Skip to content
Open-Source Registry

cargo / car-whisper / 0.57.4

car-whisper 0.57.4

bitbison: flagged, behavior flagged, dependencies clean, posture notes, pipeline clean, 1 of 1 jobs captured 1 detection1 note
processes
530
operations
43K
packages
176
compiler runs
137
connections
1
job time
1m 44s
capture
503 KB
records
75K
bytes / record
6.7

Build behaviourcompiled C/C++

run f6227de3-9d99-4cb6-a9d3-7e4fe16f6f3d · built 2026-10-12 · complete

Artifact

file · retained · product · graph v2
1

Checks

13 of 15 clear Build script activity Binary hardening
Build behavior✓✓✓✓▲✓✓✓
Supply chain✓✓✓✓✓
Build hardening▲
Pipeline✓

Detections

2
  • Build script looked up repository state
    whisper-rs-sys 0.13.1
    low
  • Build is missing recommended hardening flags
    whisper.cpp · posture
    low

Detection

lowwitnessed

Build script looked up repository state

Unexpected build script activity

Subject
whisper-rs-sys 0.13.1
Jobs
build-test
Rule
buildscript · car

Evidence

  1. Build script read outside its cratecause

    The script read 2 workspace files outside its crate and allowed build directories (2 under .git/).

    by /home/runner/work/car/car/target/release/build/whisper-rs-sys-a3414d395875248f/build-script-build

  2. File read by the build scriptsupport

    read: /home/runner/work/car/car/.git/objects/47/0a4da1a6935d9cda0c295e8f6fdb7bdeaeb9aa

    input /home/runner/work/car/car/.git/objects/47/0a4da1a6935d9cda0c295e8f6fdb7bdeaeb9aa

  3. File read by the build scriptsupport

    read: /home/runner/work/car/car/.git/objects/82/b1bc6434317dd8ad3d73953527be2c4873349f

    input /home/runner/work/car/car/.git/objects/82/b1bc6434317dd8ad3d73953527be2c4873349f

  4. Build scriptcontext

    build script: /home/runner/work/car/car/target/release/build/whisper-rs-sys-a3414d395875248f/build_script_build-a3414d395875248f — readers: git

    subject build-script-build

Remediation

Review the listed files and the crate's build.rs. Remove unnecessary reads, or use a reviewed dependency version.

Detection

lowinferredposture

Build is missing recommended hardening flags

Missing hardening flags

Subject
/home/runner/work/car/car/target/release/build/whisper-rs-sys-d3e533a5e7b7c185/out/whisper.cpp
Jobs
build-test
Rule
hardening · target/release/build/whisper-rs-sys-d3e533a5e7b7c185/out/whisper.cpp

Evidence

  1. Hardening flag missingcause

    stack-protector: missing from all 16 eligible compile commands; add -fstack-protector-strong

  2. Hardening flag missingcause

    fortify: missing from all 16 eligible compile commands; add -D_FORTIFY_SOURCE=2 (needs -O1+)

  3. Hardening flag missingcause

    stack-clash-protection: missing from all 16 eligible compile commands; add -fstack-clash-protection

  4. Hardening flag missingcause

    pie: missing from all 16 eligible compile commands; add -fPIE (with -pie at link)

  5. Hardening flag missingcause

    cf-protection: missing from all 16 eligible compile commands; add -fcf-protection=full (x86-64) / -mbranch-protection=standard (aarch64)

  6. Hardening flag missingcause

    format-security: missing from all 16 eligible compile commands; add -Wformat -Werror=format-security

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/car/car/target/release/build/whisper-rs-sys-a3414d395875248f/build-script-build
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 3 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2460
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2460
  3. build-script-build/home/runner/work/car/car/target/release/build/whisper-rs-sys-a3414d395875248f/build-script-build3980

Remediation

Enable the listed flags for supported targets, rebuild, and verify the resulting compile commands.

