Skip to content
Open-Source Registry

cargo / bux-serve / 0.9.0

bux-serve 0.9.0

bitbison: flagged, behavior flagged, dependencies notes, posture not checked, pipeline clean, 1 of 1 jobs captured RiskhighVulnsnone
processes
597
operations
116K
packages
307
compiler runs
220
connections
3
build time
2m 16s
job time
2m 16s
capture
995 KB
records
183K
bytes / record
5.4
run 966588ae-976c-48bb-b5a7-4a2a092704fb · built 2026-11-06 · complete View on crates.io
Reviewed by Bitbison: unverified-downloadCompiling bux-serve fetches prebuilt e2fsprogs static libraries (linked in) and a bubblewrap binary (executed at runtime) from the project's GitHub releases, pinned only by version, with no hash or signature check.

Graph

egress · high · in libbux_serve.rlib
3

Checks

14 of 17 clear Network activity Data flow analysis +1 more
Build behavior▲✓✓✓✓✓✓✓▲✓✓
Supply chain✓▲✓✓✓
Pipeline✓

Detections

2
  • Build script fetched what the build compiled, linked or ran
    bux-bwrap 0.3.0 › github.com:443, release-assets.githubusercontent.com:443
    high
  • 5 uncompiled libraries linked
    bux-e2fs 0.3.0 › github.com, release-assets.githubusercontent.com
    high

Detection

highwitnessed

Build script fetched what the build compiled, linked or ran

Unexpected network connection

Subject
bux-bwrap 0.3.0
Destination
github.com:443, release-assets.githubusercontent.com:443
Reaches
Jobs
build-test
Rule
egress · bux

Evidence

  1. Connection outside the process’s allowed destinationscause

    connection to github.com:443, opened by build-script-build

    subject github.com:443

    by /home/runner/work/bux/bux/target/release/build/bux-bwrap-30f6a315fe0c1f6b/build-script-build

  2. Connection outside the process’s allowed destinationscause

    connection to release-assets.githubusercontent.com:443, opened by build-script-build

    subject release-assets.githubusercontent.com:443

    by /home/runner/work/bux/bux/target/release/build/bux-bwrap-30f6a315fe0c1f6b/build-script-build

  3. What a build script's fetch becamesupport

    25 files came down, reaching 475 more; the build compiled or linked libcreate_inode.a, libext2fs.a, libcom_err.a +3 more

  4. Connection opened by a build script or child processsupport

    the opener is the build script at /home/runner/work/bux/bux/target/release/build/bux-bwrap-30f6a315fe0c1f6b/build-script-build

In libbux_serve.rlib

Loading the graph

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/bux/bux/target/release/build/bux-bwrap-30f6a315fe0c1f6b/build-script-build
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 3 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics1342
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics1342
  3. build-script-build/home/runner/work/bux/bux/target/release/build/bux-bwrap-30f6a315fe0c1f6b/build-script-build5521

Remediation

A dependency's build downloaded files the build then compiled, linked or ran, outside anything the registry checksums. Review what came down, pin or replace the dependency, or record the download as accepted once it is reviewed.

Detection

highwitnessed

5 uncompiled libraries linked

Object file origin needs review

Subject
bux-e2fs 0.3.0
Destination
github.com, release-assets.githubusercontent.com
Jobs
build-test
Rule
object-provenance · bux

Witness chain

  1. /home/runner/work/bux/bux/target/release/build/bux-e2fs-8ad02f816d4ea2ee/out/e2fs/lib/libcom_err.avia /home/runner/work/bux/bux/target/release/build/bux-e2fs-83413bb3d87a8002/build-script-build
    • Object written under a build script that downloadedfrom github.com · release-assets.githubusercontent.com

      written under the build script at /home/runner/work/bux/bux/target/release/build/bux-e2fs-83413bb3d87a8002/build-script-build, which downloaded from github.com, release-assets.githubusercontent.com

    • Obfuscated toolchain bypass

      Written by build-script-build from a network connection without a recorded source compilation

    • Asked for by the build's own declaration

      bux-e2fs asked the linker for it: static com_err (target/release/build/bux-e2fs-8ad02f816d4ea2ee/output)

    source
  2. dependency
    artifact

Evidence

  1. Object written under a build script that downloadedcause

    written under the build script at /home/runner/work/bux/bux/target/release/build/bux-e2fs-83413bb3d87a8002/build-script-build, which downloaded from github.com, release-assets.githubusercontent.com

    subject /home/runner/work/bux/bux/target/release/build/bux-e2fs-8ad02f816d4ea2ee/out/e2fs/lib/libcreate_inode.asource github.comsource release-assets.githubusercontent.com

    by /home/runner/work/bux/bux/target/release/build/bux-e2fs-83413bb3d87a8002/build-script-build

