Skip to content
Open-Source Registry

cargo / barretenberg-rs / 5.3.0-nightly.20261016

barretenberg-rs 5.3.0-nightly.20261016

bitbison: flagged, behavior flagged, dependencies clean, posture not checked, pipeline clean, 1 of 1 jobs captured 2 detections
processes
398
operations
11K
packages
46
compiler runs
17
connections
3
job time
26s
capture
158 KB
records
20K
bytes / record
7.9

Build behaviourits build script reached github.com, release-assets.githubusercontent.comits build script ran curlundeclared fetchlinked a downloaded binaryfetched outside crates.io

run 469614f6-d2fd-4b5d-a20a-a14b95bfe4f8 · built 2026-10-16 · complete

Graph

egress · medium · in libbarretenberg_rs.rlib
3

Checks

12 of 14 clear Network activity Data flow analysis
Build behavior▲✓✓✓✓▲✓✓
Supply chain✓✓✓✓✓
Pipeline✓

Detections

2
  • Build script reached github.com +1
    barretenberg-rs 5.3.0-nightly.20261016 › github.com:443, release-assets.githubusercontent.com:443
    medium
  • Prebuilt library downloaded by a build script from its documented source
    libbb-external.a › github.com, release-assets.githubusercontent.com
    medium

Detection

mediumwitnessed

Build script reached github.com +1

Unexpected network connection

Subject
barretenberg-rs 5.3.0-nightly.20261016
Destination
github.com:443, release-assets.githubusercontent.com:443
Reaches
Jobs
build-test
Rule
egress

Evidence

  1. Connection outside the process’s allowed destinationscause

    connection to github.com:443, opened by curl

    subject github.com:443

    by curl -L -f -o /home/runner/work/aztec-packages/aztec-packages/target/release/build/barretenberg-rs-4fb3ae1b71758d3f/out/barretenberg-static.tar.gz https://githu…

  2. Connection outside the process’s allowed destinationscause

    connection to release-assets.githubusercontent.com:443, opened by curl

    subject release-assets.githubusercontent.com:443

    by curl -L -f -o /home/runner/work/aztec-packages/aztec-packages/target/release/build/barretenberg-rs-4fb3ae1b71758d3f/out/barretenberg-static.tar.gz https://githu…

  3. What a build script's fetch becamesupport

    1 file came down; nothing the build compiled, linked or ran

  4. Connection opened by a build script or child processsupport

    the opener descends from the build script at /home/runner/work/aztec-packages/aztec-packages/target/release/build/barretenberg-rs-ffd14ab7dc05da2d/build_script_build-ffd14ab7dc05da2d

  5. Build script fetched what its crate documents it fetchessupport

    barretenberg-rs's build script fetches a prebuilt barretenberg from github.com, release-assets.githubusercontent.com: aztec-packages' build.rs fetches the barretenberg binary from its GitHub release

  6. Tool commandsupport

    Command: curl -L -f -o /home/runner/work/aztec-packages/aztec-packages/target/release/build/barretenberg-rs-4fb3ae1b71758d3f/out/barretenberg-static.tar.gz https://githu…

    by curl -L -f -o /home/runner/work/aztec-packages/aztec-packages/target/release/build/barretenberg-rs-4fb3ae1b71758d3f/out/barretenberg-static.tar.gz https://githu…

In libbarretenberg_rs.rlib

Loading the graph

Processes

build-test

cargo›cargo›build-script-build›curl

Ran
curl -L -f -o /home/runner/work/aztec-packages/aztec-packages/target/release/build/barretenberg-rs-4fb3ae1b71758d3f/out/barretenberg-static.tar.gz https://githu…
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 4 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2445
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2445
  3. build-script-build/home/runner/work/aztec-packages/aztec-packages/target/release/build/barretenberg-rs-ffd14ab7dc05da2d/build-script-build3001
  4. curlcurl -L -f -o /home/runner/work/aztec-packages/aztec-packages/target/release/build/barretenberg-rs-4fb3ae1b71758d3f/out/barretenberg-static.tar.gz https://githu…3020

Remediation

The crate's build script reached the network at compile time, outside the registry's checksums. Build it from what the registry ships (the crate's own environment variable or from-source feature), or record the download as accepted once it is reviewed.

