Build script reached github.com +1
Unexpected network connection
- Subject
- reactor-webrtc-sys 0.23.0
- Destination
- github.com:443, release-assets.githubusercontent.com:443
- Reaches
- Jobs
- build-test
- Rule
- egress
Evidence
Connection outside the process’s allowed destinationscause
connection to github.com:443, opened by curl
subject github.com:443
by curl -fsSL --retry 3 -o /home/runner/work/reactor-webrtc/reactor-webrtc/target/release/build/reactor-webrtc-sys-166cb6a15b1693a9/out/prebuilt.sha256 https://git…
Connection outside the process’s allowed destinationscause
connection to release-assets.githubusercontent.com:443, opened by curl
subject release-assets.githubusercontent.com:443
by curl -fsSL --retry 3 -o /home/runner/work/reactor-webrtc/reactor-webrtc/target/release/build/reactor-webrtc-sys-166cb6a15b1693a9/out/prebuilt.sha256 https://git…
What a build script's fetch becamesupport
1 file came down; nothing the build compiled, linked or ran
Connection opened by a build script or child processsupport
the opener descends from the build script at /home/runner/work/reactor-webrtc/reactor-webrtc/target/release/build/reactor-webrtc-sys-63a2d81ab6496084/build_script_build-63a2d81ab6496084
Build script fetched what its crate documents it fetchessupport
reactor-webrtc-sys's build script fetches a prebuilt libwebrtc from github.com, release-assets.githubusercontent.com: reactor-webrtc-sys's build.rs curls a prebuilt libwebrtc from its GitHub release (observed on the registry, 2026-10-06)
Tool commandsupport
Command: curl -fsSL --retry 3 -o /home/runner/work/reactor-webrtc/reactor-webrtc/target/release/build/reactor-webrtc-sys-166cb6a15b1693a9/out/prebuilt.sha256 https://git…
by curl -fsSL --retry 3 -o /home/runner/work/reactor-webrtc/reactor-webrtc/target/release/build/reactor-webrtc-sys-166cb6a15b1693a9/out/prebuilt.sha256 https://git…
Processes
build-test
cargo›cargo›build-script-build›curl
- Ran
- curl -fsSL --retry 3 -o /home/runner/work/reactor-webrtc/reactor-webrtc/target/release/build/reactor-webrtc-sys-166cb6a15b1693a9/out/prebuilt.sha256 https://git…
- Invoked by
- cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 4 processes
- cargocargo build --release --locked --message-format=json-render-diagnostics2448
- cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2448
- build-script-build/home/runner/work/reactor-webrtc/reactor-webrtc/target/release/build/reactor-webrtc-sys-63a2d81ab6496084/build-script-build2518
- curlcurl -fsSL --retry 3 -o /home/runner/work/reactor-webrtc/reactor-webrtc/target/release/build/reactor-webrtc-sys-166cb6a15b1693a9/out/prebuilt.sha256 https://git…2521
Remediation
The crate's build script reached the network at compile time, outside the registry's checksums. Build it from what the registry ships (the crate's own environment variable or from-source feature), or record the download as accepted once it is reviewed.
