NVIDIA/cccl

Review signals: 1 download and execute, 4 hardcoded secret.

Reviewed as expected for a test run: attempted writes that failed, so nothing was written.

Source contains download and execute; review its purpose. ci/pyenv_helper.sh

Gitleaks found a possible hardcoded secret; value withheld. 2 distinct locations. 4 findings.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• CCCL is header-only and the convenience installer copies its headers into the prefix: Real input produced the expected result: Installing: <guest-path>

  Source: Everything in CCCL is header-only.

  Input: ci/install_cccl.sh <guest-path>

  Expected: cub.cuh header installed under the prefix

  Command: bash ci/install_cccl.sh <guest-path>

  Observed: Installing: <guest-path> -- Installing: <guest-path> -- Installing: <guest-path> -- Installing: <guest-path> -- Installing: <guest-path> -- Installing: <guest-path> -- Installing: <guest-path> -- Installing: /tmp/coldpas

• A convenience script installs CCCL to a given directory: Real input produced the expected result: Install CCCL - Success

  Source: ci/install_cccl.sh /usr/local

  Input: ci/install_cccl.sh <guest-path>

  Expected: install finishes with success banner

  Command: bash ci/install_cccl.sh <guest-path>

  Observed: Install CCCL - Success - Duration: 3s ================== 

Examples

• Installation example project (examples/basic) builds CCCL demo: Not runnable in this VM: examples/basic declares project(CCCLDemo CUDA), needs an NVIDIA nvcc (none installed, no /usr/local/cuda, no GPU) and fetches CCCL from GitHub via CPM. Ran the README installer ci/install_cccl.sh instead, which is the documented install path.

  Source: examples/basic/README.md

  Expected: documented command completes successfully

  Observed: Not runnable in this VM: examples/basic declares project(CCCLDemo CUDA), needs an NVIDIA nvcc (none installed, no /usr/local/cuda, no GPU) and fetches CCCL from GitHub via CPM. Ran the README installer ci/install_cccl.sh instead, which is the documented install path.

Local or hosted: both

Install CCCL headers and CMake package files with the README's convenience installer: bash ci/install_cccl.sh <prefix>

