Skip to content
Open-Source Registry

cargo / spicedb-embedded-sys

spicedb-embedded-sys 0.8.0

bitbison: flagged, behavior flagged, dependencies clean, posture not checked, pipeline clean, 1 of 1 jobs captured RiskhighVulnsnone
processes
270
operations
22K
packages
291
compiler runs
67
connections
3
job time
30s
capture
282 KB
records
39K
bytes / record
7.2

FFI and native library for SpiceDB C shared library (builds from Go or downloads prebuilt)

Build behaviourits build script reached github.com, release-assets.githubusercontent.comits build script ran curlundeclared fetchlinked a downloaded binaryfetched outside crates.io

1,723 downloads · Apache-2.0 · source · home page ffinativespicedb View on crates.io

Graph

object-provenance · high · in libspicedb_embedded_sys.rlib
3

Checks

12 of 14 clear Network activity Data flow analysis
Build behavior▲✓✓✓✓▲✓✓
Supply chain✓✓✓✓✓
Pipeline✓

Detections

2
  • Uncompiled library linked
    libspicedb.so › github.com, release-assets.githubusercontent.com
    high
  • Build script reached github.com +1
    spicedb-embedded-sys 0.8.0 › github.com:443, release-assets.githubusercontent.com:443
    medium

Detection

highwitnessed

Uncompiled library linked

Object file origin needs review

Subject
/home/runner/work/spicedb-embedded/spicedb-embedded/target/release/build/spicedb-embedded-sys-1326e5682d0e1c05/out/libspicedb.sowritten by tar
Destination
github.com, release-assets.githubusercontent.com
Jobs
build-test
Rule
object-provenance · spicedb-embedded

Witness chain

  1. github.com:443
    source
  2. /home/runner/work/spicedb-embedded/spicedb-embedded/target/release/build/spicedb-embedded-sys-1326e5682d0e1c05/out/libspicedb.tar.gzvia curl -L -f -s -o /home/runner/work/spicedb-embedded/spicedb-embedded/target/release/build/spicedb-embedded-sys-1326e5682d0e1c05/out/libspicedb.tar.gz https://gi
  3. pipevia gzip -d
  4. /home/runner/work/spicedb-embedded/spicedb-embedded/target/release/build/spicedb-embedded-sys-1326e5682d0e1c05/out/libspicedb.sovia tar -xzf /home/runner/work/spicedb-embedded/spicedb-embedded/target/release/build/spicedb-embedded-sys-1326e5682d0e1c05/out/libspicedb.tar.gz -C /home/runner/wo
    • Object written under a build script that downloadedfrom github.com · release-assets.githubusercontent.comby build-script-build

      written under the build script at /home/runner/work/spicedb-embedded/spicedb-embedded/target/release/build/spicedb-embedded-sys-e79589d1911c8d41/build_script_build-e79589d1911c8d41, which downloaded from github.com, release-assets.githubusercontent.com

    • Obfuscated toolchain bypass

      Written by tar from a pipe without a recorded source compilation

    • Asked for by the build's own declaration

      spicedb-embedded-sys asked the linker for it: dynamic spicedb (target/release/build/spicedb-embedded-sys-1326e5682d0e1c05/output)

    subject
  5. dependency
    artifact

Evidence

  • written under the build script at /home/runner/work/spicedb-embedded/spicedb-embedded/target/release/build/spicedb-embedded-sys-e79589d1911c8d41/build_script_build-e79589d1911c8d41, which downloaded from github.com, release-assets.githubusercontent.com
  • Written by tar from a pipe without a recorded source compilation
  • spicedb-embedded-sys asked the linker for it: dynamic spicedb (target/release/build/spicedb-embedded-sys-1326e5682d0e1c05/output)

In libspicedb_embedded_sys.rlib

Loading the graph

Processes

build-test

cargo›cargo›build-script-build›tar

Ran
tar -xzf /home/runner/work/spicedb-embedded/spicedb-embedded/target/release/build/spicedb-embedded-sys-1326e5682d0e1c05/out/libspicedb.tar.gz -C /home/runner/wo…
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 4 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2468
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2468
  3. build-script-build/home/runner/work/spicedb-embedded/spicedb-embedded/target/release/build/spicedb-embedded-sys-e79589d1911c8d41/build-script-build3787
  4. tartar -xzf /home/runner/work/spicedb-embedded/spicedb-embedded/target/release/build/spicedb-embedded-sys-1326e5682d0e1c05/out/libspicedb.tar.gz -C /home/runner/wo…3803

