Skip to content
Open-Source Registry

cargo / vizier / 0.13.0-rc.2

vizier 0.13.0-rc.2

bitbison: no public build not built
processes
825
operations
216K
packages
730
compiler runs
1,581
connections
5
job time
18m 07s
capture
2.4 MB
records
366K
bytes / record
6.7

Build behaviourhas a build scriptundeclared fetchfetch went into the outputlinked a downloaded binaryfetched outside crates.iocompiled C/C++

run 32a1ea06-68e0-4f40-8dbf-7068c6000fff · built 2026-10-16 · complete View on crates.io

This release did not build; nothing below stands for the package.

Graph

egress · high
15

Checks

11 of 14 clear Network activity Data flow analysis +1 more
Build behavior▲✓✓✓✓▲✓✓
Supply chain✓▲✓✓✓
Pipeline✓

Detections

17
  • Build script fetched what the build compiled, linked or ran
    sherpa-onnx-sys 1.13.3 › github.com:443, release-assets.githubusercontent.com:443
    high
  • Uncompiled library linked
    libespeak-ng.a › github.com, release-assets.githubusercontent.com
    high
  • Uncompiled library linked
    libkaldi-decoder-core.a › github.com, release-assets.githubusercontent.com
    high
  • Uncompiled library linked
    libkaldi-native-fbank-core.a › github.com, release-assets.githubusercontent.com
    high
  • Uncompiled library linked
    libkissfft-float.a › github.com, release-assets.githubusercontent.com
    high
  • Uncompiled library linked
    libonnxruntime.a › github.com, release-assets.githubusercontent.com
    high
  • Uncompiled library linked
    libpiper_phonemize.a › github.com, release-assets.githubusercontent.com
    high
  • Uncompiled library linked
    libsherpa-onnx-c-api.a › github.com, release-assets.githubusercontent.com
    high
  • Uncompiled library linked
    libsherpa-onnx-core.a › github.com, release-assets.githubusercontent.com
    high
  • Uncompiled library linked
    libsherpa-onnx-fst.a › github.com, release-assets.githubusercontent.com
    high
  • Uncompiled library linked
    libsherpa-onnx-fstfar.a › github.com, release-assets.githubusercontent.com
    high
  • Uncompiled library linked
    libsherpa-onnx-kaldifst-core.a › github.com, release-assets.githubusercontent.com
    high
  • Uncompiled library linked
    libssentencepiece_core.a › github.com, release-assets.githubusercontent.com
    high
  • Uncompiled library linked
    libucd.a › github.com, release-assets.githubusercontent.com
    high
  • Build script reached parcel.pyke.io
    ort-sys 2.0.0-rc.9 › parcel.pyke.io:443
    medium
  • Build script reached codeload.github.com +1
    utoipa-swagger-ui 10.0.1 › github.com:443, codeload.github.com:443
    medium
  • Prebuilt library downloaded by a build script from its documented source
    libonnxruntime.a › parcel.pyke.io
    medium

Detection

highwitnessed

Build script fetched what the build compiled, linked or ran

Unexpected network connection

Subject
sherpa-onnx-sys 1.13.3
Destination
github.com:443, release-assets.githubusercontent.com:443
Jobs
build-test
Rule
egress · vizier

Evidence

  1. Connection outside the process’s allowed destinationscause

    connection to github.com:443, opened by build-script-build

    subject github.com:443

    by /home/runner/work/vizier/vizier/target/release/build/sherpa-onnx-sys-28cf8fd34ceecfde/build-script-build

  2. Connection outside the process’s allowed destinationscause

    connection to release-assets.githubusercontent.com:443, opened by build-script-build

    subject release-assets.githubusercontent.com:443

    by /home/runner/work/vizier/vizier/target/release/build/sherpa-onnx-sys-28cf8fd34ceecfde/build-script-build

  3. What a build script's fetch becamesupport

    16 files came down; the build compiled or linked libespeak-ng.a, libsherpa-onnx-kaldifst-core.a, libsherpa-onnx-fst.a +10 more

  4. Connection opened by a build script or child processsupport

    the opener is the build script at /home/runner/work/vizier/vizier/target/release/build/sherpa-onnx-sys-28cf8fd34ceecfde/build-script-build

What came before it

Loading the graph

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/vizier/vizier/target/release/build/sherpa-onnx-sys-28cf8fd34ceecfde/build-script-build
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 3 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2479
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2479
  3. build-script-build/home/runner/work/vizier/vizier/target/release/build/sherpa-onnx-sys-28cf8fd34ceecfde/build-script-build11660

Remediation

A dependency's build downloaded files the build then compiled, linked or ran, outside anything the registry checksums. Review what came down, pin or replace the dependency, or record the download as accepted once it is reviewed.

Detection

highwitnessed

Uncompiled library linked

Object file origin needs review

Subject
/home/runner/work/vizier/vizier/target/sherpa-onnx-prebuilt/sherpa-onnx-v1.13.3-linux-x64-static-lib/lib/libespeak-ng.awritten by build-script-build
Destination
github.com, release-assets.githubusercontent.com
Jobs
build-test
Rule
object-provenance · vizier

Witness chain

  1. /home/runner/work/vizier/vizier/target/sherpa-onnx-prebuilt/sherpa-onnx-v1.13.3-linux-x64-static-lib/lib/libespeak-ng.avia /home/runner/work/vizier/vizier/target/release/build/sherpa-onnx-sys-28cf8fd34ceecfde/build-script-build
    • Object written under a build script that downloadedfrom github.com · release-assets.githubusercontent.com

      written under the build script at /home/runner/work/vizier/vizier/target/release/build/sherpa-onnx-sys-28cf8fd34ceecfde/build-script-build, which downloaded from github.com, release-assets.githubusercontent.com

    • Obfuscated toolchain bypass

      Written by build-script-build from a network connection without a recorded source compilation

    • Asked for by the build's own declaration

      sherpa-onnx-sys asked the linker for it: static espeak-ng (target/release/build/sherpa-onnx-sys-8b5f8caa2aff97d9/output)

    source

Evidence

  • written under the build script at /home/runner/work/vizier/vizier/target/release/build/sherpa-onnx-sys-28cf8fd34ceecfde/build-script-build, which downloaded from github.com, release-assets.githubusercontent.com
  • Written by build-script-build from a network connection without a recorded source compilation
  • sherpa-onnx-sys asked the linker for it: static espeak-ng (target/release/build/sherpa-onnx-sys-8b5f8caa2aff97d9/output)

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/vizier/vizier/target/release/build/sherpa-onnx-sys-28cf8fd34ceecfde/build-script-build
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 3 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2479
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2479
  3. build-script-build/home/runner/work/vizier/vizier/target/release/build/sherpa-onnx-sys-28cf8fd34ceecfde/build-script-build11660

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Detection

highwitnessed

Uncompiled library linked

Object file origin needs review

Subject
/home/runner/work/vizier/vizier/target/sherpa-onnx-prebuilt/sherpa-onnx-v1.13.3-linux-x64-static-lib/lib/libkaldi-decoder-core.awritten by build-script-build
Destination
github.com, release-assets.githubusercontent.com
Jobs
build-test
Rule
object-provenance · vizier

Witness chain

  1. /home/runner/work/vizier/vizier/target/sherpa-onnx-prebuilt/sherpa-onnx-v1.13.3-linux-x64-static-lib/lib/libkaldi-decoder-core.avia /home/runner/work/vizier/vizier/target/release/build/sherpa-onnx-sys-28cf8fd34ceecfde/build-script-build
    • Object written under a build script that downloadedfrom github.com · release-assets.githubusercontent.com

      written under the build script at /home/runner/work/vizier/vizier/target/release/build/sherpa-onnx-sys-28cf8fd34ceecfde/build-script-build, which downloaded from github.com, release-assets.githubusercontent.com

    • Obfuscated toolchain bypass

      Written by build-script-build from a network connection without a recorded source compilation

    • Asked for by the build's own declaration

      sherpa-onnx-sys asked the linker for it: static kaldi-decoder-core (target/release/build/sherpa-onnx-sys-8b5f8caa2aff97d9/output)

    source

Evidence

  • written under the build script at /home/runner/work/vizier/vizier/target/release/build/sherpa-onnx-sys-28cf8fd34ceecfde/build-script-build, which downloaded from github.com, release-assets.githubusercontent.com
  • Written by build-script-build from a network connection without a recorded source compilation
  • sherpa-onnx-sys asked the linker for it: static kaldi-decoder-core (target/release/build/sherpa-onnx-sys-8b5f8caa2aff97d9/output)

