CallumWalterWhite/crucible

Review signals: 16 known vulnerability. 2 static matches retained as context.

OSV reports a known vulnerability in this dependency version. 3 distinct locations. 16 findings.

2 hardcoded secret matches retained as context; full list in the evidence.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• The README quickstart Python client query against the local emulator returns 42: Real input produced the expected result: 42

  Source: Expected output: `42`. Anonymous credentials and the explicit endpoint keep this query local.

  Input: SELECT 6 * 7 AS answer via google-cloud-bigquery at http://127.0.0.1:9050

  Expected: 42

  Command: uv run --with google-cloud-bigquery python -

  Observed: 42

• The README health check returns an ok status from the running server: Real input produced the expected result: "status":"ok"

  Source: Check either server with `curl --fail http://127.0.0.1:9050/_crucible/health`.

  Input: GET /_crucible/health

  Expected: status ok

  Command: curl --fail http://127.0.0.1:9050/_crucible/health

  Observed: …"status":"ok","storage":"memory","catalogs":1,"duckdb":"1.5.6","sqlglot":"30.23.0","dialect":"bigquery"} % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0 100 105 100 105 0 0 3638 0 --:--:-- --:--:-- --:--:-- 3750

Examples

• Basic BigQuery query against the local emulator returns an answer row: command completed successfully

  Source: examples/python-bigquery/README.md Scripts table: 01_basic_query.py

  Input: examples/python-bigquery/01_basic_query.py

  Expected: result row {'answer': 4} printed

  Command: uv run --with google-cloud-bigquery python examples/python-bigquery/01_basic_query.py

  Observed: {'id': 1, 'name': 'ada'} {'answer': 4} 3 pages: [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25]

• Create table, INSERT, SELECT and list tables on the local emulator: command completed successfully

  Source: examples/python-bigquery/README.md Scripts table: 02_tables.py

  Input: examples/python-bigquery/02_tables.py

  Expected: inserted rows: 2 printed

  Command: uv run --with google-cloud-bigquery python examples/python-bigquery/02_tables.py

  Observed: inserted rows: 2 1 ada 2 grace num_rows: 2 tables: ['people'] cleaned up example_aa6b52e1

Local or hosted: local

Run the Crucible BigQuery emulator with the README uv command and execute a query through the official google-cloud-bigquery Python client against it

cd <guest-path> && ls -la && git status 2>&1 | head -3; ls /inputs 2>&1; python3 --version; cat README.md 2>/dev/null | head -150
curl -s -m 10 -w '\nHTTP %{http_code}\n' $CDP_URL/json/version; echo; echo "CDP_URL=$CDP_URL"
cd <guest-path> && grep -n "requires-python\|^\[project.optional\|server\s*=" pyproject.toml; ls .coldpass; which uv || (curl -LsSf https://astral.sh/uv/install.sh | sh >/tmp/uvinst.log 2>&1; echo rc=$?; tail -3 /tmp/uvinst.log); ls ~/.local/bin 2>/dev/null
cd <guest-path> && uv --version && uv sync --extra server 2>&1 | tail -15; echo rc=$?
cd <guest-path> && (nohup uv run crucible serve --dialect bigquery > /tmp/crucible-server.log 2>&1 &) ; sleep 8; curl --fail -s http://127.0.0.1:9050/_crucible/health; echo rc=$?; tail -5 /tmp/crucible-server.log
cd <guest-path> && cat > <guest-path> <<'PY'
from google.auth.credentials import AnonymousCredentials
from google.cloud import bigquery