Detection

mediumwitnessed

Prebuilt library downloaded by a build script from its documented source

Object file origin needs review

Subject
/home/runner/work/aztec-packages/aztec-packages/target/release/build/barretenberg-rs-4fb3ae1b71758d3f/out/libbb-external.awritten by tar
Destination
github.com, release-assets.githubusercontent.com
Jobs
build-test
Rule
object-provenance · aztec-packages

Witness chain

  1. github.com:443
    source
  2. /home/runner/work/aztec-packages/aztec-packages/target/release/build/barretenberg-rs-4fb3ae1b71758d3f/out/barretenberg-static.tar.gzvia curl -L -f -o /home/runner/work/aztec-packages/aztec-packages/target/release/build/barretenberg-rs-4fb3ae1b71758d3f/out/barretenberg-static.tar.gz https://githu
  3. pipevia gzip -d
  4. /home/runner/work/aztec-packages/aztec-packages/target/release/build/barretenberg-rs-4fb3ae1b71758d3f/out/libbb-external.avia tar -xzf /home/runner/work/aztec-packages/aztec-packages/target/release/build/barretenberg-rs-4fb3ae1b71758d3f/out/barretenberg-static.tar.gz -C /home/runner/wo
    • Object written under a build script that downloadedfrom github.com · release-assets.githubusercontent.comby build-script-build

      written under the build script at /home/runner/work/aztec-packages/aztec-packages/target/release/build/barretenberg-rs-ffd14ab7dc05da2d/build_script_build-ffd14ab7dc05da2d, which downloaded from github.com, release-assets.githubusercontent.com

    • Obfuscated toolchain bypass

      Written by tar from a pipe without a recorded source compilation

    • Asked for by the build's own declaration

      barretenberg-rs asked the linker for it: static bb-external (target/release/build/barretenberg-rs-4fb3ae1b71758d3f/output)

    subject
  5. member
    artifact

Evidence

  1. Build script fetched what its crate documents it fetchessupport

    barretenberg-rs's build script fetches a prebuilt barretenberg from github.com, release-assets.githubusercontent.com: aztec-packages' build.rs fetches the barretenberg binary from its GitHub release

In libbarretenberg_rs.rlib

Loading the graph

Processes

build-test

cargo›cargo›build-script-build›tar

Ran
tar -xzf /home/runner/work/aztec-packages/aztec-packages/target/release/build/barretenberg-rs-4fb3ae1b71758d3f/out/barretenberg-static.tar.gz -C /home/runner/wo…
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 4 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2445
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2445
  3. build-script-build/home/runner/work/aztec-packages/aztec-packages/target/release/build/barretenberg-rs-ffd14ab7dc05da2d/build-script-build3001
  4. tartar -xzf /home/runner/work/aztec-packages/aztec-packages/target/release/build/barretenberg-rs-4fb3ae1b71758d3f/out/barretenberg-static.tar.gz -C /home/runner/wo…3053

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Network

3 peers
  • github.com:443 barretenberg-rs's own build code · curl · GitHub, Inc. · 1 file undeclared
  • release-assets.githubusercontent.com:443 barretenberg-rs's own build code · curl · Fastly, Inc. · 1 file undeclared
  • static.crates.io:8080 the package manager · cargo (aztec-packages) via crates.io · 2,846 files · went into an output ecosystem
Dependencies47Build behaviour
autocfg1.5.1
bitflags2.13.2
bytes1.12.1
cfg-if1.0.5
errno0.3.14
hex0.4.3
ld-linux-x86-64.so.2system library
libc0.2.190build script
libc.so.6system library
libgcc_s.so.1system library
libm.so.6system library
libmvec.so.1system library
lock_api0.4.14
memoffset0.9.1build script
mio1.2.4
nix0.27.1
num-traits0.2.19build script
once_cell1.21.4
parking_lot0.12.5
parking_lot_core0.9.12build script
pin-project-lite0.2.17
proc-macro21.0.107build script
quote1.0.47build script
redox_syscall0.5.18
rmp0.8.15
rmp-serde1.3.1
rmpv1.3.1
scopeguard1.2.0
serde1.0.229build script
serde_core1.0.229build script
serde_derive1.0.229proc macro
signal-hook-registry1.4.8
smallvec1.16.3
socket20.6.5
syn2.0.119
syn3.0.9
thiserror1.0.69build script
thiserror-impl1.0.69proc macro
tokio1.53.3
tokio-macros2.7.2proc macro
tracing0.1.44
tracing-attributes0.1.31proc macro
tracing-core0.1.36
unicode-ident1.0.27
wasi0.11.1+wasi-snapshot-preview1
windows-link0.2.1
windows-sys0.61.2

Raw data

capture
158 KB
records
20,035
bytes per record
7.9

Loading a sample of the capture

Want to see more? E-mail us at hello@bitbison.io about your use case.

1 of 1 jobs captured: build-test success · Generated 2026-10-16 · run 469614f6-d2fd-4b5d-a20a-a14b95bfe4f8

analysis 0.1.0 · 2026-10-15 · 244c7b2 · graph v2