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/vizier/vizier/target/release/build/sherpa-onnx-sys-28cf8fd34ceecfde/build-script-build
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 3 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2479
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2479
  3. build-script-build/home/runner/work/vizier/vizier/target/release/build/sherpa-onnx-sys-28cf8fd34ceecfde/build-script-build11660

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Detection

highwitnessed

Uncompiled library linked

Object file origin needs review

Subject
/home/runner/work/vizier/vizier/target/sherpa-onnx-prebuilt/sherpa-onnx-v1.13.3-linux-x64-static-lib/lib/libkaldi-native-fbank-core.awritten by build-script-build
Destination
github.com, release-assets.githubusercontent.com
Jobs
build-test
Rule
object-provenance · vizier

Witness chain

  1. /home/runner/work/vizier/vizier/target/sherpa-onnx-prebuilt/sherpa-onnx-v1.13.3-linux-x64-static-lib/lib/libkaldi-native-fbank-core.avia /home/runner/work/vizier/vizier/target/release/build/sherpa-onnx-sys-28cf8fd34ceecfde/build-script-build
    • Object written under a build script that downloadedfrom github.com · release-assets.githubusercontent.com

      written under the build script at /home/runner/work/vizier/vizier/target/release/build/sherpa-onnx-sys-28cf8fd34ceecfde/build-script-build, which downloaded from github.com, release-assets.githubusercontent.com

    • Obfuscated toolchain bypass

      Written by build-script-build from a network connection without a recorded source compilation

    • Asked for by the build's own declaration

      sherpa-onnx-sys asked the linker for it: static kaldi-native-fbank-core (target/release/build/sherpa-onnx-sys-8b5f8caa2aff97d9/output)

    source

Evidence

  • written under the build script at /home/runner/work/vizier/vizier/target/release/build/sherpa-onnx-sys-28cf8fd34ceecfde/build-script-build, which downloaded from github.com, release-assets.githubusercontent.com
  • Written by build-script-build from a network connection without a recorded source compilation
  • sherpa-onnx-sys asked the linker for it: static kaldi-native-fbank-core (target/release/build/sherpa-onnx-sys-8b5f8caa2aff97d9/output)

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/vizier/vizier/target/release/build/sherpa-onnx-sys-28cf8fd34ceecfde/build-script-build
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 3 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2479
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2479
  3. build-script-build/home/runner/work/vizier/vizier/target/release/build/sherpa-onnx-sys-28cf8fd34ceecfde/build-script-build11660

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Detection

highwitnessed

Uncompiled library linked

Object file origin needs review

Subject
/home/runner/work/vizier/vizier/target/sherpa-onnx-prebuilt/sherpa-onnx-v1.13.3-linux-x64-static-lib/lib/libkissfft-float.awritten by build-script-build
Destination
github.com, release-assets.githubusercontent.com
Jobs
build-test
Rule
object-provenance · vizier

Witness chain

  1. /home/runner/work/vizier/vizier/target/sherpa-onnx-prebuilt/sherpa-onnx-v1.13.3-linux-x64-static-lib/lib/libkissfft-float.avia /home/runner/work/vizier/vizier/target/release/build/sherpa-onnx-sys-28cf8fd34ceecfde/build-script-build
    • Object written under a build script that downloadedfrom github.com · release-assets.githubusercontent.com

      written under the build script at /home/runner/work/vizier/vizier/target/release/build/sherpa-onnx-sys-28cf8fd34ceecfde/build-script-build, which downloaded from github.com, release-assets.githubusercontent.com

    • Obfuscated toolchain bypass

      Written by build-script-build from a network connection without a recorded source compilation

    • Asked for by the build's own declaration

      sherpa-onnx-sys asked the linker for it: static kissfft-float (target/release/build/sherpa-onnx-sys-8b5f8caa2aff97d9/output)

    source

Evidence

  • written under the build script at /home/runner/work/vizier/vizier/target/release/build/sherpa-onnx-sys-28cf8fd34ceecfde/build-script-build, which downloaded from github.com, release-assets.githubusercontent.com
  • Written by build-script-build from a network connection without a recorded source compilation
  • sherpa-onnx-sys asked the linker for it: static kissfft-float (target/release/build/sherpa-onnx-sys-8b5f8caa2aff97d9/output)

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/vizier/vizier/target/release/build/sherpa-onnx-sys-28cf8fd34ceecfde/build-script-build
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 3 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2479
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2479
  3. build-script-build/home/runner/work/vizier/vizier/target/release/build/sherpa-onnx-sys-28cf8fd34ceecfde/build-script-build11660

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Detection

highwitnessed

Uncompiled library linked

Object file origin needs review

Subject
/home/runner/work/vizier/vizier/target/sherpa-onnx-prebuilt/sherpa-onnx-v1.13.3-linux-x64-static-lib/lib/libonnxruntime.awritten by build-script-build
Destination
github.com, release-assets.githubusercontent.com
Jobs
build-test
Rule
object-provenance · vizier

Witness chain

  1. /home/runner/work/vizier/vizier/target/sherpa-onnx-prebuilt/sherpa-onnx-v1.13.3-linux-x64-static-lib/lib/libonnxruntime.avia /home/runner/work/vizier/vizier/target/release/build/sherpa-onnx-sys-28cf8fd34ceecfde/build-script-build
    • Object written under a build script that downloadedfrom github.com · release-assets.githubusercontent.com

      written under the build script at /home/runner/work/vizier/vizier/target/release/build/sherpa-onnx-sys-28cf8fd34ceecfde/build-script-build, which downloaded from github.com, release-assets.githubusercontent.com

    • Obfuscated toolchain bypass

      Written by build-script-build from a network connection without a recorded source compilation

    • Asked for by the build's own declaration

      sherpa-onnx-sys asked the linker for it: static onnxruntime (target/release/build/sherpa-onnx-sys-8b5f8caa2aff97d9/output)

    source

Evidence

  • written under the build script at /home/runner/work/vizier/vizier/target/release/build/sherpa-onnx-sys-28cf8fd34ceecfde/build-script-build, which downloaded from github.com, release-assets.githubusercontent.com
  • Written by build-script-build from a network connection without a recorded source compilation
  • sherpa-onnx-sys asked the linker for it: static onnxruntime (target/release/build/sherpa-onnx-sys-8b5f8caa2aff97d9/output)

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/vizier/vizier/target/release/build/sherpa-onnx-sys-28cf8fd34ceecfde/build-script-build
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 3 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2479
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2479
  3. build-script-build/home/runner/work/vizier/vizier/target/release/build/sherpa-onnx-sys-28cf8fd34ceecfde/build-script-build11660

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Detection

highwitnessed

Uncompiled library linked

Object file origin needs review

Subject
/home/runner/work/vizier/vizier/target/sherpa-onnx-prebuilt/sherpa-onnx-v1.13.3-linux-x64-static-lib/lib/libpiper_phonemize.awritten by build-script-build
Destination
github.com, release-assets.githubusercontent.com
Jobs
build-test
Rule
object-provenance · vizier

Witness chain

  1. /home/runner/work/vizier/vizier/target/sherpa-onnx-prebuilt/sherpa-onnx-v1.13.3-linux-x64-static-lib/lib/libpiper_phonemize.avia /home/runner/work/vizier/vizier/target/release/build/sherpa-onnx-sys-28cf8fd34ceecfde/build-script-build
    • Object written under a build script that downloadedfrom github.com · release-assets.githubusercontent.com

      written under the build script at /home/runner/work/vizier/vizier/target/release/build/sherpa-onnx-sys-28cf8fd34ceecfde/build-script-build, which downloaded from github.com, release-assets.githubusercontent.com

    • Obfuscated toolchain bypass

      Written by build-script-build from a network connection without a recorded source compilation

    • Asked for by the build's own declaration

      sherpa-onnx-sys asked the linker for it: static piper_phonemize (target/release/build/sherpa-onnx-sys-8b5f8caa2aff97d9/output)

    source

Evidence

  • written under the build script at /home/runner/work/vizier/vizier/target/release/build/sherpa-onnx-sys-28cf8fd34ceecfde/build-script-build, which downloaded from github.com, release-assets.githubusercontent.com
  • Written by build-script-build from a network connection without a recorded source compilation
  • sherpa-onnx-sys asked the linker for it: static piper_phonemize (target/release/build/sherpa-onnx-sys-8b5f8caa2aff97d9/output)

