Skip to content
Open-Source Registry

cargo / spicedb-embedded

spicedb-embedded 0.8.0

bitbison: flagged, behavior flagged, dependencies clean, posture not checked, pipeline clean, 1 of 1 jobs captured RiskhighVulnsnone
processes
325
operations
109K
packages
261
compiler runs
77
connections
4
job time
2m 57s
capture
1.6 MB
records
208K
bytes / record
7.8

Embedded SpiceDB for Rust - embedded authorization using the standard gRPC API

Build behaviourhas a build scriptundeclared fetchlinked a downloaded binaryfetched outside crates.iocompiled C/C++

1,872 downloads · Apache-2.0 · source · home page access-controlauthorizationfine-grainedspicedbzanzibar View on crates.io

Graph

object-provenance · high · in libspicedb_embedded.rlib
3

Checks

12 of 14 clear Network activity Data flow analysis
Build behavior▲✓✓✓✓▲✓✓
Supply chain✓✓✓✓✓
Pipeline✓

Detections

2
  • Uncompiled library linked
    libspicedb.so › github.com, release-assets.githubusercontent.com
    high
  • Build script reached github.com +1
    spicedb-embedded-sys 0.8.0 › github.com:443, release-assets.githubusercontent.com:443
    medium

Detection

highwitnessed

Uncompiled library linked

Object file origin needs review

Subject
/home/runner/work/spicedb-embedded/spicedb-embedded/target/release/build/spicedb-embedded-sys-ddf0ae07d2b5bc2e/out/libspicedb.sowritten by tar
Destination
github.com, release-assets.githubusercontent.com
Jobs
build-test
Rule
object-provenance · spicedb-embedded

Witness chain

  1. github.com:443
    source
  2. /home/runner/work/spicedb-embedded/spicedb-embedded/target/release/build/spicedb-embedded-sys-ddf0ae07d2b5bc2e/out/libspicedb.tar.gzvia curl -L -f -s -o /home/runner/work/spicedb-embedded/spicedb-embedded/target/release/build/spicedb-embedded-sys-ddf0ae07d2b5bc2e/out/libspicedb.tar.gz https://gi
  3. pipevia gzip -d
  4. /home/runner/work/spicedb-embedded/spicedb-embedded/target/release/build/spicedb-embedded-sys-ddf0ae07d2b5bc2e/out/libspicedb.sovia tar -xzf /home/runner/work/spicedb-embedded/spicedb-embedded/target/release/build/spicedb-embedded-sys-ddf0ae07d2b5bc2e/out/libspicedb.tar.gz -C /home/runner/wo
    • Object written under a build script that downloadedfrom github.com · release-assets.githubusercontent.comby build-script-build

      written under the build script at /home/runner/work/spicedb-embedded/spicedb-embedded/target/release/build/spicedb-embedded-sys-4a0596cc8c361922/build_script_build-4a0596cc8c361922, which downloaded from github.com, release-assets.githubusercontent.com

    • Obfuscated toolchain bypass

      Written by tar from a pipe without a recorded source compilation

    • Asked for by the build's own declaration

      spicedb-embedded-sys asked the linker for it: dynamic spicedb (target/release/build/spicedb-embedded-sys-ddf0ae07d2b5bc2e/output)

    subject
  5. dependency
    artifact

Evidence

  • written under the build script at /home/runner/work/spicedb-embedded/spicedb-embedded/target/release/build/spicedb-embedded-sys-4a0596cc8c361922/build_script_build-4a0596cc8c361922, which downloaded from github.com, release-assets.githubusercontent.com
  • Written by tar from a pipe without a recorded source compilation
  • spicedb-embedded-sys asked the linker for it: dynamic spicedb (target/release/build/spicedb-embedded-sys-ddf0ae07d2b5bc2e/output)

In libspicedb_embedded.rlib

Loading the graph

Processes

build-test

cargo›cargo›build-script-build›tar

Ran
tar -xzf /home/runner/work/spicedb-embedded/spicedb-embedded/target/release/build/spicedb-embedded-sys-ddf0ae07d2b5bc2e/out/libspicedb.tar.gz -C /home/runner/wo…
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 4 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2513
  2. cargo/home/runner/.rustup/toolchains/1.91.1-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2513
  3. build-script-build/home/runner/work/spicedb-embedded/spicedb-embedded/target/release/build/spicedb-embedded-sys-4a0596cc8c361922/build-script-build4124
  4. tartar -xzf /home/runner/work/spicedb-embedded/spicedb-embedded/target/release/build/spicedb-embedded-sys-ddf0ae07d2b5bc2e/out/libspicedb.tar.gz -C /home/runner/wo…4139