client = bigquery.Client(
    project="local-project",
    credentials=AnonymousCredentials(),
    client_options={"api_endpoint": "http://127.0.0.1:9050"},
)
print(next(iter(client.query("SELECT 6 * 7 AS answer").result())).answer)
client.close()
PY
timeout 240 uv run --with google-cloud-bigquery python - < <guest-path>; echo rc=$?
cd <guest-path> && mkdir -p .coldpass && cat > .coldpass/probe.json <<'EOF'
{"kind":"cli","argv":["uv","run","--with","google-cloud-bigquery","python","-"],"cwd":"<guest-path>","stdin":"from google.auth.credentials import AnonymousCredentials\nfrom google.cloud import bigquery\n\nclient = bigquery.Client(\n    project=\"local-project\",\n    credentials=AnonymousCredentials(),\n    client_options={\"api_endpoint\": \"http://127.0.0.1:9050\"},\n)\nprint(next(iter(client.query(\"SELECT 6 * 7 AS answer\").result())).answer)\nclient.close()\n","expected_text":"42"}
EOF
cat > .coldpass/claims.json <<'EOF'
[{"kind":"claim","claim":"The README quickstart Python client query against the local emulator returns 42","source":"Expected output: `42`. Anonymous credentials and the explicit endpoint keep this query local.","input":"SELECT 6 * 7 AS answer via google-cloud-bigquery at http://127.0.0.1:9050","expected":"42","probe_kind":"cli","argv":["uv","run","--with","google-cloud-bigquery","python","-"],"stdin":"from google.auth.credentials import AnonymousCredentials\nfrom google.cloud import bigquery\n\nclient = bigquery.Client(\n    project=\"local-project\",\n    credentials=AnonymousCredentials(),\n    client_options={\"api_endpoint\": \"http://127.0.0.1:9050\"},\n)\nprint(next(iter(client.query(\"SELECT 6 * 7 AS answer\").result())).answer)\nclient.close()\n","expected_text":"42","cwd":"<guest-path>"},
{"kind":"claim","claim":"The README health check returns an ok status from the running server","source":"Check either server with `curl --fail http://127.0.0.1:9050/_crucible/health`.","input":"GET /_crucible/health","expected":"status ok","probe_kind":"cli","argv":["curl","--fail","http://127.0.0.1:9050/_crucible/health"],"expected_text":"\"status\":\"ok\"","cwd":"<guest-path>"}]
EOF
python3 -m json.tool .coldpass/probe.json >/dev/null && python3 -m json.tool .coldpass/claims.json >/dev/null && echo OK; ls <guest-path>
cd <guest-path> && ls examples/ examples/python-bigquery && sed -n 1,80p examples/python-bigquery/README.md
cd <guest-path> && timeout 240 uv run --with google-cloud-bigquery python examples/python-bigquery/01_basic_query.py; echo rc=$?
cd <guest-path> && timeout 240 uv run --with google-cloud-bigquery python examples/python-bigquery/02_tables.py; echo rc=$?
cd <guest-path> && cat > .coldpass/examples.json <<'EOF'
[{"kind":"example","claim":"Basic BigQuery query against the local emulator returns an answer row","source":"examples/python-bigquery/README.md Scripts table: 01_basic_query.py","input":"examples/python-bigquery/01_basic_query.py","expected":"result row {'answer': 4} printed","argv":["uv","run","--with","google-cloud-bigquery","python","examples/python-bigquery/01_basic_query.py"],"cwd":"<guest-path>","env":{},"expected_text":"{'answer': 4}"},
{"kind":"example","claim":"Create table, INSERT, SELECT and list tables on the local emulator","source":"examples/python-bigquery/README.md Scripts table: 02_tables.py","input":"examples/python-bigquery/02_tables.py","expected":"inserted rows: 2 printed","argv":["uv","run","--with","google-cloud-bigquery","python","examples/python-bigquery/02_tables.py"],"cwd":"<guest-path>","env":{},"expected_text":"inserted rows: 2"}]
EOF
python3 -m json.tool .coldpass/examples.json >/dev/null && echo OK && <env-var>=<guest-path> python3 -I <guest-path> --validate --replay 2>&1 | tail -60
cd <guest-path> && grep -rniE "cron|schedul|--once|webhook|--now|while True" src/ README.md docs/*.md 2>/dev/null | head -10; echo "---"; grep -n "def \|add_argument\|add_parser" src/crucible/cli*.py src/crucible/*/cli*.py 2>/dev/null | head -20; ls src/crucible | head -30
cd <guest-path> && cat > .coldpass/cycles.json <<'EOF'