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/vizier/vizier/target/release/build/sherpa-onnx-sys-28cf8fd34ceecfde/build-script-build
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 3 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2479
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2479
  3. build-script-build/home/runner/work/vizier/vizier/target/release/build/sherpa-onnx-sys-28cf8fd34ceecfde/build-script-build11660

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Detection

highwitnessed

Uncompiled library linked

Object file origin needs review

Subject
/home/runner/work/vizier/vizier/target/sherpa-onnx-prebuilt/sherpa-onnx-v1.13.3-linux-x64-static-lib/lib/libsherpa-onnx-c-api.awritten by build-script-build
Destination
github.com, release-assets.githubusercontent.com
Jobs
build-test
Rule
object-provenance · vizier

Witness chain

  1. /home/runner/work/vizier/vizier/target/sherpa-onnx-prebuilt/sherpa-onnx-v1.13.3-linux-x64-static-lib/lib/libsherpa-onnx-c-api.avia /home/runner/work/vizier/vizier/target/release/build/sherpa-onnx-sys-28cf8fd34ceecfde/build-script-build
    • Object written under a build script that downloadedfrom github.com · release-assets.githubusercontent.com

      written under the build script at /home/runner/work/vizier/vizier/target/release/build/sherpa-onnx-sys-28cf8fd34ceecfde/build-script-build, which downloaded from github.com, release-assets.githubusercontent.com

    • Obfuscated toolchain bypass

      Written by build-script-build from a network connection without a recorded source compilation

    • Asked for by the build's own declaration

      sherpa-onnx-sys asked the linker for it: static sherpa-onnx-c-api (target/release/build/sherpa-onnx-sys-8b5f8caa2aff97d9/output)

    source

Evidence

  • written under the build script at /home/runner/work/vizier/vizier/target/release/build/sherpa-onnx-sys-28cf8fd34ceecfde/build-script-build, which downloaded from github.com, release-assets.githubusercontent.com
  • Written by build-script-build from a network connection without a recorded source compilation
  • sherpa-onnx-sys asked the linker for it: static sherpa-onnx-c-api (target/release/build/sherpa-onnx-sys-8b5f8caa2aff97d9/output)

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/vizier/vizier/target/release/build/sherpa-onnx-sys-28cf8fd34ceecfde/build-script-build
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 3 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2479
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2479
  3. build-script-build/home/runner/work/vizier/vizier/target/release/build/sherpa-onnx-sys-28cf8fd34ceecfde/build-script-build11660

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Detection

highwitnessed

Uncompiled library linked

Object file origin needs review

Subject
/home/runner/work/vizier/vizier/target/sherpa-onnx-prebuilt/sherpa-onnx-v1.13.3-linux-x64-static-lib/lib/libsherpa-onnx-core.awritten by build-script-build
Destination
github.com, release-assets.githubusercontent.com
Jobs
build-test
Rule
object-provenance · vizier

Witness chain

  1. /home/runner/work/vizier/vizier/target/sherpa-onnx-prebuilt/sherpa-onnx-v1.13.3-linux-x64-static-lib/lib/libsherpa-onnx-core.avia /home/runner/work/vizier/vizier/target/release/build/sherpa-onnx-sys-28cf8fd34ceecfde/build-script-build
    • Object written under a build script that downloadedfrom github.com · release-assets.githubusercontent.com

      written under the build script at /home/runner/work/vizier/vizier/target/release/build/sherpa-onnx-sys-28cf8fd34ceecfde/build-script-build, which downloaded from github.com, release-assets.githubusercontent.com

    • Obfuscated toolchain bypass

      Written by build-script-build from a network connection without a recorded source compilation

    • Asked for by the build's own declaration

      sherpa-onnx-sys asked the linker for it: static sherpa-onnx-core (target/release/build/sherpa-onnx-sys-8b5f8caa2aff97d9/output)

    source

Evidence

  • written under the build script at /home/runner/work/vizier/vizier/target/release/build/sherpa-onnx-sys-28cf8fd34ceecfde/build-script-build, which downloaded from github.com, release-assets.githubusercontent.com
  • Written by build-script-build from a network connection without a recorded source compilation
  • sherpa-onnx-sys asked the linker for it: static sherpa-onnx-core (target/release/build/sherpa-onnx-sys-8b5f8caa2aff97d9/output)

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/vizier/vizier/target/release/build/sherpa-onnx-sys-28cf8fd34ceecfde/build-script-build
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 3 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2479
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2479
  3. build-script-build/home/runner/work/vizier/vizier/target/release/build/sherpa-onnx-sys-28cf8fd34ceecfde/build-script-build11660

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Detection

highwitnessed

Uncompiled library linked

Object file origin needs review

Subject
/home/runner/work/vizier/vizier/target/sherpa-onnx-prebuilt/sherpa-onnx-v1.13.3-linux-x64-static-lib/lib/libsherpa-onnx-fst.awritten by build-script-build
Destination
github.com, release-assets.githubusercontent.com
Jobs
build-test
Rule
object-provenance · vizier

Witness chain

  1. /home/runner/work/vizier/vizier/target/sherpa-onnx-prebuilt/sherpa-onnx-v1.13.3-linux-x64-static-lib/lib/libsherpa-onnx-fst.avia /home/runner/work/vizier/vizier/target/release/build/sherpa-onnx-sys-28cf8fd34ceecfde/build-script-build
    • Object written under a build script that downloadedfrom github.com · release-assets.githubusercontent.com

      written under the build script at /home/runner/work/vizier/vizier/target/release/build/sherpa-onnx-sys-28cf8fd34ceecfde/build-script-build, which downloaded from github.com, release-assets.githubusercontent.com

    • Obfuscated toolchain bypass

      Written by build-script-build from a network connection without a recorded source compilation

    • Asked for by the build's own declaration

      sherpa-onnx-sys asked the linker for it: static sherpa-onnx-fst (target/release/build/sherpa-onnx-sys-8b5f8caa2aff97d9/output)

    source

Evidence

  • written under the build script at /home/runner/work/vizier/vizier/target/release/build/sherpa-onnx-sys-28cf8fd34ceecfde/build-script-build, which downloaded from github.com, release-assets.githubusercontent.com
  • Written by build-script-build from a network connection without a recorded source compilation
  • sherpa-onnx-sys asked the linker for it: static sherpa-onnx-fst (target/release/build/sherpa-onnx-sys-8b5f8caa2aff97d9/output)

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/vizier/vizier/target/release/build/sherpa-onnx-sys-28cf8fd34ceecfde/build-script-build
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 3 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2479
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2479
  3. build-script-build/home/runner/work/vizier/vizier/target/release/build/sherpa-onnx-sys-28cf8fd34ceecfde/build-script-build11660

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Detection

highwitnessed

Uncompiled library linked

Object file origin needs review

Subject
/home/runner/work/vizier/vizier/target/sherpa-onnx-prebuilt/sherpa-onnx-v1.13.3-linux-x64-static-lib/lib/libsherpa-onnx-fstfar.awritten by build-script-build
Destination
github.com, release-assets.githubusercontent.com
Jobs
build-test
Rule
object-provenance · vizier

Witness chain

  1. /home/runner/work/vizier/vizier/target/sherpa-onnx-prebuilt/sherpa-onnx-v1.13.3-linux-x64-static-lib/lib/libsherpa-onnx-fstfar.avia /home/runner/work/vizier/vizier/target/release/build/sherpa-onnx-sys-28cf8fd34ceecfde/build-script-build
    • Object written under a build script that downloadedfrom github.com · release-assets.githubusercontent.com

      written under the build script at /home/runner/work/vizier/vizier/target/release/build/sherpa-onnx-sys-28cf8fd34ceecfde/build-script-build, which downloaded from github.com, release-assets.githubusercontent.com

    • Obfuscated toolchain bypass

      Written by build-script-build from a network connection without a recorded source compilation