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Detection

mediumwitnessed

Build script reached github.com +1

Unexpected network connection

Subject
spicedb-embedded-sys 0.8.0
Destination
github.com:443, release-assets.githubusercontent.com:443
Reaches
Jobs
build-test
Rule
egress

Evidence

  1. Connection outside the process’s allowed destinationscause

    connection to github.com:443, opened by curl

    subject github.com:443

    by curl -L -f -s -o /home/runner/work/spicedb-embedded/spicedb-embedded/target/release/build/spicedb-embedded-sys-ddf0ae07d2b5bc2e/out/libspicedb.tar.gz https://gi…

  2. Connection outside the process’s allowed destinationscause

    connection to release-assets.githubusercontent.com:443, opened by curl

    subject release-assets.githubusercontent.com:443

    by curl -L -f -s -o /home/runner/work/spicedb-embedded/spicedb-embedded/target/release/build/spicedb-embedded-sys-ddf0ae07d2b5bc2e/out/libspicedb.tar.gz https://gi…

  3. What a build script's fetch becamesupport

    1 file came down; nothing the build compiled, linked or ran

  4. Connection opened by a build script or child processsupport

    the opener descends from the build script at /home/runner/work/spicedb-embedded/spicedb-embedded/target/release/build/spicedb-embedded-sys-4a0596cc8c361922/build_script_build-4a0596cc8c361922

  5. Tool commandsupport

    Command: curl -L -f -s -o /home/runner/work/spicedb-embedded/spicedb-embedded/target/release/build/spicedb-embedded-sys-ddf0ae07d2b5bc2e/out/libspicedb.tar.gz https://gi…

    by curl -L -f -s -o /home/runner/work/spicedb-embedded/spicedb-embedded/target/release/build/spicedb-embedded-sys-ddf0ae07d2b5bc2e/out/libspicedb.tar.gz https://gi…

In libspicedb_embedded.rlib

Loading the graph

Processes

build-test

cargo›cargo›build-script-build›curl

Ran
curl -L -f -s -o /home/runner/work/spicedb-embedded/spicedb-embedded/target/release/build/spicedb-embedded-sys-ddf0ae07d2b5bc2e/out/libspicedb.tar.gz https://gi…
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 4 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2513
  2. cargo/home/runner/.rustup/toolchains/1.91.1-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2513
  3. build-script-build/home/runner/work/spicedb-embedded/spicedb-embedded/target/release/build/spicedb-embedded-sys-4a0596cc8c361922/build-script-build4124
  4. curlcurl -L -f -s -o /home/runner/work/spicedb-embedded/spicedb-embedded/target/release/build/spicedb-embedded-sys-ddf0ae07d2b5bc2e/out/libspicedb.tar.gz https://gi…4131

Remediation

The build script connected to the network while compiling. Nothing it downloaded was compiled, linked or run. Build the crate from what the registry ships, or accept the download after reviewing it.

