Skip to content
Open-Source Registry

cargo / shiguredo_dav1d / 2026.4.0-canary.0

shiguredo_dav1d 2026.4.0-canary.0

bitbison: flagged, behavior flagged, dependencies clean, posture not checked, pipeline clean, 1 of 1 jobs captured RiskhighVulnsnone
processes
374
operations
9.2K
packages
38
compiler runs
27
connections
3
job time
21s
capture
126 KB
records
16K
bytes / record
7.8

Build behaviourits build script reached github.com, release-assets.githubusercontent.comits build script ran curlundeclared fetchlinked a downloaded binaryfetched outside crates.io

run d46c2df1-2629-4835-90a8-48cf819b593f · built 2026-10-17 · complete View on crates.io

Graph

object-provenance · high · in libshiguredo_dav1d.rlib
3

Checks

12 of 14 clear Network activity Data flow analysis
Build behavior▲✓✓✓✓▲✓✓
Supply chain✓✓✓✓✓
Pipeline✓

Detections

4
  • Uncompiled library linked
    libaom.a › github.com, release-assets.githubusercontent.com
    high
  • Uncompiled library linked
    libdav1d.a › github.com, release-assets.githubusercontent.com
    high
  • Uncompiled library linked
    libSvtAv1Enc.a › github.com, release-assets.githubusercontent.com
    high
  • Build script reached github.com +1
    shiguredo_dav1d 2026.4.0-canary.0 › github.com:443, release-assets.githubusercontent.com:443
    medium

Detection

highwitnessed

Uncompiled library linked

Object file origin needs review

Subject
/home/runner/work/dav1d-rs/dav1d-rs/target/release/build/shiguredo_aom-1ea6692a4c5716fe/out/lib/libaom.awritten by build_script_build-26d04c0101f4b077
Destination
github.com, release-assets.githubusercontent.com
Jobs
build-test
Rule
object-provenance · dav1d-rs

Witness chain

  1. /home/runner/work/dav1d-rs/dav1d-rs/target/release/build/shiguredo_aom-1ea6692a4c5716fe/out/prebuilt/lib/libaom.avia tar xzf /home/runner/work/dav1d-rs/dav1d-rs/target/release/build/shiguredo_aom-1ea6692a4c5716fe/out/prebuilt.tar.gz -C /home/runner/work/dav1d-rs/dav1d-rs/targe
    source
  2. /home/runner/work/dav1d-rs/dav1d-rs/target/release/build/shiguredo_aom-1ea6692a4c5716fe/out/lib/libaom.avia /home/runner/work/dav1d-rs/dav1d-rs/target/release/build/shiguredo_aom-26d04c0101f4b077/build-script-build
    • Object written under a build script that downloadedfrom github.com · release-assets.githubusercontent.com

      written under the build script at /home/runner/work/dav1d-rs/dav1d-rs/target/release/build/shiguredo_aom-26d04c0101f4b077/build_script_build-26d04c0101f4b077, which downloaded from github.com, release-assets.githubusercontent.com

    • Obfuscated toolchain bypassfrom libaom.aby tar

      copied input /home/runner/work/dav1d-rs/dav1d-rs/target/release/build/shiguredo_aom-1ea6692a4c5716fe/out/prebuilt/lib/libaom.a: Written by tar from a pipe without a recorded source compilation

    • Asked for by the build's own declaration

      shiguredo_aom asked the linker for it: static aom (target/release/build/shiguredo_aom-1ea6692a4c5716fe/output)

    subject

Evidence

  • written under the build script at /home/runner/work/dav1d-rs/dav1d-rs/target/release/build/shiguredo_aom-26d04c0101f4b077/build_script_build-26d04c0101f4b077, which downloaded from github.com, release-assets.githubusercontent.com
  • copied input /home/runner/work/dav1d-rs/dav1d-rs/target/release/build/shiguredo_aom-1ea6692a4c5716fe/out/prebuilt/lib/libaom.a: Written by tar from a pipe without a recorded source compilation
  • shiguredo_aom asked the linker for it: static aom (target/release/build/shiguredo_aom-1ea6692a4c5716fe/output)