  2. Obfuscated toolchain bypasscause

    Written by build-script-build from a network connection without a recorded source compilation

    subject /home/runner/work/bux/bux/target/release/build/bux-e2fs-8ad02f816d4ea2ee/out/e2fs/lib/libcreate_inode.a

    by /home/runner/work/bux/bux/target/release/build/bux-e2fs-83413bb3d87a8002/build-script-build

  3. Object written under a build script that downloadedcause

    written under the build script at /home/runner/work/bux/bux/target/release/build/bux-e2fs-83413bb3d87a8002/build-script-build, which downloaded from github.com, release-assets.githubusercontent.com

    subject /home/runner/work/bux/bux/target/release/build/bux-e2fs-8ad02f816d4ea2ee/out/e2fs/lib/libe2p.asource github.comsource release-assets.githubusercontent.com

    by /home/runner/work/bux/bux/target/release/build/bux-e2fs-83413bb3d87a8002/build-script-build

  4. Obfuscated toolchain bypasscause

    Written by build-script-build from a network connection without a recorded source compilation

    subject /home/runner/work/bux/bux/target/release/build/bux-e2fs-8ad02f816d4ea2ee/out/e2fs/lib/libe2p.a

    by /home/runner/work/bux/bux/target/release/build/bux-e2fs-83413bb3d87a8002/build-script-build

  5. Object written under a build script that downloadedcause

    written under the build script at /home/runner/work/bux/bux/target/release/build/bux-e2fs-83413bb3d87a8002/build-script-build, which downloaded from github.com, release-assets.githubusercontent.com

    subject /home/runner/work/bux/bux/target/release/build/bux-e2fs-8ad02f816d4ea2ee/out/e2fs/lib/libext2fs.asource github.comsource release-assets.githubusercontent.com

    by /home/runner/work/bux/bux/target/release/build/bux-e2fs-83413bb3d87a8002/build-script-build

  6. Obfuscated toolchain bypasscause

    Written by build-script-build from a network connection without a recorded source compilation

    subject /home/runner/work/bux/bux/target/release/build/bux-e2fs-8ad02f816d4ea2ee/out/e2fs/lib/libext2fs.a

    by /home/runner/work/bux/bux/target/release/build/bux-e2fs-83413bb3d87a8002/build-script-build

  7. Object written under a build script that downloadedcause

    written under the build script at /home/runner/work/bux/bux/target/release/build/bux-e2fs-83413bb3d87a8002/build-script-build, which downloaded from github.com, release-assets.githubusercontent.com

    subject /home/runner/work/bux/bux/target/release/build/bux-e2fs-8ad02f816d4ea2ee/out/e2fs/lib/libuuid_e2fs.asource github.comsource release-assets.githubusercontent.com

    by /home/runner/work/bux/bux/target/release/build/bux-e2fs-83413bb3d87a8002/build-script-build

  8. Obfuscated toolchain bypasscause

    Written by build-script-build from a network connection without a recorded source compilation

    subject /home/runner/work/bux/bux/target/release/build/bux-e2fs-8ad02f816d4ea2ee/out/e2fs/lib/libuuid_e2fs.a

    by /home/runner/work/bux/bux/target/release/build/bux-e2fs-83413bb3d87a8002/build-script-build

  9. Asked for by the build's own declarationsupport

    bux-e2fs asked the linker for it: static create_inode (target/release/build/bux-e2fs-8ad02f816d4ea2ee/output)

    subject /home/runner/work/bux/bux/target/release/build/bux-e2fs-8ad02f816d4ea2ee/out/e2fs/lib/libcreate_inode.a

  10. Asked for by the build's own declarationsupport

    bux-e2fs asked the linker for it: static e2p (target/release/build/bux-e2fs-8ad02f816d4ea2ee/output)

    subject /home/runner/work/bux/bux/target/release/build/bux-e2fs-8ad02f816d4ea2ee/out/e2fs/lib/libe2p.a

  11. Asked for by the build's own declarationsupport

    bux-e2fs asked the linker for it: static ext2fs (target/release/build/bux-e2fs-8ad02f816d4ea2ee/output)

    subject /home/runner/work/bux/bux/target/release/build/bux-e2fs-8ad02f816d4ea2ee/out/e2fs/lib/libext2fs.a