Network

4 peers
  • github.com:443 build code of spicedb-embedded-sys · curl · GitHub, Inc. · 1 file undeclared
  • release-assets.githubusercontent.com:443 build code of spicedb-embedded-sys · curl · Fastly, Inc. · 1 file undeclared
  • static.crates.io:8080 the package manager · cargo (spicedb-embedded) via crates.io · 16,707 files · went into an output ecosystem
  • static.rust-lang.org:443 the toolchain installer · rustup (spicedb-embedded) via Package registries profile (rustup → asn:54113) · Fastly, Inc. · 13 files ecosystem
Dependencies275Build behaviour
aho-corasick1.1.4
android_system_properties0.1.5
anyhow1.0.103build script
astral-tokio-tar0.6.3
async-stream0.3.6
async-stream-impl0.3.6proc macro
async-trait0.1.89proc macro
atomic-waker1.1.2
autocfg1.5.1
axum0.8.9
axum-core0.5.6
base640.22.1
bitflags2.13.0
bollard0.20.2
bollard-buildkit-proto0.7.0build script
bollard-stubs1.52.1-rc.29.1.3
bs580.5.1
bumpalo3.20.3
bytes1.12.0
cc1.2.66
cfg-if1.0.4
chacha200.10.1
chrono0.4.45
core-foundation0.10.1
core-foundation-sys0.8.7
cpufeatures0.3.0
darling0.23.0
darling_core0.23.0
darling_macro0.23.0proc macro
deranged0.5.8
displaydoc0.2.6proc macro
docker_credential1.4.0
dyn-clone1.0.20
either1.16.0
equivalent1.0.2
errno0.3.14
etcetera0.11.0
fastrand2.4.1
ferroid2.0.0
find-msvc-tools0.1.9
fixedbitset0.5.7
fnv1.0.7
foldhash0.1.5
form_urlencoded1.2.2
futures0.3.32
futures-channel0.3.32
futures-core0.3.32
futures-executor0.3.32
futures-io0.3.32
futures-macro0.3.32proc macro
futures-sink0.3.32
futures-task0.3.32
futures-util0.3.32
getrandom0.2.17
getrandom0.3.4build script
getrandom0.4.3build script
h20.4.20
hashbrown0.12.3
hashbrown0.15.5
hashbrown0.17.1
heck0.5.0
hex0.4.3
home0.5.12
http1.4.2
http-body1.0.1
http-body-util0.1.3
httparse1.10.1build script
httpdate1.0.3
hyper1.10.1
hyper-named-pipe0.1.0
hyper-rustls0.27.9
hyper-timeout0.5.2
hyper-util0.1.20
hyperlocal0.9.1
iana-time-zone0.1.65
iana-time-zone-haiku0.1.2build script, not run
icu_collections2.2.0
icu_locale_core2.2.0
icu_normalizer2.2.0
icu_normalizer_data2.2.0build script
icu_properties2.2.0
icu_properties_data2.2.0build script
icu_provider2.2.0
ident_case1.0.1
idna1.1.0
idna_adapter1.2.2
indexmap1.9.3build script, not run
indexmap2.14.0
itertools0.14.0
itoa1.0.18
js-sys0.3.103
ld-linux-x86-64.so.2system library
libc0.2.186build script
libc.so.6system library
libgcc_s.so.1system library
libm.so.6system library
libmvec.so.1system library
linux-raw-sys0.12.1
linux-raw-sys0.4.15
litemap0.8.2
lock_api0.4.14
log0.4.33
matchit0.8.4
memchr2.8.2
mime0.3.17
mio1.2.1
multimap0.10.1
num0.4.3
num-bigint0.4.8
num-complex0.4.6
num-conv0.2.2
num-integer0.1.46
num-iter0.1.45
num-rational0.4.2
num-traits0.2.19build script
once_cell1.21.4
openssl-probe0.2.1
parking_lot0.12.5
parking_lot_core0.9.12build script
parse-display0.9.1
parse-display-derive0.9.1proc macro
percent-encoding2.3.2
petgraph0.8.3
pin-project1.1.13
pin-project-internal1.1.13proc macro
pin-project-lite0.2.17
portable-atomic1.13.1build script
potential_utf0.1.5
powerfmt0.2.0
ppv-lite860.2.21
prettyplease0.2.37build script
proc-macro21.0.106build script
prost0.14.4
prost-build0.14.4
prost-derive0.14.4proc macro
prost-types0.14.4
pulldown-cmark0.13.4build script
pulldown-cmark-to-cmark22.0.0
quote1.0.46build script
r-efi5.3.0
r-efi6.0.0
rand0.10.2
rand0.9.4
rand_chacha0.9.0
rand_core0.10.1
rand_core0.9.5
redox_syscall0.5.18
ref-cast1.0.25build script, not run
ref-cast-impl1.0.25proc macro
regex1.12.4
regex-automata0.4.14
regex-syntax0.8.11
ring0.17.14build scriptprebuilt objects
rustc-hash2.1.3
rustix0.38.44build script
rustix1.1.4build script
rustls0.23.46build script
rustls-native-certs0.8.4
rustls-pki-types1.15.0
rustls-webpki0.103.15
rustversion1.0.22build script, not runproc macro
ryu1.0.23
same-file1.0.6
schannel0.1.29
schemars0.9.0
schemars1.2.1
scopeguard1.2.0
security-framework3.7.0
security-framework-sys2.17.0
serde1.0.229build script
serde_core1.0.229build script
serde_derive1.0.229proc macro
serde_json1.0.151build script