Processes

build-test

cargo›cargo›build-script-build›tar

Ran
tar xzf /home/runner/work/dav1d-rs/dav1d-rs/target/release/build/shiguredo_aom-1ea6692a4c5716fe/out/prebuilt.tar.gz -C /home/runner/work/dav1d-rs/dav1d-rs/targe…
Invoked by
cargo test --release --locked --no-fail-fast
Lineage · 4 processes
  1. cargocargo test --release --locked --no-fail-fast2910
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo test --release --locked --no-fail-fast3064
  3. build-script-build/home/runner/work/dav1d-rs/dav1d-rs/target/release/build/shiguredo_aom-26d04c0101f4b077/build-script-build3029
  4. tartar xzf /home/runner/work/dav1d-rs/dav1d-rs/target/release/build/shiguredo_aom-1ea6692a4c5716fe/out/prebuilt.tar.gz -C /home/runner/work/dav1d-rs/dav1d-rs/targe…3041

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Detection

highwitnessed

Uncompiled library linked

Object file origin needs review

Subject
/home/runner/work/dav1d-rs/dav1d-rs/target/release/build/shiguredo_dav1d-b40e519da1c51606/out/lib/libdav1d.awritten by build_script_build-059b4c2d24adefb1
Destination
github.com, release-assets.githubusercontent.com
Jobs
build-test
Rule
object-provenance · dav1d-rs

Witness chain

  1. github.com:443
    source
  2. /home/runner/work/dav1d-rs/dav1d-rs/target/release/build/shiguredo_dav1d-b40e519da1c51606/out/prebuilt.tar.gzvia curl -fsSL -o /home/runner/work/dav1d-rs/dav1d-rs/target/release/build/shiguredo_dav1d-b40e519da1c51606/out/prebuilt.tar.gz https://github.com/shiguredo/dav1d-r
  3. pipevia gzip -d
  4. /home/runner/work/dav1d-rs/dav1d-rs/target/release/build/shiguredo_dav1d-b40e519da1c51606/out/prebuilt/lib/libdav1d.avia tar xzf /home/runner/work/dav1d-rs/dav1d-rs/target/release/build/shiguredo_dav1d-b40e519da1c51606/out/prebuilt.tar.gz -C /home/runner/work/dav1d-rs/dav1d-rs/tar
  5. /home/runner/work/dav1d-rs/dav1d-rs/target/release/build/shiguredo_dav1d-b40e519da1c51606/out/lib/libdav1d.avia /home/runner/work/dav1d-rs/dav1d-rs/target/release/build/shiguredo_dav1d-059b4c2d24adefb1/build-script-build
    • Object written under a build script that downloadedfrom github.com · release-assets.githubusercontent.com

      written under the build script at /home/runner/work/dav1d-rs/dav1d-rs/target/release/build/shiguredo_dav1d-059b4c2d24adefb1/build_script_build-059b4c2d24adefb1, which downloaded from github.com, release-assets.githubusercontent.com

    • Obfuscated toolchain bypassfrom libdav1d.aby tar

      copied input /home/runner/work/dav1d-rs/dav1d-rs/target/release/build/shiguredo_dav1d-b40e519da1c51606/out/prebuilt/lib/libdav1d.a: Written by tar from a pipe without a recorded source compilation