  12. Asked for by the build's own declarationsupport

    bux-e2fs asked the linker for it: static uuid_e2fs (target/release/build/bux-e2fs-8ad02f816d4ea2ee/output)

    subject /home/runner/work/bux/bux/target/release/build/bux-e2fs-8ad02f816d4ea2ee/out/e2fs/lib/libuuid_e2fs.a

In libbux_serve.rlib

Loading the graph

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/bux/bux/target/release/build/bux-e2fs-83413bb3d87a8002/build-script-build
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 3 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics1342
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics1342
  3. build-script-build/home/runner/work/bux/bux/target/release/build/bux-e2fs-83413bb3d87a8002/build-script-build5884

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Network

3 peers
  • github.com:443 build code of bux-bwrap · build-script-build (bux) · Microsoft Corporation · 25 files · went into an output undeclared
  • release-assets.githubusercontent.com:443 build code of bux-bwrap · build-script-build (bux) · Fastly, Inc. · 25 files · went into an output undeclared
  • static.crates.io:8080 the package manager · cargo (bux) via crates.io · 16,960 files · went into an output ecosystem
Vulnerabilities10FixSeverity
Dependencies
quinn-proto 0.11.17>=0.11.18
RUSTSEC-2026-0338Remote peer can panic quinn-proto with zero-length STREAM frames during unordered readshigh
RUSTSEC-2026-0340Peer minimum ACK delay can panic quinn-proto when ACK_FREQUENCY transmission is enabledhigh
RUSTSEC-2026-0343Outgoing datagram buffer accounting can panic the sender in quinn-protohigh
rustls-webpki 0.103.15>=0.103.16
CVE-2026-111943Important: ignition security updatehigh
rustls 0.23.43>=0.23.46
GHSA-2mjx-qc3c-rqvcRustls: TLS 1.3 handshake messages incorrectly accepted across encryption level boundariesmedium
GHSA-c8m5-c952-6cm4Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKsmedium
GHSA-h2v8-394m-p7vvRustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.low
GHSA-w44r-93j7-qv28rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 sharelow
atomic-polyfill 1.0.3none published
RUSTSEC-2023-0089atomic-polyfill is unmaintainedinfo
tokio 1.53.1>=1.53.3
RUSTSEC-2026-0386`AsyncFd::new` and related constructors violate I/O safetyinfo

