Build script reached github.com
Unexpected network connection
- Subject
- baracuda-cutlass-sys 0.0.1-alpha.110
- Destination
- github.com:443
- Reaches
- Jobs
- build-test
- Rule
- egress
Evidence
Connection outside the process’s allowed destinationscause
connection to github.com:443, opened by git-remote-http
subject github.com:443
by /usr/lib/git-core/git-remote-https origin https://github.com/NVIDIA/cutlass.git
What a build script's fetch becamesupport
29 files came down; nothing the build compiled, linked or ran
Connection opened by a build script or child processsupport
the opener descends from the build script at /home/runner/work/baracuda/baracuda/target/release/build/baracuda-cutlass-sys-9a04da9260f111da/build_script_build-9a04da9260f111da
Tool commandsupport
Command: /usr/lib/git-core/git-remote-https origin https://github.com/NVIDIA/cutlass.git
by /usr/lib/git-core/git-remote-https origin https://github.com/NVIDIA/cutlass.git
In libbaracuda_cutlass_sys.rlib
Processes
build-test
cargo›cargo›build-script-build›git›git›git-remote-https
- Ran
- /usr/lib/git-core/git-remote-https origin https://github.com/NVIDIA/cutlass.git
- Invoked by
- cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 6 processes
- cargocargo build --release --locked --message-format=json-render-diagnostics2453
- cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2453
- build-script-build/home/runner/work/baracuda/baracuda/target/release/build/baracuda-cutlass-sys-9a04da9260f111da/build-script-build2526
- gitgit clone --depth 1 --filter=blob:none --sparse --no-recurse-submodules --branch v4.2.0 https://github.com/NVIDIA/cutlass.git /home/runner/.baracuda-cutlass-sys…2527
- git/usr/lib/git-core/git remote-https origin https://github.com/NVIDIA/cutlass.git2528
- git-remote-https/usr/lib/git-core/git-remote-https origin https://github.com/NVIDIA/cutlass.git2530
Remediation
The build script connected to the network while compiling. Nothing it downloaded was compiled, linked or run. Build the crate from what the registry ships, or accept the download after reviewing it.
