Build script reached github.com +1
Unexpected network connection
- Subject
- reactor-webrtc-sys 0.22.1
- Destination
- github.com:443, release-assets.githubusercontent.com:443
- Reaches
- Jobs
- build-test
- Rule
- egress
Evidence
Connection outside the process’s allowed destinationscause
connection to github.com:443, opened by curl
subject github.com:443
by curl -fsSL --retry 3 -o /home/runner/work/reactor-webrtc/reactor-webrtc/target/release/build/reactor-webrtc-sys-1f432a8d647c4efb/out/prebuilt.sha256 https://git…
Connection outside the process’s allowed destinationscause
connection to release-assets.githubusercontent.com:443, opened by curl
subject release-assets.githubusercontent.com:443
by curl -fsSL --retry 3 -o /home/runner/work/reactor-webrtc/reactor-webrtc/target/release/build/reactor-webrtc-sys-1f432a8d647c4efb/out/prebuilt.sha256 https://git…
Connection opened by a build script or child processsupport
the opener descends from the build script at /home/runner/work/reactor-webrtc/reactor-webrtc/target/release/build/reactor-webrtc-sys-774e9f601776196b/build_script_build-774e9f601776196b
Build script fetched what its crate documents it fetchessupport
reactor-webrtc-sys's build script fetches a prebuilt libwebrtc from github.com, release-assets.githubusercontent.com: reactor-webrtc-sys's build.rs curls a prebuilt libwebrtc from its GitHub release (observed on the registry, 2026-10-06)
Tool commandsupport
Command: curl -fsSL --retry 3 -o /home/runner/work/reactor-webrtc/reactor-webrtc/target/release/build/reactor-webrtc-sys-1f432a8d647c4efb/out/prebuilt.sha256 https://git…
by curl -fsSL --retry 3 -o /home/runner/work/reactor-webrtc/reactor-webrtc/target/release/build/reactor-webrtc-sys-1f432a8d647c4efb/out/prebuilt.sha256 https://git…
Processes
build-test
cargo›cargo›build-script-build›curl
- Ran
- curl -fsSL --retry 3 -o /home/runner/work/reactor-webrtc/reactor-webrtc/target/release/build/reactor-webrtc-sys-1f432a8d647c4efb/out/prebuilt.sha256 https://git…
- Invoked by
- cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 4 processes
- cargocargo build --release --locked --message-format=json-render-diagnostics2501
- cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2515
- build-script-build/home/runner/work/reactor-webrtc/reactor-webrtc/target/release/build/reactor-webrtc-sys-774e9f601776196b/build-script-build2720
- curlcurl -fsSL --retry 3 -o /home/runner/work/reactor-webrtc/reactor-webrtc/target/release/build/reactor-webrtc-sys-1f432a8d647c4efb/out/prebuilt.sha256 https://git…2723
Remediation
The crate's build script reached the network at compile time, outside the registry's checksums. Build it from what the registry ships (the crate's own environment variable or from-source feature), or record the download as accepted once it is reviewed.