{"detected":false,"checks":[],"reason":"Inspected README.md, pyproject.toml and src/crucible/cli.py (subcommands: serve, corpus run/record, mirror-schema) and grepped src/, README.md and docs/ for cron, schedule, --once, --now and webhook. The emulator has no scheduler, cron, loop trigger or webhook; the only loops found are internal parsing/hash loops."}
EOF
cat > .coldpass/report.json <<'EOF'
{"outcome":"working","fault_owner":null,"operation":"Run the Crucible BigQuery emulator with the README uv command and execute a query through the official google-cloud-bigquery Python client against it","operation_scope":"Local only: Linux guest, Python 3.12.3 with uv 0.13.5 (README requires Python >=3.11), uv sync --extra server, no Docker, no real BigQuery, anonymous credentials, 127.0.0.1:9050. The shared CDP endpoint was checked (HTTP 200, Chrome/155) but this product does not need a browser.","steps":["uv sync --extra server","uv run crucible serve --dialect bigquery (started in background, port 9050)","curl --fail http://127.0.0.1:9050/_crucible/health","uv run --with google-cloud-bigquery python - (README quickstart heredoc, stdin)","uv run --with google-cloud-bigquery python examples/python-bigquery/01_basic_query.py","uv run --with google-cloud-bigquery python examples/python-bigquery/02_tables.py"],"deviations":["Installed uv via the official astral.sh install script because uv was not preinstalled (uv was in fact already at /usr/local/bin/uv, so the install was not used).","Quickstart client code was fed to 'uv run ... python -' via stdin from a saved copy of the README heredoc, rather than a literal heredoc, to make it probe-able; the commands and code are unchanged.","Server was started by me with nohup and left running until teardown; not started by the checker.","Workspace has no .git metadata, so the pinned-commit git fetch/reset step was not performed; source tree was used as delivered."],"stuck_step":null,"main_blocker":null,"plain_failure":null,"suggested_fix":null}
EOF
python3 -m json.tool .coldpass/cycles.json >/dev/null && python3 -m json.tool .coldpass/report.json >/dev/null && <env-var>=<guest-path> python3 -I <guest-path> --validate --replay 2>&1 | python3 -c "import sys,json; d=json.loads(sys.stdin.read().split('\n',1)[-1] if False else sys.stdin.read()) if False else None; print('checked')" ; <env-var>=<guest-path> python3 -I <guest-path> --validate --replay 2>&1 | grep -o '"valid": [a-z]*\|"status": "[A-Z]*"' | head
cd <guest-path> && cat > .coldpass/report.json <<'EOF'
{"outcome":"working","fault_owner":null,"operation":"Run the Crucible BigQuery emulator with the README uv command and execute a query through the official google-cloud-bigquery Python client against it","operation_scope":"Local only: Linux guest, Python 3.12.3 with uv 0.13.5 (README requires Python >=3.11), uv sync --extra server, no Docker, no real BigQuery, anonymous credentials, 127.0.0.1:9050. The shared CDP endpoint was checked (HTTP 200, Chrome/155) but this product does not need a browser.","steps":["uv sync --extra server","uv run crucible serve --dialect bigquery (started in background, port 9050)","curl --fail http://127.0.0.1:9050/_crucible/health","uv run --with google-cloud-bigquery python - (README quickstart heredoc, stdin)","uv run --with google-cloud-bigquery python examples/python-bigquery/01_basic_query.py","uv run --with google-cloud-bigquery python examples/python-bigquery/02_tables.py"],"deviations":["Quickstart client code was fed to 'uv run ... python -' via stdin from a saved copy of the README heredoc, rather than a literal heredoc, so it could be recorded as a probe. Commands and code are unchanged.","Server was started by me with nohup and left running until teardown; not started by the checker.","Workspace has no .git metadata, so the pinned-commit git fetch/reset step was not performed; source tree was used as delivered."],"stuck_step":null,"main_blocker":null,"plain_failure":null,"suggested_fix":null}
EOF
python3 -m json.tool .coldpass/report.json >/dev/null && echo OK && <env-var>=<guest-path> python3 -I <guest-path> --validate --replay 2>&1 | grep -o '"valid": [a-z]*\|"status": "[A-Z]*"' | head