Clira · clearance packet · public sample
A real packet on a repository whose dependencies are lockfile-pinned. Every one of
the 52 crates was independently re-hashed and matched against Cargo.lock before any
code ran, then the full suite executed offline in the sandbox.
| Repository | https://github.com/BurntSushi/ripgrep |
|---|---|
| Commit | 3fce3b5bb0236da2df6d99672afb8a719642eca7 |
| Scanned at | 2026-08-12T20:14:51Z UTC |
| Scope | 233 files · 67,438 lines · {"Rust": 89, "Ruby": 1} |
| Findings | 5 — all medium, none blocking |
ripgrep spawns subprocesses deliberately — decompression preprocessors and the
--pre command. These are advisory: real call sites worth a human's eye, not defects.
Rating them critical would have produced a STOP verdict on a tool millions of people run daily, and
we would have deserved the ridicule.
| Finding | Location | CWE |
|---|---|---|
| Rust: std::process::Command — verify input sanitization | build.rs:40 | CWE-78 |
| Rust: std::process::Command — verify input sanitization | crates/cli/src/decompress.rs:182 | CWE-78 |
| Rust: std::process::Command — verify input sanitization | crates/cli/src/process.rs:162 | CWE-78 |
| Rust: std::process::Command — verify input sanitization | crates/core/flags/hiargs.rs:1373 | CWE-78 |
| Rust: std::process::Command — verify input sanitization | crates/core/search.rs:303 | CWE-78 |
| Command | cargo fetch --locked |
|---|---|
| Why it is safe | cargo fetch downloads crate sources and compiles nothing. build.rs scripts run later, offline. |
| Result | exit 0 |
| Mechanism | Clira recomputed SHA-256 of every .crate and compared it to the checksum in Cargo.lock; cargo also fail-closes on mismatch |
|---|---|
| Result | 52 of 52 crates matched the digest pinned in Cargo.lock |
| Command | cargo test --quiet |
|---|---|
| Result | 118 passed · 0 failed · exit 0 · 23.9s |
"We installed 52 crates" and "we installed exactly the 52 artifacts your lockfile pins" are both
true statements, and only the second is reproducible. Clira recomputes the SHA-256 of every
downloaded crate itself and compares it to Cargo.lock — it does not simply trust that
cargo checked.
Where a repository has no lockfile, or its manifest declares version ranges rather than artifact digests, the packet says unpinned and says why. That is a published fact, not a silent default.
| Sandbox image | clira/sandbox@sha256:62f94465b6e07ebc18f40c13553fa9b46ac1cf9c057cb72950bc7a08ce418be1 |
|---|---|
| Runtime | gVisor (runsc) |
| Network (fetch) | enabled, no untrusted code executed |
| Network (build/test) | none |
| User | 65534:65534 |
| Toolchain | Python 3.12.3 go version go1.22.2 linux/amd64 v22.23.2 |
The signed verdict carries a SHA-256 of the whole evidence document — commit, scan, every finding, both dependency stages, the pinning result, the test result, the image digest and the toolchain.
| Evidence SHA-256 | c814999815010c58e7aa78aad6803ac60264d4999f160dcc85d6abf1c8f94475 |
|---|---|
| Signature | MrvzxoHMrXld2owLpfZOAGTUtG1V12ZYagSFh0XIjYjKRMCnGgrrXw7K0YQfWREBJEn9t/C9A3HgP6NXM+pBAQ== |
| Public key | 15fMX/qUTOyy/TT+1hW2ZxLHNZjUBEZilt5YRkNvT2E= |
Verify this verdict in your browser Download the evidence document
curl -s https://clira.dev/clearance/burntsushi-ripgrep/evidence.json | sha256sum # => c814999815010c58e7aa78aad6803ac60264d4999f160dcc85d6abf1c8f94475
It does not say ripgrep is secure. It says: at this commit, our checks found nothing at critical or high severity, its dependencies matched the digests its lockfile pins, and its suite ran to completion in our sandbox with a recorded result.
No findings were critical or high, so no patches were generated. This packet demonstrates the scan, pinned dependency install and sandboxed test run — not the repair loop.
Stage A reaches crates.io over unrestricted egress rather than an enumerated per-URL allowlist, which is why it executes no untrusted code at all.