Dependencies

315
Dependencies315Build behaviour
adler22.0.1
aho-corasick1.1.5
android_system_properties0.1.6
asn1-rs0.7.2
asn1-rs-derive0.6.0proc macro
asn1-rs-impl0.2.0proc macro
atomic-polyfill1.0.3build script, not run
atomic-waker1.1.2
autocfg1.5.1
aws-lc-rs1.18.0build script
aws-lc-sys0.44.0build scriptprebuilt objects
axum0.8.9
axum-core0.5.6
base640.22.1
base640.23.1
bit-vec0.9.1
bitflags2.13.1
block-buffer0.12.1
bumpalo3.20.3
bux0.9.0
bux-bwrap0.3.0build scriptnetworkgithub.com, release-assets.githubusercontent.com
bux-e2fs0.3.0build scriptnetworkgithub.com, release-assets.githubusercontent.com
bux-jail0.2.0
bux-landlock0.2.0
bux-oci0.9.0
bux-proto0.9.0
bux-qcow20.2.0
bux-shim0.2.0
byteorder1.5.0
bytes1.12.1
cc1.4.4
cfg-if1.0.4
cfg_aliases0.2.2
chacha200.10.1
chrono0.4.45
cmake0.1.58
cobs0.3.0
combine4.6.8
const-oid0.10.2
const_format0.2.36
const_format_proc_macros0.2.34proc macro
core-foundation0.10.1
core-foundation-sys0.8.7
cpufeatures0.3.0
crc32fast1.5.1build script
critical-section1.2.0
crypto-common0.2.2
darling0.20.11
darling_core0.20.11
darling_macro0.20.11proc macro
data-encoding2.11.1
der-parser10.0.0
deranged0.5.8
derive_builder0.20.2
derive_builder_core0.20.2
derive_builder_macro0.20.2proc macro
digest0.11.3
dirs6.0.0
dirs-sys0.5.0
displaydoc0.2.7proc macro
dunce1.0.5
embedded-io0.4.0
embedded-io0.6.1
enumflags20.7.12
enumflags2_derive0.7.12proc macro
equivalent1.0.2
errno0.3.14
fallible-iterator0.3.0
fallible-streaming-iterator0.1.9
fastrand2.5.0
filetime0.2.29
find-msvc-tools0.1.11
flate21.1.9
fnv1.0.7
foldhash0.2.0
form_urlencoded1.2.2
fs_extra1.3.0
futures-channel0.3.34
futures-core0.3.34
futures-io0.3.34
futures-macro0.3.34proc macro
futures-sink0.3.34
futures-task0.3.34
futures-util0.3.34
getrandom0.2.17
getrandom0.4.3build script
getset0.1.7proc macro
hash320.2.1
hashbrown0.16.1
hashbrown0.17.1
hashlink0.12.1
heapless0.7.17build script
heck0.5.0
hex0.4.3
http1.5.0
http-auth0.1.10
http-body1.1.0
http-body-util0.1.5
httparse1.10.1build script
httpdate1.0.3
hybrid-array0.4.14
hyper1.11.0
hyper-rustls0.27.9
hyper-util0.1.20
iana-time-zone0.1.65
iana-time-zone-haiku0.1.2build script, not run
icu_collections2.3.0
icu_locale_core2.3.0
icu_normalizer2.3.0
icu_normalizer_data2.3.0build script
icu_properties2.3.0
icu_properties_data2.3.0build script
icu_provider2.3.1
ident_case1.0.1
idna1.1.0
idna_adapter1.2.2
indexmap2.14.1
ipnet2.12.1
itoa1.0.18
jni0.22.4build script, not run
jni-macros0.22.4build script, not runproc macro
jni-sys0.4.1
jni-sys-macros0.4.1proc macro
jobserver0.1.35
js-sys0.3.104
jsonwebtoken10.4.0
konst0.2.20
konst_macro_rules0.2.19
landlock0.4.7
lazy_static1.5.0
ld-linux-x86-64.so.2system library
libc0.2.189build script
libc.so.6system library
libgcc_s.so.1system library
libm.so.6system library
libmvec.so.1system library
libredox0.1.20
libsqlite3-sys0.38.2build script
linux-raw-sys0.12.1
litemap0.8.3
lock_api0.4.14
log0.4.34
lru-slab0.1.2
matchit0.8.4
memchr2.8.3
mime0.3.17
minimal-lexical0.2.1
miniz_oxide0.8.9
mio1.2.2
nix0.31.3build script
nom7.1.3
num-bigint0.4.8
num-conv0.2.2
num-integer0.1.47
num-traits0.2.19build script
oci-client0.17.0
oci-spec0.9.0
oid-registry0.8.1build script, not run
olpc-cjson0.1.4
once_cell1.21.4
openssl-probe0.2.1
option-ext0.2.0
pem3.0.6
percent-encoding2.3.2
pin-project-lite0.2.17
pkg-config0.3.34
postcard1.1.3
potential_utf0.1.6
powerfmt0.2.0
proc-macro21.0.107build script
quinn0.11.11build script, not run
quinn-proto0.11.17
quinn-udp0.5.15build script, not run
quote1.0.47build script
r-efi6.0.0
rand0.10.2
rand_core0.10.1
rand_core0.6.4
rand_pcg0.10.2
rcgen0.14.9
redox_users0.5.2
regex1.13.1
regex-automata0.4.18
regex-syntax0.8.11
reqwest0.13.4
ring0.17.14build scriptprebuilt objects
rsqlite-vfs0.1.1
rusqlite0.40.2
rustc-hash2.1.3
rustc_version0.4.1
rusticata-macros4.1.0
rustix1.1.4build script
rustls0.23.43build script
