not checked"},"jobs":[{"analyzed":true,"conclusion":"success","job":"build","name":"build","status":"analyzed","verdict":"flagged"}],"network":{"fetches":[],"peers":[]},"pipeline_id":"xz-utils-5.6.0","report":"report.json","repository":"incidents/releases/xz-utils","run":{"analyzed_ts_ms":1791937635125,"branch":"","built":true,"groups":null,"pipeline_id":"xz-utils-5.6.0","ref":"refs/tags/5.6.0","revision":"","started_ts_ms":1791937632228,"status":"complete","verdict":"flagged"},"schema":1,"stats":{"analyzed":{"artifacts":4,"compiler_invocations":1036,"feeds":0,"lockfiles":0,"packages":0},"checks":{"clean":5,"findings":2,"not_applicable":7,"not_checked":1,"run":15},"observed":{"connections":0,"interactions":436396,"jobs":1,"objects":5535,"operations":89608,"processes":1792,"wall_s":0}},"status":"open","tarp_version":"0.1.0+g0fad39e541a0.dirty","verdict":"flagged"}