    • Asked for by the build's own declaration

      sherpa-onnx-sys asked the linker for it: static sherpa-onnx-fstfar (target/release/build/sherpa-onnx-sys-8b5f8caa2aff97d9/output)

    source

Evidence

  • written under the build script at /home/runner/work/vizier/vizier/target/release/build/sherpa-onnx-sys-28cf8fd34ceecfde/build-script-build, which downloaded from github.com, release-assets.githubusercontent.com
  • Written by build-script-build from a network connection without a recorded source compilation
  • sherpa-onnx-sys asked the linker for it: static sherpa-onnx-fstfar (target/release/build/sherpa-onnx-sys-8b5f8caa2aff97d9/output)

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/vizier/vizier/target/release/build/sherpa-onnx-sys-28cf8fd34ceecfde/build-script-build
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 3 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2479
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2479
  3. build-script-build/home/runner/work/vizier/vizier/target/release/build/sherpa-onnx-sys-28cf8fd34ceecfde/build-script-build11660

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Detection

highwitnessed

Uncompiled library linked

Object file origin needs review

Subject
/home/runner/work/vizier/vizier/target/sherpa-onnx-prebuilt/sherpa-onnx-v1.13.3-linux-x64-static-lib/lib/libsherpa-onnx-kaldifst-core.awritten by build-script-build
Destination
github.com, release-assets.githubusercontent.com
Jobs
build-test
Rule
object-provenance · vizier

Witness chain

  1. /home/runner/work/vizier/vizier/target/sherpa-onnx-prebuilt/sherpa-onnx-v1.13.3-linux-x64-static-lib/lib/libsherpa-onnx-kaldifst-core.avia /home/runner/work/vizier/vizier/target/release/build/sherpa-onnx-sys-28cf8fd34ceecfde/build-script-build
    • Object written under a build script that downloadedfrom github.com · release-assets.githubusercontent.com

      written under the build script at /home/runner/work/vizier/vizier/target/release/build/sherpa-onnx-sys-28cf8fd34ceecfde/build-script-build, which downloaded from github.com, release-assets.githubusercontent.com

    • Obfuscated toolchain bypass

      Written by build-script-build from a network connection without a recorded source compilation

    • Asked for by the build's own declaration

      sherpa-onnx-sys asked the linker for it: static sherpa-onnx-kaldifst-core (target/release/build/sherpa-onnx-sys-8b5f8caa2aff97d9/output)

    source

Evidence

  • written under the build script at /home/runner/work/vizier/vizier/target/release/build/sherpa-onnx-sys-28cf8fd34ceecfde/build-script-build, which downloaded from github.com, release-assets.githubusercontent.com
  • Written by build-script-build from a network connection without a recorded source compilation
  • sherpa-onnx-sys asked the linker for it: static sherpa-onnx-kaldifst-core (target/release/build/sherpa-onnx-sys-8b5f8caa2aff97d9/output)

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/vizier/vizier/target/release/build/sherpa-onnx-sys-28cf8fd34ceecfde/build-script-build
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 3 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2479
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2479
  3. build-script-build/home/runner/work/vizier/vizier/target/release/build/sherpa-onnx-sys-28cf8fd34ceecfde/build-script-build11660

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Detection

highwitnessed

Uncompiled library linked

Object file origin needs review

Subject
/home/runner/work/vizier/vizier/target/sherpa-onnx-prebuilt/sherpa-onnx-v1.13.3-linux-x64-static-lib/lib/libssentencepiece_core.awritten by build-script-build
Destination
github.com, release-assets.githubusercontent.com
Jobs
build-test
Rule
object-provenance · vizier

Witness chain

  1. /home/runner/work/vizier/vizier/target/sherpa-onnx-prebuilt/sherpa-onnx-v1.13.3-linux-x64-static-lib/lib/libssentencepiece_core.avia /home/runner/work/vizier/vizier/target/release/build/sherpa-onnx-sys-28cf8fd34ceecfde/build-script-build
    • Object written under a build script that downloadedfrom github.com · release-assets.githubusercontent.com

      written under the build script at /home/runner/work/vizier/vizier/target/release/build/sherpa-onnx-sys-28cf8fd34ceecfde/build-script-build, which downloaded from github.com, release-assets.githubusercontent.com

    • Obfuscated toolchain bypass

      Written by build-script-build from a network connection without a recorded source compilation

    • Asked for by the build's own declaration

      sherpa-onnx-sys asked the linker for it: static ssentencepiece_core (target/release/build/sherpa-onnx-sys-8b5f8caa2aff97d9/output)

    source

Evidence

  • written under the build script at /home/runner/work/vizier/vizier/target/release/build/sherpa-onnx-sys-28cf8fd34ceecfde/build-script-build, which downloaded from github.com, release-assets.githubusercontent.com
  • Written by build-script-build from a network connection without a recorded source compilation
  • sherpa-onnx-sys asked the linker for it: static ssentencepiece_core (target/release/build/sherpa-onnx-sys-8b5f8caa2aff97d9/output)

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/vizier/vizier/target/release/build/sherpa-onnx-sys-28cf8fd34ceecfde/build-script-build
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 3 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2479
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2479
  3. build-script-build/home/runner/work/vizier/vizier/target/release/build/sherpa-onnx-sys-28cf8fd34ceecfde/build-script-build11660

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Detection

highwitnessed

Uncompiled library linked

Object file origin needs review

Subject
/home/runner/work/vizier/vizier/target/sherpa-onnx-prebuilt/sherpa-onnx-v1.13.3-linux-x64-static-lib/lib/libucd.awritten by build-script-build
Destination
github.com, release-assets.githubusercontent.com
Jobs
build-test
Rule
object-provenance · vizier

Witness chain

  1. /home/runner/work/vizier/vizier/target/sherpa-onnx-prebuilt/sherpa-onnx-v1.13.3-linux-x64-static-lib/lib/libucd.avia /home/runner/work/vizier/vizier/target/release/build/sherpa-onnx-sys-28cf8fd34ceecfde/build-script-build
    • Object written under a build script that downloadedfrom github.com · release-assets.githubusercontent.com

      written under the build script at /home/runner/work/vizier/vizier/target/release/build/sherpa-onnx-sys-28cf8fd34ceecfde/build-script-build, which downloaded from github.com, release-assets.githubusercontent.com

    • Obfuscated toolchain bypass

      Written by build-script-build from a network connection without a recorded source compilation

    • Asked for by the build's own declaration

      sherpa-onnx-sys asked the linker for it: static ucd (target/release/build/sherpa-onnx-sys-8b5f8caa2aff97d9/output)

    source

Evidence

  • written under the build script at /home/runner/work/vizier/vizier/target/release/build/sherpa-onnx-sys-28cf8fd34ceecfde/build-script-build, which downloaded from github.com, release-assets.githubusercontent.com
  • Written by build-script-build from a network connection without a recorded source compilation
  • sherpa-onnx-sys asked the linker for it: static ucd (target/release/build/sherpa-onnx-sys-8b5f8caa2aff97d9/output)

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/vizier/vizier/target/release/build/sherpa-onnx-sys-28cf8fd34ceecfde/build-script-build
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 3 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2479
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2479
  3. build-script-build/home/runner/work/vizier/vizier/target/release/build/sherpa-onnx-sys-28cf8fd34ceecfde/build-script-build11660

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Detection

mediumwitnessed

Build script reached parcel.pyke.io

Unexpected network connection

Subject
ort-sys 2.0.0-rc.9
Destination
parcel.pyke.io:443
Jobs
build-test
Rule
egress

Evidence

  1. Connection outside the process’s allowed destinationscause

    connection to parcel.pyke.io:443, opened by build-script-build

    subject parcel.pyke.io:443

    by /home/runner/work/vizier/vizier/target/release/build/ort-sys-e738b04b797369bc/build-script-build

  2. What a build script's fetch becamesupport

    1 file came down; the build compiled or linked libonnxruntime.a

  3. Connection opened by a build script or child processsupport

    the opener is the build script at /home/runner/work/vizier/vizier/target/release/build/ort-sys-e738b04b797369bc/build-script-build

  4. Build script fetched what its crate documents it fetchessupport

    ort-sys's build script fetches a prebuilt ONNX Runtime from parcel.pyke.io: ort's default `download-binaries` feature fetches pyke's prebuilt from its CDN

What came before it

Loading the graph

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/vizier/vizier/target/release/build/ort-sys-e738b04b797369bc/build-script-build
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 3 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2479
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2479
  3. build-script-build/home/runner/work/vizier/vizier/target/release/build/ort-sys-e738b04b797369bc/build-script-build11628

Remediation

The crate's build script reached the network at compile time, outside the registry's checksums. Build it from what the registry ships (the crate's own environment variable or from-source feature), or record the download as accepted once it is reviewed.