    • Asked for by the build's own declaration

      shiguredo_dav1d asked the linker for it: static dav1d (target/release/build/shiguredo_dav1d-b40e519da1c51606/output)

    subject
  6. member
    artifact

Evidence

  • written under the build script at /home/runner/work/dav1d-rs/dav1d-rs/target/release/build/shiguredo_dav1d-059b4c2d24adefb1/build_script_build-059b4c2d24adefb1, which downloaded from github.com, release-assets.githubusercontent.com
  • copied input /home/runner/work/dav1d-rs/dav1d-rs/target/release/build/shiguredo_dav1d-b40e519da1c51606/out/prebuilt/lib/libdav1d.a: Written by tar from a pipe without a recorded source compilation
  • shiguredo_dav1d asked the linker for it: static dav1d (target/release/build/shiguredo_dav1d-b40e519da1c51606/output)

In libshiguredo_dav1d.rlib

Loading the graph

Processes

build-test

cargo›cargo›build-script-build›tar

Ran
tar xzf /home/runner/work/dav1d-rs/dav1d-rs/target/release/build/shiguredo_dav1d-b40e519da1c51606/out/prebuilt.tar.gz -C /home/runner/work/dav1d-rs/dav1d-rs/tar…
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 4 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2465
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2465
  3. build-script-build/home/runner/work/dav1d-rs/dav1d-rs/target/release/build/shiguredo_dav1d-059b4c2d24adefb1/build-script-build2890
  4. tartar xzf /home/runner/work/dav1d-rs/dav1d-rs/target/release/build/shiguredo_dav1d-b40e519da1c51606/out/prebuilt.tar.gz -C /home/runner/work/dav1d-rs/dav1d-rs/tar…2898

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Detection

highwitnessed

Uncompiled library linked

Object file origin needs review

Subject
/home/runner/work/dav1d-rs/dav1d-rs/target/release/build/shiguredo_svt_av1-3f410aaddb7f1d26/out/lib/libSvtAv1Enc.awritten by build_script_build-13fc745ff6663d8a
Destination
github.com, release-assets.githubusercontent.com
Jobs
build-test
Rule
object-provenance · dav1d-rs

Witness chain

  1. github.com:443
    source
  2. /home/runner/work/dav1d-rs/dav1d-rs/target/release/build/shiguredo_svt_av1-3f410aaddb7f1d26/out/prebuilt/libSvtAv1Enc-ubuntu-26.04_x86_64.tar.gzvia curl -fsSL --retry 3 -o /home/runner/work/dav1d-rs/dav1d-rs/target/release/build/shiguredo_svt_av1-3f410aaddb7f1d26/out/prebuilt/libSvtAv1Enc-ubuntu-26.04_x86_6
  3. pipevia gzip -d
  4. /home/runner/work/dav1d-rs/dav1d-rs/target/release/build/shiguredo_svt_av1-3f410aaddb7f1d26/out/prebuilt/libSvtAv1Enc.avia tar -xzf /home/runner/work/dav1d-rs/dav1d-rs/target/release/build/shiguredo_svt_av1-3f410aaddb7f1d26/out/prebuilt/libSvtAv1Enc-ubuntu-26.04_x86_64.tar.gz -C /ho
  5. /home/runner/work/dav1d-rs/dav1d-rs/target/release/build/shiguredo_svt_av1-3f410aaddb7f1d26/out/lib/libSvtAv1Enc.avia /home/runner/work/dav1d-rs/dav1d-rs/target/release/build/shiguredo_svt_av1-13fc745ff6663d8a/build-script-build
    • Object written under a build script that downloadedfrom github.com · release-assets.githubusercontent.com

      written under the build script at /home/runner/work/dav1d-rs/dav1d-rs/target/release/build/shiguredo_svt_av1-13fc745ff6663d8a/build_script_build-13fc745ff6663d8a, which downloaded from github.com, release-assets.githubusercontent.com

    • Obfuscated toolchain bypassfrom libSvtAv1Enc.aby tar

      copied input /home/runner/work/dav1d-rs/dav1d-rs/target/release/build/shiguredo_svt_av1-3f410aaddb7f1d26/out/prebuilt/libSvtAv1Enc.a: Written by tar from a pipe without a recorded source compilation