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Detection

mediumwitnessed

Build script reached github.com +1

Unexpected network connection

Subject
spicedb-embedded-sys 0.8.0
Destination
github.com:443, release-assets.githubusercontent.com:443
Reaches
Jobs
build-test
Rule
egress

Evidence

  1. Connection outside the process’s allowed destinationscause

    connection to github.com:443, opened by curl

    subject github.com:443

    by curl -L -f -s -o /home/runner/work/spicedb-embedded/spicedb-embedded/target/release/build/spicedb-embedded-sys-1326e5682d0e1c05/out/libspicedb.tar.gz https://gi…

  2. Connection outside the process’s allowed destinationscause

    connection to release-assets.githubusercontent.com:443, opened by curl

    subject release-assets.githubusercontent.com:443

    by curl -L -f -s -o /home/runner/work/spicedb-embedded/spicedb-embedded/target/release/build/spicedb-embedded-sys-1326e5682d0e1c05/out/libspicedb.tar.gz https://gi…

  3. What a build script's fetch becamesupport

    1 file came down; nothing the build compiled, linked or ran

  4. Connection opened by a build script or child processsupport

    the opener descends from the build script at /home/runner/work/spicedb-embedded/spicedb-embedded/target/release/build/spicedb-embedded-sys-e79589d1911c8d41/build_script_build-e79589d1911c8d41

  5. Tool commandsupport

    Command: curl -L -f -s -o /home/runner/work/spicedb-embedded/spicedb-embedded/target/release/build/spicedb-embedded-sys-1326e5682d0e1c05/out/libspicedb.tar.gz https://gi…

    by curl -L -f -s -o /home/runner/work/spicedb-embedded/spicedb-embedded/target/release/build/spicedb-embedded-sys-1326e5682d0e1c05/out/libspicedb.tar.gz https://gi…

In libspicedb_embedded_sys.rlib

Loading the graph

Processes

build-test

cargo›cargo›build-script-build›curl

Ran
curl -L -f -s -o /home/runner/work/spicedb-embedded/spicedb-embedded/target/release/build/spicedb-embedded-sys-1326e5682d0e1c05/out/libspicedb.tar.gz https://gi…
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 4 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2468
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2468
  3. build-script-build/home/runner/work/spicedb-embedded/spicedb-embedded/target/release/build/spicedb-embedded-sys-e79589d1911c8d41/build-script-build3787
  4. curlcurl -L -f -s -o /home/runner/work/spicedb-embedded/spicedb-embedded/target/release/build/spicedb-embedded-sys-1326e5682d0e1c05/out/libspicedb.tar.gz https://gi…3791

Remediation

The build script connected to the network while compiling. Nothing it downloaded was compiled, linked or run. Build the crate from what the registry ships, or accept the download after reviewing it.