Network

1 peers
  • static.crates.io:8080 the package manager · cargo (car) via crates.io · 9,724 files · went into an output ecosystem
Dependencies181Build behaviour
aho-corasick1.1.5
atomic-waker1.1.2
autocfg1.5.1
base640.22.1
bindgen0.71.1build script
bitflags2.13.1
block-buffer0.10.4
bumpalo3.20.3
bytes1.12.1
cc1.4.4
cexpr0.6.0
cfg-if1.0.4
cfg_aliases0.2.2
chacha200.10.2
clang-sys1.9.1build script
cmake0.1.58
cpufeatures0.2.17
cpufeatures0.3.1
crypto-common0.1.7
digest0.10.7
dirs6.0.0
dirs-sys0.5.0
displaydoc0.2.7proc macro
either1.18.0
find-msvc-tools0.1.11
form_urlencoded1.2.2
fs_extra1.3.0
futures-channel0.3.34
futures-core0.3.34
futures-io0.3.34
futures-sink0.3.34
futures-task0.3.34
futures-util0.3.34
generic-array0.14.7build script
getrandom0.2.17
getrandom0.4.3build script, not run
glob0.3.4
hound3.5.1
http1.5.0
http-body1.1.0
http-body-util0.1.5
httparse1.10.1build script
hyper1.11.1
hyper-rustls0.27.9
hyper-util0.1.20
icu_collections2.3.0
icu_locale_core2.3.0
icu_normalizer2.3.0
icu_normalizer_data2.3.0build script
icu_properties2.3.0
icu_properties_data2.3.0build script
icu_provider2.3.1
idna1.1.0
idna_adapter1.2.2
ipnet2.12.1
itertools0.13.0
itoa1.0.18
js-sys0.3.104
ld-linux-x86-64.so.2system library
libc0.2.189build script
libc.so.6system library
libgcc_s.so.1system library
libloading0.8.9
libm.so.6system library
libmvec.so.1system library
libredox0.1.21
litemap0.8.3
log0.4.34
lru-slab0.1.2
memchr2.8.3
minimal-lexical0.2.1
mio1.2.2
nom7.1.3
num-complex0.4.6
num-integer0.1.47
num-traits0.2.19build script
once_cell1.21.4
option-ext0.2.0
percent-encoding2.3.2
pin-project-lite0.2.17
potential_utf0.1.6
prettyplease0.2.37build script
primal-check0.3.4
proc-macro21.0.107build script
quinn0.11.11build script, not run
quinn-proto0.11.17
quinn-udp0.5.15build script, not run
quote1.0.47build script
r-efi6.0.0
rand0.10.2
rand_core0.10.1
rand_pcg0.10.2
realfft3.5.0
redox_users0.5.2
regex1.13.1
regex-automata0.4.18
regex-syntax0.8.11
reqwest0.12.28
ring0.17.14build scriptprebuilt objects
rubato0.15.0
rustc-hash2.1.3
rustfft6.4.1
rustls0.23.45build script
rustls-pki-types1.15.1
rustls-webpki0.103.15
rustversion1.0.23build script, not runproc macro
ryu1.0.23
serde1.0.229build script
serde_core1.0.229build script
serde_derive1.0.229proc macro
serde_json1.0.151build script
serde_urlencoded0.7.1
sha20.10.9
shlex1.3.0
shlex2.0.1
slab0.4.12
smallvec1.15.2
socket20.6.5
stable_deref_trait1.2.1
strength_reduce0.2.4
subtle2.6.1
syn2.0.119
syn3.0.4
sync_wrapper1.0.2
synstructure0.13.2
thiserror2.0.20build script
thiserror-impl2.0.20proc macro
tinystr0.8.4
tinyvec1.12.0
tinyvec_macros0.1.1
tokio1.53.1
tokio-rustls0.26.4
tower0.5.3
tower-http0.6.11
tower-layer0.3.3
tower-service0.3.3
tracing0.1.44
tracing-attributes0.1.31proc macro
tracing-core0.1.36
transpose0.2.3
try-lock0.2.5
typenum1.20.1
unicode-ident1.0.24
untrusted0.9.0
url2.5.8
utf8_iter1.0.4
version_check0.9.5
want0.3.1
wasi0.11.1+wasi-snapshot-preview1
wasm-bindgen0.2.127build script, not run
wasm-bindgen-futures0.4.77
wasm-bindgen-macro0.2.127proc macro
wasm-bindgen-macro-support0.2.127
wasm-bindgen-shared0.2.127build script, not run
web-sys0.3.104
web-time1.1.0
webpki-roots1.0.9
whisper-rs0.14.4build script
whisper-rs-sys0.13.1build scriptruns toolsgit
windows-link0.2.1
windows-sys0.52.0
windows-sys0.61.2
windows-targets0.52.6
windows_aarch64_gnullvm0.52.6build script, not runprebuilt objects
windows_aarch64_msvc0.52.6build script, not runprebuilt objects
windows_i686_gnu0.52.6build script, not runprebuilt objects
windows_i686_gnullvm0.52.6build script, not runprebuilt objects
windows_i686_msvc0.52.6build script, not runprebuilt objects
windows_x86_64_gnu0.52.6build script, not runprebuilt objects
windows_x86_64_gnullvm0.52.6build script, not runprebuilt objects
windows_x86_64_msvc0.52.6build script, not runprebuilt objects
writeable0.6.4
yoke0.8.3
yoke-derive0.8.2proc macro
zerofrom0.1.8
zerofrom-derive0.1.7proc macro
zeroize1.9.0
zerotrie0.2.5
zerovec0.11.8
zerovec-derive0.11.6proc macro
zmij1.0.23build script

Raw data

capture
503 KB
records
75,208
bytes per record
6.7

Loading a sample of the capture

Want to see more? E-mail us at hello@bitbison.io about your use case.

1 of 1 jobs captured: build-test success · Generated 2026-10-12 · run f6227de3-9d99-4cb6-a9d3-7e4fe16f6f3d

analysis 0.1.0 · 2026-10-11 · d6246d3 · graph v2