serde_repr0.1.20proc macro
serde_urlencoded0.7.1
serde_with3.21.0
serde_with_macros3.21.0proc macro
serial_test3.5.0
serial_test_derive3.5.0proc macro
shlex2.0.1
signal-hook-registry1.4.8
slab0.4.12
smallvec1.15.2
socket20.6.4
spicedb-embedded-sys0.8.0build scriptnetworkruns toolsgithub.com, release-assets.githubusercontent.com, curl
spicedb-grpc-tonic1.0.0build script
stable_deref_trait1.2.1
strsim0.11.1
structmeta0.3.0
structmeta-derive0.3.0proc macro
subtle2.6.1
syn2.0.118
syn3.0.2
sync_wrapper1.0.2
synstructure0.13.2
tempfile3.27.0
testcontainers0.27.3
testcontainers-modules0.15.0
thiserror2.0.20build script
thiserror-impl2.0.20proc macro
time0.3.53
time-core0.1.9
time-macros0.2.31proc macro
tinystr0.8.3
tinyvec1.11.0
tinyvec_macros0.1.1
tokio1.53.1
tokio-macros2.7.0proc macro
tokio-rustls0.26.4
tokio-stream0.1.19
tokio-util0.7.18
tonic0.14.6
tonic-build0.14.6
tonic-prost0.14.6
tonic-prost-build0.14.6
tower0.5.3
tower-layer0.3.3
tower-service0.3.3
tracing0.1.44
tracing-attributes0.1.31proc macro
tracing-core0.1.36
try-lock0.2.5
unicase2.9.0
unicode-ident1.0.24
untrusted0.9.0
ureq3.3.0
ureq-proto0.6.0
url2.5.8
utf8-zero0.8.1
utf8_iter1.0.4
walkdir2.5.0
want0.3.1
wasi0.11.1+wasi-snapshot-preview1
wasip21.0.4+wasi-0.2.12
wasm-bindgen0.2.126build script, not run
wasm-bindgen-macro0.2.126proc macro
wasm-bindgen-macro-support0.2.126
wasm-bindgen-shared0.2.126build script, not run
web-time1.1.0
winapi0.3.9build script, not run
winapi-i686-pc-windows-gnu0.4.0build script, not runprebuilt objects
winapi-util0.1.11
winapi-x86_64-pc-windows-gnu0.4.0build script, not runprebuilt objects
windows-core0.62.2
windows-implement0.60.2proc macro
windows-interface0.59.3proc macro
windows-link0.2.1
windows-result0.4.1
windows-strings0.5.1
windows-sys0.52.0
windows-sys0.59.0
windows-sys0.61.2
windows-targets0.52.6
windows_aarch64_gnullvm0.52.6build script, not runprebuilt objects
windows_aarch64_msvc0.52.6build script, not runprebuilt objects
windows_i686_gnu0.52.6build script, not runprebuilt objects
windows_i686_gnullvm0.52.6build script, not runprebuilt objects
windows_i686_msvc0.52.6build script, not runprebuilt objects
windows_x86_64_gnu0.52.6build script, not runprebuilt objects
windows_x86_64_gnullvm0.52.6build script, not runprebuilt objects
windows_x86_64_msvc0.52.6build script, not runprebuilt objects
wit-bindgen0.57.1build script, not runprebuilt objects
writeable0.6.3
xattr1.6.1
yoke0.8.3
yoke-derive0.8.2proc macro
zerocopy0.8.53build script
zerocopy-derive0.8.53proc macro
zerofrom0.1.8
zerofrom-derive0.1.7proc macro
zeroize1.9.0
zerotrie0.2.4
zerovec0.11.6
zerovec-derive0.11.3proc macro
zmij1.0.21build script
Versions37RiskVulnsPublished
0.7.1not analyzed2026-07-07
0.7.0not analyzed2026-04-06
0.6.2not analyzed2026-04-02
0.6.1not analyzed2026-03-14
0.6.0not analyzed2026-02-25
0.5.2not analyzed2026-02-23
0.5.1not analyzed2026-02-23
0.4.3not analyzed2026-02-22
0.4.2not analyzed2026-02-22
0.3.9not analyzed2026-02-17
0.3.8not analyzed2026-02-16
0.3.7not analyzed2026-02-16
0.3.5not analyzed2026-02-15
0.2.6not analyzed2026-02-13
0.2.5not analyzed2026-02-13
0.2.0not analyzed2026-02-12
0.1.21not analyzed2026-02-12
0.1.20not analyzed2026-02-12
0.1.18not analyzed2026-02-12
0.1.17not analyzed2026-02-12
0.1.16not analyzed2026-02-12
0.1.15not analyzed2026-02-12
0.1.14not analyzed2026-02-12
0.1.13not analyzed2026-02-11
0.1.12not analyzed2026-02-11
0.1.11not analyzed2026-02-11
0.1.10not analyzed2026-02-11
0.1.9not analyzed2026-02-11
0.1.8not analyzed2026-02-11
0.1.7not analyzed2026-02-11
0.1.5not analyzed2026-02-10
0.1.4not analyzed2026-02-10
0.1.3not analyzed2026-02-10
0.1.2not analyzed2026-02-10
0.1.1not analyzed2026-02-10
0.1.0not analyzed2026-02-10
0.8.0highnone

Raw data

capture
1.6 MB
records
208,151
bytes per record
7.8

Loading a sample of the capture

Want to see more? E-mail us at hello@bitbison.io about your use case.

1 of 1 jobs captured: build-test success · Generated 2026-10-17 · run 9a3cd1ca-29ee-4d27-980a-91d58e47622f

analysis 0.1.0 · 2026-10-17 · 0abbde9 · graph v2