Clira · clearance packet · public sample

BurntSushi/ripgrep — cleared at commit 3fce3b5b

A real packet on a repository whose dependencies are lockfile-pinned. Every one of the 52 crates was independently re-hashed and matched against Cargo.lock before any code ran, then the full suite executed offline in the sandbox.

GO 0 critical · 0 high · 5 medium advisories
118 tests passed in the sandbox
52/52 crates independently verified against Cargo.lock
status verified — 52 digests declared, all matched

What was scanned

Repositoryhttps://github.com/BurntSushi/ripgrep
Commit3fce3b5bb0236da2df6d99672afb8a719642eca7
Scanned at2026-08-12T20:14:51Z UTC
Scope233 files · 67,438 lines · {"Rust": 89, "Ruby": 1}
Findings5 — all medium, none blocking

The findings, in full

ripgrep spawns subprocesses deliberately — decompression preprocessors and the --pre command. These are advisory: real call sites worth a human's eye, not defects. Rating them critical would have produced a STOP verdict on a tool millions of people run daily, and we would have deserved the ridicule.

FindingLocationCWE
Rust: std::process::Command — verify input sanitizationbuild.rs:40CWE-78
Rust: std::process::Command — verify input sanitizationcrates/cli/src/decompress.rs:182CWE-78
Rust: std::process::Command — verify input sanitizationcrates/cli/src/process.rs:162CWE-78
Rust: std::process::Command — verify input sanitizationcrates/core/flags/hiargs.rs:1373CWE-78
Rust: std::process::Command — verify input sanitizationcrates/core/search.rs:303CWE-78

How the dependencies were installed

Stage A — fetch · network ENABLED · untrusted code NEVER RUN

Commandcargo fetch --locked
Why it is safecargo fetch downloads crate sources and compiles nothing. build.rs scripts run later, offline.
Resultexit 0

Verification — before any of it executed

MechanismClira recomputed SHA-256 of every .crate and compared it to the checksum in Cargo.lock; cargo also fail-closes on mismatch
Result52 of 52 crates matched the digest pinned in Cargo.lock

Stage C — test · network NONE

Commandcargo test --quiet
Result118 passed · 0 failed · exit 0 · 23.9s

Why the pinning line matters

"We installed 52 crates" and "we installed exactly the 52 artifacts your lockfile pins" are both true statements, and only the second is reproducible. Clira recomputes the SHA-256 of every downloaded crate itself and compares it to Cargo.lock — it does not simply trust that cargo checked.

Where a repository has no lockfile, or its manifest declares version ranges rather than artifact digests, the packet says unpinned and says why. That is a published fact, not a silent default.

The environment it ran in

Sandbox imageclira/sandbox@sha256:62f94465b6e07ebc18f40c13553fa9b46ac1cf9c057cb72950bc7a08ce418be1
RuntimegVisor (runsc)
Network (fetch)enabled, no untrusted code executed
Network (build/test)none
User65534:65534
ToolchainPython 3.12.3
go version go1.22.2 linux/amd64
v22.23.2

The signature

The signed verdict carries a SHA-256 of the whole evidence document — commit, scan, every finding, both dependency stages, the pinning result, the test result, the image digest and the toolchain.

Evidence SHA-256c814999815010c58e7aa78aad6803ac60264d4999f160dcc85d6abf1c8f94475
SignatureMrvzxoHMrXld2owLpfZOAGTUtG1V12ZYagSFh0XIjYjKRMCnGgrrXw7K0YQfWREBJEn9t/C9A3HgP6NXM+pBAQ==
Public key15fMX/qUTOyy/TT+1hW2ZxLHNZjUBEZilt5YRkNvT2E=

Verify this verdict in your browser Download the evidence document

curl -s https://clira.dev/clearance/burntsushi-ripgrep/evidence.json | sha256sum
# => c814999815010c58e7aa78aad6803ac60264d4999f160dcc85d6abf1c8f94475

What this packet does not claim

It does not say ripgrep is secure. It says: at this commit, our checks found nothing at critical or high severity, its dependencies matched the digests its lockfile pins, and its suite ran to completion in our sandbox with a recorded result.

No findings were critical or high, so no patches were generated. This packet demonstrates the scan, pinned dependency install and sandboxed test run — not the repair loop.

Stage A reaches crates.io over unrestricted egress rather than an enumerated per-URL allowlist, which is why it executes no untrusted code at all.