Detection

mediumwitnessed

Build script reached codeload.github.com +1

Unexpected network connection

Subject
utoipa-swagger-ui 10.0.1
Destination
github.com:443, codeload.github.com:443
Jobs
build-test
Rule
egress

Evidence

  1. Connection outside the process’s allowed destinationscause

    connection to github.com:443, opened by curl

    subject github.com:443

    by curl -sSL -o /home/runner/work/vizier/vizier/target/release/build/utoipa-swagger-ui-243f93fea0895689/out/v5.32.6.zip https://github.com/swagger-api/swagger-ui/a…

  2. Connection outside the process’s allowed destinationscause

    connection to codeload.github.com:443, opened by curl

    subject codeload.github.com:443

    by curl -sSL -o /home/runner/work/vizier/vizier/target/release/build/utoipa-swagger-ui-243f93fea0895689/out/v5.32.6.zip https://github.com/swagger-api/swagger-ui/a…

  3. What a build script's fetch becamesupport

    1 file came down; nothing the build compiled, linked or ran

  4. Connection opened by a build script or child processsupport

    the opener descends from the build script at /home/runner/work/vizier/vizier/target/release/build/utoipa-swagger-ui-dcd91e816f7f6357/build-script-build

  5. Tool commandsupport

    Command: curl -sSL -o /home/runner/work/vizier/vizier/target/release/build/utoipa-swagger-ui-243f93fea0895689/out/v5.32.6.zip https://github.com/swagger-api/swagger-ui/a…

    by curl -sSL -o /home/runner/work/vizier/vizier/target/release/build/utoipa-swagger-ui-243f93fea0895689/out/v5.32.6.zip https://github.com/swagger-api/swagger-ui/a…

What came before it

Loading the graph

Processes

build-test

cargo›cargo›build-script-build›curl

Ran
curl -sSL -o /home/runner/work/vizier/vizier/target/release/build/utoipa-swagger-ui-243f93fea0895689/out/v5.32.6.zip https://github.com/swagger-api/swagger-ui/a…
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 4 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2479
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2479
  3. build-script-build/home/runner/work/vizier/vizier/target/release/build/utoipa-swagger-ui-dcd91e816f7f6357/build-script-build14206
  4. curlcurl -sSL -o /home/runner/work/vizier/vizier/target/release/build/utoipa-swagger-ui-243f93fea0895689/out/v5.32.6.zip https://github.com/swagger-api/swagger-ui/a…14214

Remediation

The build script connected to the network while compiling. Nothing it downloaded was compiled, linked or run. Build the crate from what the registry ships, or accept the download after reviewing it.

Detection

mediumwitnessed

Prebuilt library downloaded by a build script from its documented source

Object file origin needs review

Subject
/home/runner/.cache/ort.pyke.io/dfbin/x86_64-unknown-linux-gnu/F88A8C1E4B4813A1CFA79AF3F35B23ADDF2F0F36E66C5CD7C88103CB9B30509D/onnxruntime/lib/libonnxruntime.awritten by build-script-build
Destination
parcel.pyke.io
Jobs
build-test
Rule
object-provenance

Witness chain

  1. /usr/share/pkgconfig/iso-codes.pc
    source
  2. pipevia pkg-config --libs --cflags libonnxruntime
  3. /home/runner/.cache/ort.pyke.io/dfbin/x86_64-unknown-linux-gnu/F88A8C1E4B4813A1CFA79AF3F35B23ADDF2F0F36E66C5CD7C88103CB9B30509D/onnxruntime/lib/libonnxruntime.avia /home/runner/work/vizier/vizier/target/release/build/ort-sys-e738b04b797369bc/build-script-build
    • Object written under a build script that downloadedfrom parcel.pyke.io

      written under the build script at /home/runner/work/vizier/vizier/target/release/build/ort-sys-e738b04b797369bc/build-script-build, which downloaded from parcel.pyke.io

    • Obfuscated toolchain bypass

      Written by build-script-build from a network connection without a recorded source compilation

    • Asked for by the build's own declaration

      ort-sys asked the linker for it: static onnxruntime (target/release/build/ort-sys-1c259569c7e32319/output)

    subject

Evidence

  1. Build script fetched what its crate documents it fetchessupport

    ort-sys's build script fetches a prebuilt ONNX Runtime from parcel.pyke.io: ort's default `download-binaries` feature fetches pyke's prebuilt from its CDN

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/vizier/vizier/target/release/build/ort-sys-e738b04b797369bc/build-script-build
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 3 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2479
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2479
  3. build-script-build/home/runner/work/vizier/vizier/target/release/build/ort-sys-e738b04b797369bc/build-script-build11628