    • Asked for by the build's own declaration

      shiguredo_svt_av1 asked the linker for it: static SvtAv1Enc (target/release/build/shiguredo_svt_av1-3f410aaddb7f1d26/output)

    subject

Evidence

  • written under the build script at /home/runner/work/dav1d-rs/dav1d-rs/target/release/build/shiguredo_svt_av1-13fc745ff6663d8a/build_script_build-13fc745ff6663d8a, which downloaded from github.com, release-assets.githubusercontent.com
  • copied input /home/runner/work/dav1d-rs/dav1d-rs/target/release/build/shiguredo_svt_av1-3f410aaddb7f1d26/out/prebuilt/libSvtAv1Enc.a: Written by tar from a pipe without a recorded source compilation
  • shiguredo_svt_av1 asked the linker for it: static SvtAv1Enc (target/release/build/shiguredo_svt_av1-3f410aaddb7f1d26/output)

Processes

build-test

cargo›cargo›build-script-build›tar

Ran
tar -xzf /home/runner/work/dav1d-rs/dav1d-rs/target/release/build/shiguredo_svt_av1-3f410aaddb7f1d26/out/prebuilt/libSvtAv1Enc-ubuntu-26.04_x86_64.tar.gz -C /ho…
Invoked by
cargo test --release --locked --no-fail-fast
Lineage · 4 processes
  1. cargocargo test --release --locked --no-fail-fast2910
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo test --release --locked --no-fail-fast3064
  3. build-script-build/home/runner/work/dav1d-rs/dav1d-rs/target/release/build/shiguredo_svt_av1-13fc745ff6663d8a/build-script-build3025
  4. tartar -xzf /home/runner/work/dav1d-rs/dav1d-rs/target/release/build/shiguredo_svt_av1-3f410aaddb7f1d26/out/prebuilt/libSvtAv1Enc-ubuntu-26.04_x86_64.tar.gz -C /ho…3044

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Detection

mediumwitnessed

Build script reached github.com +1

Unexpected network connection

Subject
shiguredo_dav1d 2026.4.0-canary.0
Destination
github.com:443, release-assets.githubusercontent.com:443
Reaches
Jobs
build-test
Rule
egress

Evidence

  1. Connection outside the process’s allowed destinationscause

    connection to github.com:443, opened by curl

    subject github.com:443

    by curl -fsSL -o /home/runner/work/dav1d-rs/dav1d-rs/target/release/build/shiguredo_dav1d-b40e519da1c51606/out/prebuilt.tar.gz https://github.com/shiguredo/dav1d-r…

  2. Connection outside the process’s allowed destinationscause

    connection to release-assets.githubusercontent.com:443, opened by curl

    subject release-assets.githubusercontent.com:443

    by curl -fsSL -o /home/runner/work/dav1d-rs/dav1d-rs/target/release/build/shiguredo_dav1d-b40e519da1c51606/out/prebuilt.tar.gz https://github.com/shiguredo/dav1d-r…

  3. What a build script's fetch becamesupport

    6 files came down; nothing the build compiled, linked or ran

  4. Connection opened by a build script or child processsupport

    the opener descends from the build script at /home/runner/work/dav1d-rs/dav1d-rs/target/release/build/shiguredo_dav1d-059b4c2d24adefb1/build_script_build-059b4c2d24adefb1

  5. Tool commandsupport

    Command: curl -fsSL -o /home/runner/work/dav1d-rs/dav1d-rs/target/release/build/shiguredo_dav1d-b40e519da1c51606/out/prebuilt.tar.gz https://github.com/shiguredo/dav1d-r…

    by curl -fsSL -o /home/runner/work/dav1d-rs/dav1d-rs/target/release/build/shiguredo_dav1d-b40e519da1c51606/out/prebuilt.tar.gz https://github.com/shiguredo/dav1d-r…