Network

3 peers
  • github.com:443 spicedb-embedded-sys's own build code · curl · GitHub, Inc. · 1 file undeclared
  • release-assets.githubusercontent.com:443 spicedb-embedded-sys's own build code · curl · Fastly, Inc. · 1 file undeclared
  • static.crates.io:8080 the package manager · cargo (spicedb-embedded) via crates.io · 6,328 files · went into an output ecosystem
Dependencies294Build behaviour
aho-corasick1.1.4
anyhow1.0.103build script
async-trait0.1.89proc macro
atomic-waker1.1.2
axum0.8.9
axum-core0.5.6
base640.22.1
bitflags2.13.0
bytes1.12.0
cfg-if1.0.4
either1.16.0
equivalent1.0.2
errno0.3.14
fastrand2.4.1
fixedbitset0.5.7
fnv1.0.7
foldhash0.1.5
futures-channel0.3.32
futures-core0.3.32
futures-sink0.3.32
futures-task0.3.32
futures-util0.3.32
getrandom0.4.3build script
h20.4.20
hashbrown0.15.5
hashbrown0.17.1
heck0.5.0
http1.4.2
http-body1.0.1
http-body-util0.1.3
httparse1.10.1build script
httpdate1.0.3
hyper1.10.1
hyper-timeout0.5.2
hyper-util0.1.20
indexmap2.14.0
itertools0.14.0
itoa1.0.18
ld-linux-x86-64.so.2system library
libc0.2.186build script
libc.so.6system library
libgcc_s.so.1system library
libm.so.6system library
libmvec.so.1system library
linux-raw-sys0.12.1
log0.4.33
matchit0.8.4
memchr2.8.2
mime0.3.17
mio1.2.1
multimap0.10.1
once_cell1.21.4
percent-encoding2.3.2
petgraph0.8.3
pin-project1.1.13
pin-project-internal1.1.13proc macro
pin-project-lite0.2.17
prettyplease0.2.37build script
proc-macro21.0.106build script
prost0.14.4
prost-build0.14.4
prost-derive0.14.4proc macro
prost-types0.14.4
pulldown-cmark0.13.4build script
pulldown-cmark-to-cmark22.0.0
quote1.0.46build script
r-efi6.0.0
regex1.12.4
regex-automata0.4.14
regex-syntax0.8.11
rustix1.1.4build script
same-file1.0.6
serde_core1.0.229build script
serde_derive1.0.229proc macro
slab0.4.12
smallvec1.15.2
socket20.6.4
spicedb-grpc-tonic1.0.0build script
syn2.0.118
syn3.0.2
sync_wrapper1.0.2
tempfile3.27.0
tokio1.53.1
tokio-macros2.7.0proc macro
tokio-stream0.1.19
tokio-util0.7.18
tonic0.14.6
tonic-build0.14.6
tonic-prost0.14.6
tonic-prost-build0.14.6
tower0.5.3
tower-layer0.3.3
tower-service0.3.3
tracing0.1.44
tracing-attributes0.1.31proc macro
tracing-core0.1.36
try-lock0.2.5
unicase2.9.0
unicode-ident1.0.24
walkdir2.5.0
want0.3.1
wasi0.11.1+wasi-snapshot-preview1
winapi-util0.1.11
windows-link0.2.1
windows-sys0.59.0
windows-sys0.61.2
windows-targets0.52.6
windows_aarch64_gnullvm0.52.6build script, not runprebuilt objects
windows_aarch64_msvc0.52.6build script, not runprebuilt objects
windows_i686_gnu0.52.6build script, not runprebuilt objects
windows_i686_gnullvm0.52.6build script, not runprebuilt objects
windows_i686_msvc0.52.6build script, not runprebuilt objects
windows_x86_64_gnu0.52.6build script, not runprebuilt objects
windows_x86_64_gnullvm0.52.6build script, not runprebuilt objects
windows_x86_64_msvc0.52.6build script, not runprebuilt objects
buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/gov1.36.11-20260415201107-50325440f8f2.1
buf.build/gen/go/gogo/protobuf/protocolbuffers/gov1.36.10-20240617172848-e1dbca2775a7.1
buf.build/gen/go/prometheus/prometheus/protocolbuffers/gov1.36.10-20251118093737-4105057cc7d4.1
buf.build/go/protovalidatev1.1.3
cel.dev/exprv0.25.2
cloud.google.com/gov0.123.0
cloud.google.com/go/authv0.20.0
cloud.google.com/go/auth/oauth2adaptv0.2.8
cloud.google.com/go/compute/metadatav0.9.0
cloud.google.com/go/iamv1.7.0
cloud.google.com/go/longrunningv0.9.0
cloud.google.com/go/monitoringv1.26.0
cloud.google.com/go/spannerv1.89.0
filippo.io/edwards25519v1.1.1
github.com/antlr4-go/antlr/v4v4.13.1
github.com/authzed/authzed-gov1.10.0
github.com/authzed/cel-gov0.20.2
github.com/authzed/consistentv0.2.0
github.com/authzed/ctxkeyv0.0.0-20250226155515-d49f99185584
github.com/authzed/grpcutilv0.0.0-20240123194739-2ea1e3d2d98b