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Network

6 peers
  • codeload.github.com:443 build code of utoipa-swagger-ui · curl · GitHub, Inc. · 1 file undeclared
  • github.com:443 build code of sherpa-onnx-sys · build-script-build (vizier); curl · GitHub, Inc. · 16 files · went into an output undeclared
  • github.com:443 build code of utoipa-swagger-ui · curl · 1 file undeclared
  • parcel.pyke.io:443 build code of ort-sys · build-script-build · Cloudflare, Inc. · 1 file · went into an output documented
  • release-assets.githubusercontent.com:443 build code of sherpa-onnx-sys · build-script-build (vizier) · Fastly, Inc. · 16 files · went into an output undeclared
  • static.crates.io:8080 the package manager · cargo (vizier) via crates.io · 42,544 files · went into an output ecosystem
Dependencies799Build behaviour
adler22.0.1
adobe-cmap-parser0.4.1
aes0.8.4
ahash0.8.12build script
aho-corasick1.1.5
aligned0.4.3
aligned-vec0.6.4
alloc-no-stdlib2.0.4
alloc-stdlib0.2.4
allocator-api20.2.21
android_system_properties0.1.6
anstream1.0.0
anstyle1.0.14
anstyle-parse1.0.0
anstyle-query1.1.5
anstyle-wincon3.0.11
anyhow1.0.104build script
aquamarine0.6.0proc macro
ar_archive_writer0.5.3
arbitrary1.5.0
arc-swap1.9.2
arg_enum_proc_macro0.3.4proc macro
argon20.6.0
arraydeque0.5.1
arrayvec0.7.8
as-slice0.2.1
async-stream0.3.6
async-stream-impl0.3.6proc macro
async-trait0.1.92proc macro
atoi_simd0.18.1
atomic-polyfill1.0.3build script, not run
atomic-waker1.1.2
attribute-derive0.11.0
attribute-derive-macro0.11.0proc macro
auto_enums0.8.10proc macro
autocfg1.5.1
av-scenechange0.14.1build script
av1-grain0.2.5
avif-serialize0.8.9
aws-lc-rs1.18.2build script
aws-lc-sys0.46.0build scriptprebuilt objects
axum0.8.9
axum-core0.5.6
axum-extra0.12.6
base640.13.1
base640.22.1
base640.23.1
base64ct1.8.3
bit-set0.8.0
bit-vec0.8.0
bit_field0.10.3
bitflags1.3.2
bitflags2.13.2
bitstream-io4.10.0
bitvec1.1.1
blake20.11.0
block-buffer0.10.4
block-buffer0.12.1
block-padding0.3.3
bollard0.21.1
bollard-buildkit-proto0.8.1build script
bollard-stubs1.53.1-rc.29.3.1
brotli-decompressor5.0.3
bs580.5.1
bstr1.13.1
built0.8.1
bumpalo3.20.3
bytemuck1.25.2
byteorder1.5.0
byteorder-lite0.1.0
bytes1.12.1
bzip20.4.4
bzip20.6.1
bzip2-sys0.1.13+1.0.8build script
calamine0.36.1
castaway0.2.4
cbc0.1.2
cc1.8.0
cff-parser0.2.0
cfg-if1.0.5
cfg_aliases0.2.2
chacha200.10.2
char_str0.0.4
chrono0.4.45
cipher0.4.4
clap4.6.7
clap_builder4.6.7
clap_derive4.6.7proc macro
clap_lex1.1.1
cmake0.1.58
cmov0.5.4
cobs0.3.0
codepage0.1.3
collection_literals1.0.3
color_quant1.1.0
colorchoice1.0.5
colored3.1.1
combine4.6.8
compact_str0.10.0
compact_str0.9.1
config0.15.27
console0.15.11
console0.16.6
const-oid0.10.2
const-random0.1.18
const-random-macro0.1.16proc macro
convert_case0.10.0
convert_case0.6.0
coolor1.1.0
core-foundation0.10.1
core-foundation0.9.4
core-foundation-sys0.8.7
core_detect1.0.0
core_maths0.1.1
cpufeatures0.2.17
cpufeatures0.3.1
crc32fast1.5.2build script
critical-section1.2.0
crokey1.5.0
crokey-proc_macros1.5.0proc macro
croner4.0.1
crossbeam0.8.5
crossbeam-channel0.5.17
crossbeam-deque0.8.8build script
crossbeam-epoch0.9.21build script
crossbeam-queue0.3.14
crossbeam-utils0.8.23build script
crossterm0.29.0
crossterm_winapi0.9.1
crunchy0.2.4build script
crypto-common0.1.7
crypto-common0.2.2
ctutils0.4.3
daemonize0.5.0
darling0.20.11
darling0.24.1
darling_core0.20.11
darling_core0.24.1
darling_macro0.20.11proc macro
darling_macro0.24.1proc macro
dary_heap0.3.9
data-encoding2.11.1
debug_unsafe0.1.4
defmt1.1.1build script, not run
defmt-macros1.1.1build script, not runproc macro
defmt-parser1.0.0
deranged0.5.9
derive_builder0.20.2
derive_builder_core0.20.2
derive_builder_macro0.20.2proc macro
derive_more1.0.0
derive_more2.1.1
derive_more-impl1.0.0proc macro
derive_more-impl2.1.1proc macro
derive_utils0.16.0
digest0.10.7
digest0.11.3
dirs6.0.0
dirs7.0.0
dirs-sys0.5.0
displaydoc0.2.7proc macro
dlv-list0.5.2
document-features0.2.12proc macro
docx-rs0.4.22
dotenvy0.15.7
dptree0.5.1
drop_bomb0.1.5
dunce1.0.5
duration-string0.5.3
dyn-clone1.0.20
ecb0.1.2
either1.19.0
embedded-io0.4.0
embedded-io0.6.1
encode_unicode1.0.0
encoding_rs0.8.42build script
equator0.4.2
equator-macro0.4.2proc macro
equivalent1.0.3
erasable1.3.0build script
erased-serde0.4.10build script
errno0.3.14
esaxx-rs0.1.10build script
euclid0.20.14
exr1.74.2
extended0.1.0
fallible-iterator0.3.0
fallible-streaming-iterator0.1.9
fancy-regex0.17.0
fast-float20.2.4
fastembed4.9.1
fastrand2.5.0
fax0.2.7
fdeflate0.3.7
filetime0.2.29
find-msvc-tools0.1.14
flate21.1.10
flume0.12.0
fnv1.0.7
foldhash0.2.0
foreign-types0.3.2
foreign-types-shared0.1.1
form_urlencoded1.2.2
fs_extra1.3.0
funty2.0.0
futures0.3.34
futures-channel0.3.34
futures-core0.3.34
futures-executor0.3.34
futures-io0.3.34
futures-macro0.3.34proc macro
futures-sink0.3.34
futures-task0.3.34
futures-util0.3.34
fuzzy-matcher0.3.7
generic-array0.14.7build script
get-size-derive20.11.1proc macro
get-size20.11.1
getopts0.2.24
getrandom0.2.17
getrandom0.3.4build script
getrandom0.4.3build script
gif0.14.2
glob0.3.4
h20.4.20
half2.7.1
hash320.2.1
hashbrown0.12.3
hashbrown0.14.5
hashbrown0.16.1
hashbrown0.17.1
hashlink0.11.1
hashlink0.12.2
heapless0.7.17build script
heck0.5.0
hex0.4.3
hf-hub0.4.3
home0.5.12
hound3.5.1
html2md0.2.17
html5ever0.39.0
http1.5.0
http-body1.1.0
http-body-util0.1.5
http-range-header0.4.2
httparse1.10.1build script
httpdate1.0.3
hybrid-array0.4.15
hyper1.12.0
hyper-named-pipe0.1.1
hyper-rustls0.27.10
hyper-timeout0.5.2
hyper-tls0.6.0
hyper-util0.1.21
hyperlocal0.9.1
iana-time-zone0.1.65
iana-time-zone-haiku0.1.2build script, not run
icu_collections2.3.0
icu_locale_core2.3.0
icu_locale_fallback2.3.0
icu_locale_fallback_data2.3.0build script
icu_normalizer2.3.0
icu_normalizer_data2.3.0build script
icu_properties2.3.0
icu_properties_data2.3.0build script
icu_provider2.3.1
icu_segmenter2.3.0
icu_segmenter_data2.3.0build script
ident_case1.0.1
idna1.1.0
idna_adapter1.2.2
image0.25.10
image-webp0.2.4
imgref1.12.3
include_dir0.7.4
include_dir_macros0.7.4proc macro
indexmap1.9.3build script, not run
indexmap2.14.2
indicatif0.17.11
indicatif0.18.6
inout0.1.4
inquire0.9.4
interpolate_name0.2.4proc macro
interpolator0.5.0
ipnet2.12.2
is-macro0.3.8proc macro
is_terminal_polyfill1.70.2
itertools0.10.5
itertools0.14.0
itertools0.15.0
itoa1.0.18
jiff0.2.38
jiff-core0.1.1
jiff-static0.2.38proc macro
jiff-tzdb0.1.9
jiff-tzdb-platform0.1.3
jiter0.17.0build script
jni0.22.4build script, not run
jni-macros0.22.4build script, not runproc macro
jni-sys0.4.1
jni-sys-macros0.4.1proc macro
jobserver0.1.35
js-sys0.3.106
json51.3.2
jsonwebtoken11.1.0