rustls-native-certs0.8.4
rustls-pki-types1.15.1
rustls-platform-verifier0.7.0
rustls-platform-verifier-android0.1.1
rustls-webpki0.103.15
rustversion1.0.23build script, not runproc macro
ryu1.0.23
same-file1.0.6
schannel0.1.29
scopeguard1.2.0
security-framework3.7.0
security-framework-sys2.17.0
semver1.0.28
serde1.0.229build script
serde_core1.0.229build script
serde_derive1.0.229proc macro
serde_json1.0.151build script
serde_path_to_error0.1.20
serde_urlencoded0.7.1
sha20.11.0
shlex2.0.1
signal-hook-registry1.4.8
signature2.2.0
simd-adler320.3.10
simd_cesu81.2.0
simdutf80.1.5
slab0.4.12
smallvec1.15.2
socket20.6.5
spin0.9.9
sqlite-wasm-rs0.5.5build script, not run
stable_deref_trait1.2.1
strsim0.11.1
strum0.27.2
strum_macros0.27.2proc macro
subtle2.6.1
syn2.0.119
syn3.0.4
sync_wrapper1.0.2
synstructure0.13.2
tar0.4.46
tempfile3.27.0
thiserror2.0.20build script
thiserror-impl2.0.20proc macro
time0.3.55
time-core0.1.9
time-macros0.2.32proc macro
tinystr0.8.4
tinyvec1.12.0
tinyvec_macros0.1.1
tokio1.53.1
tokio-macros2.7.2proc macro
tokio-rustls0.26.4
tokio-util0.7.19
tower0.5.3
tower-http0.6.11
tower-layer0.3.3
tower-service0.3.3
tracing0.1.44
tracing-attributes0.1.31proc macro
tracing-core0.1.36
try-lock0.2.5
typenum1.20.1
unicase2.9.0
unicode-ident1.0.24
unicode-normalization0.1.25
unicode-xid0.2.6
untrusted0.7.1
untrusted0.9.0
ureq3.4.0
ureq-proto0.6.1
url2.5.8
utf8-zero0.8.1
utf8_iter1.0.4
utoipa5.5.0
utoipa-gen5.5.0proc macro
vcpkg0.2.15prebuilt objects
walkdir2.5.0
want0.3.1
wasi0.11.1+wasi-snapshot-preview1
wasm-bindgen0.2.127build script, not run
wasm-bindgen-futures0.4.77
wasm-bindgen-macro0.2.127proc macro
wasm-bindgen-macro-support0.2.127
wasm-bindgen-shared0.2.127build script, not run
wasm-streams0.5.0
web-sys0.3.104
web-time1.1.0
webpki-root-certs1.0.9
webpki-roots1.0.9
winapi-util0.1.11
windows-core0.62.2
windows-implement0.60.2proc macro
windows-interface0.59.3proc macro
windows-link0.2.1
windows-result0.4.1
windows-strings0.5.1
windows-sys0.52.0
windows-sys0.61.2
windows-targets0.52.6
windows_aarch64_gnullvm0.52.6build script, not runprebuilt objects
windows_aarch64_msvc0.52.6build script, not runprebuilt objects
windows_i686_gnu0.52.6build script, not runprebuilt objects
windows_i686_gnullvm0.52.6build script, not runprebuilt objects
windows_i686_msvc0.52.6build script, not runprebuilt objects
windows_x86_64_gnu0.52.6build script, not runprebuilt objects
windows_x86_64_gnullvm0.52.6build script, not runprebuilt objects
windows_x86_64_msvc0.52.6build script, not runprebuilt objects
writeable0.6.4
x509-parser0.18.1
xattr1.6.1
yasna0.6.0
yoke0.8.3
yoke-derive0.8.2proc macro
zerofrom0.1.8
zerofrom-derive0.1.7proc macro
zeroize1.9.0
zeroize_derive1.5.0proc macro
zerotrie0.2.5
zerovec0.11.8
zerovec-derive0.11.6proc macro
zmij1.0.23build script

Versions1

Raw data

capture
995 KB
records
182,965
bytes per record
5.4

Loading a sample of the capture

Want to see more? E-mail us at hello@bitbison.io about your use case.

1 of 1 jobs captured: build-test success · Generated 2026-11-06 · run 966588ae-976c-48bb-b5a7-4a2a092704fb

analysis 0.1.0 · 2026-11-06 · 4346b99 · graph v2

Bitbison's review

bux-serve's dependencies download prebuilt e2fsprogs libraries and a bubblewrap binary without hash or signature verification

Conclusion
unverified-download
Covers
0.9.0
Reviewed by
Bitbison
Updated
2026-11-06

Compiling bux-serve fetches prebuilt e2fsprogs static libraries (linked in) and a bubblewrap binary (executed at runtime) from the project's GitHub releases, pinned only by version, with no hash or signature check.

Indicators

hosts
github.comrelease-assets.githubusercontent.com
files
libext2fs.alibcom_err.alibe2p.alibuuid_e2fs.alibcreate_inode.abwrap
processes

What was examined

0.9.0
sha256:2982ee5268f972f3343dfb6ee3a90a6644228ef142a1a58b5e87e3c2b01027ff

Links