github.com/authzed/jitterbugv0.0.0-20260128162915-e97d76daaa24
github.com/authzed/spicedbv1.56.0
github.com/aws/aws-sdk-go-v2v1.40.1
github.com/aws/aws-sdk-go-v2/configv1.32.3
github.com/aws/aws-sdk-go-v2/credentialsv1.19.3
github.com/aws/aws-sdk-go-v2/feature/ec2/imdsv1.18.15
github.com/aws/aws-sdk-go-v2/feature/rds/authv1.6.15
github.com/aws/aws-sdk-go-v2/internal/configsourcesv1.4.15
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2v2.7.15
github.com/aws/aws-sdk-go-v2/internal/iniv1.8.4
github.com/aws/aws-sdk-go-v2/service/internal/accept-encodingv1.13.4
github.com/aws/aws-sdk-go-v2/service/internal/presigned-urlv1.13.15
github.com/aws/aws-sdk-go-v2/service/signinv1.0.3
github.com/aws/aws-sdk-go-v2/service/ssov1.30.6
github.com/aws/aws-sdk-go-v2/service/ssooidcv1.35.11
github.com/aws/aws-sdk-go-v2/service/stsv1.41.3
github.com/aws/smithy-gov1.24.0
github.com/benbjohnson/clockv1.3.5
github.com/beorn7/perksv1.0.1
github.com/bits-and-blooms/bitsetv1.24.4
github.com/bits-and-blooms/bloom/v3v3.7.1
github.com/caio/go-tdigest/v4v4.1.0
github.com/ccoveille/go-safecast/v2v2.0.0
github.com/cenkalti/backoff/v5v5.0.3
github.com/certifi/gocertifiv0.0.0-20210507211836-431795d63e8d
github.com/cespare/xxhash/v2v2.3.0
github.com/cloudspannerecosystem/spanner-change-streams-tailv0.3.1
github.com/cncf/xds/gov0.0.0-20260202195803-dba9d589def2
github.com/creasty/defaultsv1.8.0
github.com/dalzilio/ruddv1.1.1-0.20230806153452-9e08a6ea8170
github.com/davecgh/go-spewv1.1.2-0.20180830191138-d8f796af33cc
github.com/dustin/go-humanizev1.0.1
github.com/emirpasic/godsv1.18.1
github.com/envoyproxy/go-control-plane/envoyv1.37.0
github.com/envoyproxy/protoc-gen-validatev1.3.3
github.com/exaring/otelpgxv0.9.3
github.com/fatih/colorv1.19.0
github.com/felixge/fgprofv0.9.5
github.com/felixge/httpsnoopv1.0.4
github.com/fsnotify/fsnotifyv1.9.0
github.com/go-errors/errorsv1.5.1
github.com/go-jose/go-jose/v4v4.1.4
github.com/go-logr/logrv1.4.3
github.com/go-logr/stdrv1.2.2
github.com/go-logr/zerologrv1.2.3
github.com/go-sql-driver/mysqlv1.9.3
github.com/go-viper/mapstructure/v2v2.5.0
github.com/golang/snappyv1.0.0
github.com/google/cel-gov0.27.0
github.com/google/go-cmpv0.7.0
github.com/google/pprofv0.0.0-20260115054156-294ebfa9ad83
github.com/google/s2a-gov0.1.9
github.com/google/uuidv1.6.0
github.com/googleapis/enterprise-certificate-proxyv0.3.14
github.com/googleapis/gax-go/v2v2.21.0
github.com/GoogleCloudPlatform/grpc-gcp-go/grpcgcpv1.6.0
github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcpv1.33.0
github.com/grpc-ecosystem/go-grpc-middlewarev1.4.0
github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheusv1.1.0
github.com/grpc-ecosystem/go-grpc-middleware/v2v2.3.3
github.com/grpc-ecosystem/grpc-gateway/v2v2.29.0
github.com/hashicorp/go-immutable-radixv1.3.1
github.com/hashicorp/go-memdbv1.3.5
github.com/hashicorp/golang-lruv1.0.2
github.com/IBM/pgxpoolprometheusv1.1.2
github.com/inconshreveable/mousetrapv1.1.0
github.com/jackc/pgiov1.0.0
github.com/jackc/pgpassfilev1.0.0
github.com/jackc/pgservicefilev0.0.0-20240606120523-5a60cdf6a761
github.com/jackc/pgx-zerologv0.0.0-20230315001418-f978528409eb
github.com/jackc/pgx/v5v5.9.2
github.com/jackc/puddle/v2v2.2.2
github.com/joho/godotenvv1.5.1
github.com/jzelinskie/cobrautil/v2v2.0.0-20240819150235-f7fe73942d0f
github.com/jzelinskie/stringzv0.0.3
github.com/KimMachineGun/automemlimitv0.7.5
github.com/klauspost/compressv1.19.1
github.com/lann/builderv0.0.0-20180802200727-47ae307949d0
github.com/lann/psv0.0.0-20150810152359-62de8c46ede0
github.com/lithammer/fuzzysearchv1.1.8
github.com/Masterminds/semverv1.5.0
github.com/Masterminds/squirrelv1.5.4
github.com/mattn/go-colorablev0.1.14
github.com/mattn/go-isattyv0.0.22
github.com/maypok86/otter/v2v2.3.0