lazy-regex3.6.2
lazy-regex-proc_macros3.6.2proc macro
lazy_static1.5.1
ld-linux-x86-64.so.2system library
lebe0.5.3
lexical-parse-float1.0.6
lexical-parse-integer1.0.6
lexical-util1.0.7
libbz2-rs-sys0.2.5
libc0.2.190build script
libc.so.6system library
libfuzzer-sys0.4.13build script, not run
libgcc_s.so.1system library
libm0.2.16build script
libm.so.6system library
libmvec.so.1system library
libredox0.1.25
libsqlite3-sys0.38.2build script
linux-raw-sys0.12.1
litemap0.8.3
litrs1.0.1
lock_api0.4.14
log0.4.34
loop90.1.5
lopdf0.42.0
lru-slab0.1.3
macro_rules_attribute0.2.3
macro_rules_attribute-proc_macro0.2.3proc macro
manyhow0.14.1
manyhow-macros0.14.1proc macro
markup5ever0.39.0
markup5ever_rcdom0.39.0+unofficial
matchers0.2.0
matchit0.8.4
matrixmultiply0.3.11build script
maybe-rayon0.1.1
md-50.10.6
memchr2.8.3
mime0.3.17
mime_guess2.0.5build script
minicbor2.3.0
minicbor-serde0.7.1
minimad0.16.0
minimal-lexical0.2.1
miniz_oxide0.8.9
miniz_oxide0.9.1
mio1.2.4
monostate0.1.18
monostate-impl0.1.18proc macro
monty1.0.0
monty-macros1.1.0proc macro
monty-types1.0.0
moxcms0.8.1
multer3.1.0build script
multiversion_no_op1.0.0proc macro
nanoid0.5.0
native-tls0.2.18build script
ndarray0.16.1
new_debug_unreachable1.0.6
nix0.31.3build script
no_std_io20.9.4
nom7.1.3
nom8.0.0
noop_proc_macro0.3.0proc macro
nu-ansi-term0.50.3
num0.4.3
num-bigint0.4.8
num-complex0.4.6
num-conv0.2.2
num-derive0.4.2proc macro
num-integer0.1.47
num-iter0.1.46
num-rational0.4.2
num-traits0.2.19build script
number_prefix0.4.0
object0.39.1build script
once_cell1.21.4
once_cell_polyfill1.70.2
onig6.5.3
onig_sys69.9.3build script
openssl0.10.81build script
openssl-macros0.1.1proc macro
openssl-probe0.2.1
openssl-sys0.9.117build script
opentelemetry0.33.1
opentelemetry-http0.33.1
opentelemetry-otlp0.33.1
opentelemetry-proto0.33.1
opentelemetry_sdk0.33.1
option-ext0.2.0
ordered-float2.10.1
ordered-multimap0.7.3
ordermap1.2.2
ort2.0.0-rc.9
ort-sys2.0.0-rc.9build scriptnetworkparcel.pyke.io
parking_lot0.12.5
parking_lot_core0.9.12build script
password-hash0.6.1
paste1.0.15build scriptproc macro
pastey0.1.1proc macro
pastey0.2.3proc macro
pathdiff0.2.3
pdf-extract0.12.1
pem3.0.6
percent-encoding2.3.2
phc0.6.1
phf0.11.3
phf0.13.1
phf_codegen0.11.3
phf_codegen0.13.1
phf_generator0.11.3
phf_generator0.13.1
phf_shared0.11.3
phf_shared0.13.1
pin-project1.1.13
pin-project-internal1.1.13proc macro
pin-project-lite0.2.17
pkg-config0.3.34
png0.18.1
pom1.1.0
portable-atomic1.15.0build script
portable-atomic-util0.2.8build script, not run
postcard1.1.3
postscript0.14.1
potential_utf0.1.6
powerfmt0.2.1
ppv-lite860.2.21
precomputed-hash0.1.1
primal-check0.3.4
proc-macro-error-attr22.0.0proc macro
proc-macro-error22.0.1
proc-macro-utils0.10.0
proc-macro21.0.107build script
process-wrap10.0.1
profiling1.0.18
profiling-procmacros1.0.18proc macro
prost0.14.4
prost-derive0.14.4proc macro
prost-types0.14.4
psm0.1.32build scriptprebuilt objects
pulldown-cmark0.13.4build script
pulp0.22.3build script
pulp-wasm-simd-flag0.1.1
pxfm0.1.30
pyo30.29.3build script, not run
pyo3-build-config0.29.3
pyo3-ffi0.29.3build script, not run
pyo3-macros0.29.3proc macro
pyo3-macros-backend0.29.3
qoi0.4.1
quick-error2.0.1
quick-xml0.41.0
quinn0.11.12build script, not run
quinn-proto0.11.19
quinn-udp0.5.16build script, not run
quote1.0.47build script
quote-use0.9.0
quote-use-macros0.9.0proc macro
r-efi5.3.0
r-efi6.0.0
radium0.7.0build script
rand0.10.3
rand0.8.8
rand0.9.5
rand_chacha0.3.1
rand_chacha0.9.0
rand_core0.10.1
rand_core0.6.4
rand_core0.9.5
rand_pcg0.10.2
rangemap1.8.0
rav1e0.8.1build script
ravif0.13.0
raw-cpuid11.6.0
rawpointer0.2.1
rayon1.12.0
rayon-cond0.4.0
rayon-core1.13.0build script
rc-box1.3.0
reborrow0.5.5
redox_syscall0.5.18
redox_users0.5.3
ref-cast1.0.27build script
ref-cast-impl1.0.27proc macro
regex1.13.1
regex-automata0.4.18
regex-lite0.1.9
regex-syntax0.8.11
reqwest0.12.28
reqwest0.13.5
rgb0.8.53
ring0.17.14build scriptprebuilt objects
rmcp3.5.1build script
rmcp-macros3.5.1proc macro
ron0.12.2
rsqlite-vfs0.1.1
ruff_python_ast0.0.14
ruff_python_codegen0.0.14
ruff_python_literal0.0.14
ruff_python_parser0.0.14
ruff_python_stdlib0.0.14
ruff_python_trivia0.0.14
ruff_source_file0.0.14
ruff_text_size0.0.14
rusqlite0.40.2
rust-embed8.13.0
rust-embed-impl8.13.0proc macro
rust-embed-utils8.13.0
rust-ini0.21.3
rustc-hash2.1.3
rustc_version0.4.1
rustfft6.4.1
rustix1.1.5build script
rustls0.23.46build script
rustls-native-certs0.8.5
rustls-pki-types1.15.1
rustls-platform-verifier0.7.1
rustls-platform-verifier-android0.2.0
rustls-webpki0.103.15
rustversion1.0.23build scriptproc macro
ryu1.0.23
same-file1.0.6
schannel0.1.29
schemars0.9.0
schemars1.2.3
schemars_derive1.2.3proc macro
scopeguard1.2.0
security-framework3.7.0
security-framework-sys2.17.0
semver1.0.28
serde1.0.229build script
serde-untagged0.1.9
serde-value0.7.0
serde_bytes0.11.19
serde_core1.0.229build script
serde_derive1.0.229proc macro
serde_derive_internals0.30.0
serde_json1.0.154build script
serde_path_to_error0.1.20
serde_repr0.1.21proc macro
serde_spanned1.1.2
serde_urlencoded0.7.1
serde_with3.24.0
serde_with_macros3.24.0proc macro
serde_yaml0.9.34+deprecated
sha10.10.7
sha10.11.0
sha1_smol1.0.1
sha20.10.9
sha20.11.1
sharded-slab0.1.7
shellexpand3.1.2
sherpa-onnx1.13.3
sherpa-onnx-sys1.13.3build scriptnetworkgithub.com, release-assets.githubusercontent.com
shlex2.0.1
signal-hook0.3.18build script
signal-hook-mio0.2.5
signal-hook-registry1.4.8
signature2.2.0
simd-adler320.3.10
simd_cesu81.2.0
simd_helpers0.1.0proc macro
simdutf80.1.5
similar3.2.0
simple_asn10.6.4
siphasher1.0.4
slab0.4.12
slugify0.1.0
smallvec1.16.3
socket20.6.5
socks0.3.4
speedate0.17.0
spin0.9.9
spm_precompiled0.1.4
sqlite-vec0.1.9build script
sqlite-wasm-rs0.5.5build script, not run
sse-stream0.2.6
stable_deref_trait1.2.1
stacker0.1.25build script
static_assertions1.1.0
strength_reduce0.2.4
strict0.2.0
string_cache0.9.0
string_cache_codegen0.6.1
stringprep0.1.5
strsim0.11.1
strum0.27.2
strum0.28.0
strum_macros0.27.2proc macro
strum_macros0.28.0proc macro
subtle2.6.1
symphonia0.6.1
symphonia-bundle-flac0.6.1
symphonia-bundle-mp30.6.1
symphonia-codec-adpcm0.6.1
symphonia-codec-pcm0.6.1
symphonia-codec-vorbis0.6.1
symphonia-common0.6.1
symphonia-core0.6.1
symphonia-format-isomp40.6.1
symphonia-format-mkv0.6.1
symphonia-format-ogg0.6.1
symphonia-format-riff0.6.1
symphonia-metadata0.6.1
syn2.0.119
syn3.0.9
sync_wrapper1.0.2
synstructure0.14.0
system-configuration0.7.0
system-configuration-sys0.6.0build script, not run
take_mut0.2.2
takecell0.1.2
tap1.0.1
tar0.4.46
target-lexicon0.13.5build script, not run
teloxide0.17.0
teloxide-core0.13.0
tempfile3.27.0