In libshiguredo_dav1d.rlib

Loading the graph

Processes

build-test

cargo›cargo›build-script-build›curl

Ran
curl -fsSL -o /home/runner/work/dav1d-rs/dav1d-rs/target/release/build/shiguredo_dav1d-b40e519da1c51606/out/prebuilt.tar.gz https://github.com/shiguredo/dav1d-r…
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 4 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2465
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2465
  3. build-script-build/home/runner/work/dav1d-rs/dav1d-rs/target/release/build/shiguredo_dav1d-059b4c2d24adefb1/build-script-build2890
  4. curlcurl -fsSL -o /home/runner/work/dav1d-rs/dav1d-rs/target/release/build/shiguredo_dav1d-b40e519da1c51606/out/prebuilt.tar.gz https://github.com/shiguredo/dav1d-r…2893

Remediation

The build script connected to the network while compiling. Nothing it downloaded was compiled, linked or run. Build the crate from what the registry ships, or accept the download after reviewing it.

Network

3 peers
  • github.com:443 shiguredo_dav1d's own build code · curl · GitHub, Inc. · 6 files undeclared
  • release-assets.githubusercontent.com:443 shiguredo_dav1d's own build code · curl · Fastly, Inc. · 6 files undeclared
  • static.crates.io:8080 the package manager · cargo (dav1d-rs) via crates.io · 1,738 files · went into an output ecosystem
Dependencies39Build behaviour
aho-corasick1.1.5
bindgen0.72.1build script
bitflags2.13.2
cc1.6.0
cexpr0.6.0
cfg-if1.0.5
clang-sys1.9.1build script
cmake0.1.58
either1.18.0
find-msvc-tools0.1.14
glob0.3.4
itertools0.13.0
ld-linux-x86-64.so.2system library
libc0.2.190build script
libc.so.6system library
libgcc_s.so.1system library
libloading0.8.9
libm.so.6system library
libmvec.so.1system library
log0.4.34
memchr2.8.3
minimal-lexical0.2.1
nom7.1.3
prettyplease0.2.37build script
proc-macro21.0.107build script
quote1.0.47build script
regex1.13.1
regex-automata0.4.18
regex-syntax0.8.11
rustc-hash2.1.3
shiguredo_aom2026.3.0build scriptnetworkruns toolsgithub.com, release-assets.githubusercontent.com, curl
shiguredo_cmake4.4.0build script
shiguredo_svt_av12026.2.0build scriptnetworkruns toolsgithub.com, release-assets.githubusercontent.com, curl
shiguredo_toml2026.2.0
shlex1.3.0
shlex2.0.1
syn2.0.119
unicode-ident1.0.26
windows-link0.2.1
Versions16RiskVulnsPublished
2026.3.0not analyzed2026-10-03
2026.2.0not analyzed2026-08-06
2026.2.0-canary.2not analyzed2026-07-31
2026.2.0-canary.1not analyzed2026-07-30
2026.2.0-canary.0not analyzed2026-06-15
2026.1.0not analyzed2026-03-31
2026.1.0-canary.4not analyzed2026-03-31
2026.1.0-canary.3not analyzed2026-03-27
2026.1.0-canary.2not analyzed2026-03-25
2026.1.0-canary.1not analyzed2026-03-24
2026.1.0-canary.0not analyzed2026-03-23
2025.1.0not analyzed2025-09-26
2025.1.0-canary.2not analyzed2025-09-02
2025.1.0-canary.1not analyzed2025-04-08
2025.1.0-canary.0not analyzed2025-04-02
2026.4.0-canary.0highnone

Raw data

capture
126 KB
records
16,173
bytes per record
7.8

Loading a sample of the capture

Want to see more? E-mail us at hello@bitbison.io about your use case.

1 of 1 jobs captured: build-test success · Generated 2026-10-17 · run d46c2df1-2629-4835-90a8-48cf819b593f

analysis 0.1.0 · 2026-10-16 · e987d53 · graph v2