github.com/mitchellh/colorstringv0.0.0-20190213212951-d06e56a500db
github.com/mostynb/go-grpc-compressionv1.2.3
github.com/munnerz/goautonegv0.0.0-20191010083416-a7dc8b61c822
github.com/ngrok/sqlmwv0.0.0-20220520173518-97c9c04efc79
github.com/pbnjay/memoryv0.0.0-20210728143218-7b4eea64cf58
github.com/pelletier/go-toml/v2v2.3.0
github.com/planetscale/vtprotobufv0.6.1-0.20240917153116-6f2963f01587
github.com/pmezard/go-difflibv1.0.1-0.20181226105442-5d4384ee4fb2
github.com/prometheus/client_golangv1.24.1
github.com/prometheus/client_modelv0.6.2
github.com/prometheus/commonv0.70.1
github.com/prometheus/otlptranslatorv1.0.0
github.com/prometheus/procfsv0.21.1
github.com/puzpuzpuz/xsync/v4v4.2.0
github.com/rivo/unisegv0.4.7
github.com/rs/corsv1.11.1
github.com/rs/xidv1.6.0
github.com/rs/zerologv1.34.0
github.com/sagikazarmark/locaferov0.12.0
github.com/samber/lov1.53.0
github.com/samber/slog-commonv0.19.0
github.com/samber/slog-zerolog/v2v2.9.0
github.com/schollz/progressbar/v3v3.19.0
github.com/sean-/sysexitsv1.0.0
github.com/shopspring/decimalv1.4.0
github.com/spf13/aferov1.15.0
github.com/spf13/castv1.10.0
github.com/spf13/cobrav1.10.2
github.com/spf13/pflagv1.0.10
github.com/spf13/viperv1.21.0
github.com/spiffe/go-spiffe/v2v2.7.0
github.com/stoewer/go-strcasev1.3.1
github.com/stretchr/testifyv1.11.1
github.com/subosito/gotenvv1.6.0
go.opencensus.iov0.24.0
go.opentelemetry.io/auto/sdkv1.2.1
go.opentelemetry.io/contrib/detectors/gcpv1.44.0
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpcv0.68.0
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttpv0.68.0
go.opentelemetry.io/contrib/propagators/b3v1.20.0
go.opentelemetry.io/contrib/propagators/otv1.20.0
go.opentelemetry.io/otelv1.44.0
go.opentelemetry.io/otel/exporters/otlp/otlptracev1.44.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpcv1.44.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttpv1.43.0
go.opentelemetry.io/otel/exporters/prometheusv0.62.0
go.opentelemetry.io/otel/metricv1.44.0
go.opentelemetry.io/otel/sdkv1.44.0
go.opentelemetry.io/otel/sdk/metricv1.44.0
go.opentelemetry.io/otel/tracev1.44.0
go.opentelemetry.io/proto/otlpv1.10.0
go.uber.org/atomicv1.11.0
go.uber.org/automaxprocsv1.6.0
go.uber.org/multierrv1.11.0
go.yaml.in/yaml/v3v3.0.4
golang.org/x/cryptov0.54.0
golang.org/x/expv0.0.0-20260410095643-746e56fc9e2f
golang.org/x/modv0.37.0
golang.org/x/netv0.57.0
golang.org/x/oauth2v0.36.0
golang.org/x/syncv0.22.0
golang.org/x/sysv0.47.0
golang.org/x/termv0.45.0
golang.org/x/textv0.40.0
golang.org/x/timev0.15.0
google.golang.org/apiv0.275.0
google.golang.org/genprotov0.0.0-20260406210006-6f92a3bedf2d
google.golang.org/genproto/googleapis/apiv0.0.0-20260526163538-3dc84a4a5aaa
google.golang.org/genproto/googleapis/rpcv0.0.0-20260526163538-3dc84a4a5aaa
google.golang.org/grpcv1.83.0
google.golang.org/protobufv1.36.11
gopkg.in/yaml.v3v3.0.1
k8s.io/utilsv0.0.0-20250604170112-4c0f3b243397
resenje.org/singleflightv0.4.3
Versions19RiskVulnsPublished
0.7.1not analyzed2026-07-07
0.7.0not analyzed2026-04-06
0.6.2not analyzed2026-04-02
0.6.1not analyzed2026-03-14
0.6.0not analyzed2026-02-25
0.5.2not analyzed2026-02-23
0.5.1not analyzed2026-02-23
0.5.0not analyzed2026-02-23
0.4.3not analyzed2026-02-22
0.4.2not analyzed2026-02-22
0.4.1not analyzed2026-02-22
0.3.9not analyzed2026-02-17
0.3.8not analyzed2026-02-16
0.3.7not analyzed2026-02-16
0.3.5not analyzed2026-02-15
0.3.3not analyzed2026-02-15
0.2.6not analyzed2026-02-13
0.2.5not analyzed2026-02-13
0.8.0highnone

Raw data

capture
282 KB
records
39,173
bytes per record
7.2

Loading a sample of the capture

Want to see more? E-mail us at hello@bitbison.io about your use case.

1 of 1 jobs captured: build-test success · Generated 2026-10-17 · run 2afe2e83-5fad-4145-8a6b-b14a11df5dcf

analysis 0.1.0 · 2026-10-17 · 0abbde9 · graph v2