tendril0.5.1
termimad0.35.5
text-splitter0.33.0
thin-vec0.2.21
thiserror2.0.21build script
thiserror-impl2.0.21proc macro
thread_local1.1.10
tiff0.11.3
time0.3.55
time-core0.1.9
time-macros0.2.32proc macro
tiny-keccak2.0.2build script
tinystr0.8.4
tinyvec1.13.3
tokenizers0.21.4
tokio1.53.3
tokio-macros2.7.2proc macro
tokio-native-tls0.3.1
tokio-rustls0.26.6
tokio-stream0.1.19
tokio-tungstenite0.29.0
tokio-tungstenite0.30.0
tokio-util0.7.20
tokio-websockets0.13.3
toml1.1.8+spec-1.1.0
toml_datetime1.1.2+spec-1.1.0
toml_parser1.1.5+spec-1.1.0
toml_writer1.1.3+spec-1.1.0
tonic0.14.6
tonic-prost0.14.6
tower0.5.3
tower-http0.6.11
tower-http0.7.1
tower-layer0.3.3
tower-service0.3.3
tracing0.1.44
tracing-attributes0.1.31proc macro
tracing-core0.1.36
tracing-log0.2.0
tracing-opentelemetry0.34.0
tracing-subscriber0.3.23
transpose0.2.3
try-lock0.2.5
ttf-parser0.25.1
tungstenite0.29.0
tungstenite0.30.0
twilight-gateway0.17.1
twilight-gateway-queue0.17.0
twilight-http0.17.1
twilight-http-ratelimiting0.17.1
twilight-model0.17.1
twilight-util0.17.0
twilight-validate0.17.0
type1-encoding-parser0.1.1
typed-path0.12.3
typeid1.0.3build script
typenum1.20.1
ucd-trie0.1.7
unicase2.10.0
unicode-bidi0.3.18
unicode-general-category1.1.0build script
unicode-ident1.0.27
unicode-normalization0.1.25
unicode-normalization-alignments0.1.12
unicode-properties0.1.4
unicode-segmentation1.13.3
unicode-width0.1.14
unicode-width0.2.2
unicode-xid0.2.6
unicode_categories0.1.1
unicode_names21.3.0build script
unicode_names2_generator1.3.0
unidecode0.3.0
unit-prefix0.5.2
unsafe-libyaml0.2.11
untrusted0.7.1
untrusted0.9.0
ureq2.12.1
url2.5.8
utf8_iter1.0.4
utf8parse0.2.2
utoipa6.0.0
utoipa-axum0.3.0
utoipa-gen6.0.1proc macro
utoipa-swagger-ui10.0.1build scriptnetworkruns toolscodeload.github.com, github.com, curl
uuid1.28.0
v_frame0.3.9
valuable0.1.1build script, not run
vcpkg0.2.15prebuilt objects
version_check0.9.5
vizier-derive0.13.0-rc.2proc macro
walkdir2.5.0
want0.3.2
wasi0.11.1+wasi-snapshot-preview1
wasip21.0.4+wasi-0.2.12
wasm-bindgen0.2.129build script, not run
wasm-bindgen-futures0.4.79
wasm-bindgen-macro0.2.129proc macro
wasm-bindgen-macro-support0.2.129
wasm-bindgen-shared0.2.129build script, not run
wasm-streams0.4.2
wasm-streams0.5.0
web-sys0.3.106
web-time1.1.0
web_atoms0.2.6build script
webpki-root-certs1.0.9
webpki-roots0.26.11
webpki-roots1.0.9
weezl0.1.12
winapi0.3.9build script, not run
winapi-i686-pc-windows-gnu0.4.0build script, not runprebuilt objects
winapi-util0.1.11
winapi-x86_64-pc-windows-gnu0.4.0build script, not runprebuilt objects
windows0.62.2
windows-collections0.3.2
windows-core0.62.2
windows-future0.3.2
windows-implement0.60.2proc macro
windows-interface0.59.3proc macro
windows-link0.2.1
windows-numerics0.3.1
windows-registry0.6.1
windows-result0.4.1
windows-strings0.5.1
windows-sys0.52.0
windows-sys0.59.0
windows-sys0.60.2
windows-sys0.61.2
windows-targets0.52.6
windows-targets0.53.5
windows-threading0.2.1
windows_aarch64_gnullvm0.52.6build script, not runprebuilt objects
windows_aarch64_gnullvm0.53.1build script, not runprebuilt objects
windows_aarch64_msvc0.52.6build script, not runprebuilt objects
windows_aarch64_msvc0.53.1build script, not runprebuilt objects
windows_i686_gnu0.52.6build script, not runprebuilt objects
windows_i686_gnu0.53.1build script, not runprebuilt objects
windows_i686_gnullvm0.52.6build script, not runprebuilt objects
windows_i686_gnullvm0.53.1build script, not runprebuilt objects
windows_i686_msvc0.52.6build script, not runprebuilt objects
windows_i686_msvc0.53.1build script, not runprebuilt objects
windows_x86_64_gnu0.52.6build script, not runprebuilt objects
windows_x86_64_gnu0.53.1build script, not runprebuilt objects
windows_x86_64_gnullvm0.52.6build script, not runprebuilt objects
windows_x86_64_gnullvm0.53.1build script, not runprebuilt objects
windows_x86_64_msvc0.52.6build script, not runprebuilt objects
windows_x86_64_msvc0.53.1build script, not runprebuilt objects
winnow1.0.4
wit-bindgen0.57.1build script, not runprebuilt objects
writeable0.6.4
wyz0.5.1
xattr1.6.1
xml5ever0.39.0
y4m0.8.0
yaml-rust20.11.1
yoke0.8.3
yoke-derive0.8.4proc macro
zerocopy0.8.63build script
zerocopy-derive0.8.63proc macro
zerofrom0.1.8
zerofrom-derive0.1.8proc macro
zeroize1.9.1
zeroize_derive1.5.0proc macro
zerotrie0.2.5
zerovec0.11.8
zerovec-derive0.11.6proc macro
zip8.6.0
zip9.0.3
zlib-rs0.6.8
zmij1.0.23build script
zopfli0.8.4
zstd-safe7.3.0build script
zstd-sys2.1.1+zstd.1.5.7build script
zune-core0.5.3
zune-inflate0.2.54
zune-jpeg0.5.15
Versions59RiskVulnsPublished
0.13.0-rc.5did not build7h ago
0.13.0-rc.4did not build1d ago
0.13.0-rc.32d ago
0.13.0-rc.2did not build2d ago
0.13.0-rc.12d ago
0.12.03d ago
0.12.0-rc.4did not build9d ago
0.12.0-rc.3not analyzed13d ago
0.12.0-rc.2not analyzed13d ago
0.11.0not analyzed2026-09-13
0.10.11not analyzed2026-07-02
0.10.10not analyzed2026-07-02
0.10.9not analyzed2026-06-27
0.10.8not analyzed2026-06-20
0.10.7not analyzed2026-06-20
0.10.6not analyzed2026-06-19
0.10.5not analyzed2026-06-17
0.10.4not analyzed2026-06-16
0.10.3not analyzed2026-06-16
0.10.2not analyzed2026-06-16
0.10.1not analyzed2026-06-16
0.10.0-rc.3not analyzed2026-06-10
0.10.0-rc.2not analyzed2026-06-08
0.10.0-rc.1not analyzed2026-06-07
0.9.2not analyzed2026-06-07
0.9.1not analyzed2026-06-06
0.9.0not analyzed2026-06-06
0.9.0-rc.1not analyzed2026-06-04
0.8.3not analyzed2026-06-03
0.8.2not analyzed2026-06-02
0.8.1not analyzed2026-06-02
0.8.0not analyzed2026-06-02
0.7.0not analyzed2026-05-31
0.5.5not analyzed2026-05-02
0.5.4not analyzed2026-04-28
0.5.3not analyzed2026-04-25
0.5.2not analyzed2026-04-24
0.5.1not analyzed2026-04-23
0.5.0not analyzed2026-04-21
0.5.0-rc.3not analyzed2026-04-17
0.5.0-rc.2not analyzed2026-04-16
0.5.0-rc.1not analyzed2026-04-15
0.4.0not analyzed2026-04-12
0.3.3not analyzed2026-04-11
0.3.2not analyzed2026-04-11
0.3.1not analyzed2026-04-10
0.3.0not analyzed2026-04-10
0.3.0-rc.7not analyzed2026-04-10
0.3.0-rc.6not analyzed2026-04-09
0.3.0-rc.1not analyzed2026-04-04
0.2.3not analyzed2026-03-26
0.2.2not analyzed2026-03-25
0.2.1not analyzed2026-03-24
0.2.0not analyzed2026-03-24
0.2.0-rc.5not analyzed2026-03-20
0.2.0-rc.4not analyzed2026-03-17
0.2.0-rc.3not analyzed2026-03-17
0.2.0-rc.2not analyzed2026-03-17
0.2.0-rc.1not analyzed2026-03-17

Raw data

capture
2.4 MB
records
365,502
bytes per record
6.7

Loading a sample of the capture

Want to see more? E-mail us at hello@bitbison.io about your use case.

2 of 2 jobs captured: build-test unknown, build-test failure · Generated 2026-10-16 · run 32a1ea06-68e0-4f40-8dbf-7068c6000fff

analysis 0.1.0 · 2026-10-15 · 244c7b2 · graph v2