cd <guest-path> && pwd && ls -la && id -u && cat /etc/os-release | head -3 && git -C . rev-parse 2>&1 | head -1; ls /inputs 2>/dev/null; python3 --version
cd <guest-path> && ls README* && head -c 6000 README.md
cd <guest-path> && sed -n '/## Getting Started/,/## License/p' README.md | head -c 9000; echo; ls .coldpass 2>/dev/null; which nvcc cmake g++ clang++ nvidia-smi 2>&1; echo CDP=$CDP_URL $<env-var>
cd <guest-path> && which cmake make; cmake --version 2>&1|head -1; g++ --version | head -1; ls /usr/local/cuda 2>&1 | head -2; cat ci/install_cccl.sh | head -60; cat cccl-version.json; sudo -n true && echo SUDO_OK
cd <guest-path> && grep -n "cmake_minimum_required" CMakeLists.txt; grep -n -i "cmake" CONTRIBUTING.md | head; sudo apt-get -o DPkg::Lock::Timeout=300 update -qq 2>&1 | tail -2; sudo apt-get -o DPkg::Lock::Timeout=300 install -y -qq cmake 2>&1 | tail -3; cmake --version | head -1
cd <guest-path> && ls <guest-path> 2>&1; timeout 1500 bash ci/install_cccl.sh <guest-path> 2>&1 | tail -30; echo EXIT=${PIPESTATUS[0]}; ls <guest-path> 2>&1
cd <guest-path> && ls include | head -20; ls include/cub/cub.cuh include/thrust/device_vector.h include/cuda/std/atomic 2>&1; ls lib/cmake; cd <guest-path> && ls examples/basic && sed -n 1,40p examples/basic/CMakeLists.txt; ls .coldpass
cd <guest-path> && mkdir -p <guest-path> .coldpass && ls <guest-path> /inputs/coldpass-preflight.py 2>&1; cat > .coldpass/probe.json <<'EOF'
{"kind":"cli","argv":["bash","ci/install_cccl.sh","<guest-path>"],"cwd":"<guest-path>","output_directory":"<guest-path>","expected_text":"Install CCCL - Success"}
EOF
cat > .coldpass/claims.json <<'EOF'
[
{"kind":"claim","claim":"CCCL is header-only and the convenience installer copies its headers into the prefix","source":"README.md","quote":"Everything in CCCL is header-only.","input":"ci/install_cccl.sh <guest-path>","expected":"cub.cuh header installed under the prefix","probe_kind":"cli","argv":["bash","ci/install_cccl.sh","<guest-path>"],"cwd":"<guest-path>","output_directory":"<guest-path>","expected_text":"Installing: <guest-path>"},
{"kind":"claim","claim":"A convenience script installs CCCL to a given directory","source":"README.md","quote":"ci/install_cccl.sh /usr/local","input":"ci/install_cccl.sh <guest-path>","expected":"install finishes with success banner","probe_kind":"cli","argv":["bash","ci/install_cccl.sh","<guest-path>"],"cwd":"<guest-path>","output_directory":"<guest-path>","expected_text":"Install CCCL - Success"}
]
EOF
cat > .coldpass/examples.json <<'EOF'
[
{"kind":"example","claim":"Installation example project (examples/basic) builds CCCL demo","source":"examples/basic/README.md","reason":"Not runnable in this VM: examples/basic declares project(CCCLDemo CUDA), needs an NVIDIA nvcc (none installed, no /usr/local/cuda, no GPU) and fetches CCCL from GitHub via CPM. Ran the README installer ci/install_cccl.sh instead, which is the documented install path."}
]
EOF
cat > .coldpass/cycles.json <<'EOF'
{"detected":false,"reason":"CCCL is a header-only C++ library with a one-shot CMake install (ci/install_cccl.sh / cmake --preset install). Inspected README.md and the entry points: no scheduler, cron, loop, webhook, --once or --now trigger in the product.","checks":[]}
EOF
python3 -m json.tool .coldpass/probe.json >/dev/null && python3 -m json.tool .coldpass/claims.json >/dev/null && python3 -m json.tool .coldpass/examples.json >/dev/null && python3 -m json.tool .coldpass/cycles.json >/dev/null && echo JSON_OK; ls <guest-path>
cd <guest-path> && cat > .coldpass/claims.json <<'EOF'
[
{"kind":"claim","claim":"CCCL is header-only and the convenience installer copies its headers into the prefix","source":"Everything in CCCL is header-only.","input":"ci/install_cccl.sh <guest-path>","expected":"cub.cuh header installed under the prefix","probe_kind":"cli","argv":["bash","ci/install_cccl.sh","<guest-path>"],"cwd":"<guest-path>","output_directory":"<guest-path>","expected_text":"Installing: <guest-path>"},
{"kind":"claim","claim":"A convenience script installs CCCL to a given directory","source":"ci/install_cccl.sh /usr/local","input":"ci/install_cccl.sh <guest-path>","expected":"install finishes with success banner","probe_kind":"cli","argv":["bash","ci/install_cccl.sh","<guest-path>"],"cwd":"<guest-path>","output_directory":"<guest-path>","expected_text":"Install CCCL - Success"}
]
EOF
python3 -m json.tool .coldpass/claims.json >/dev/null && echo OK; <env-var>=<guest-path> python3 -I <guest-path> --validate --replay 2>&1 | tail -60
cd <guest-path> && cat > .coldpass/report.json <<'EOF'
{"outcome":"working","fault_owner":null,"operation":"Install CCCL headers and CMake package files with the README's convenience installer: bash ci/install_cccl.sh <prefix>","operation_scope":"Header-only library install on Ubuntu 24.04 (x86-64 WSL2 guest, root-capable user with sudo). Needs cmake >= 3.21 and make/g++. Not covered: compiling CUDA code with nvcc (no CUDA toolkit or GPU in this VM), so GPU builds and the examples/basic CPM project were not run.","steps":["git init / fetch of pinned commit: not needed, source snapshot already present in <guest-path>","sudo apt-get -o DPkg::Lock::Timeout=300 update && sudo apt-get -o DPkg::Lock::Timeout=300 install -y cmake  (cmake 3.28.3 installed)","bash ci/install_cccl.sh <guest-path>  (README 'A convenience script is also provided'; exit 0, installed include/, lib/cmake/)","bash ci/install_cccl.sh <guest-path>  (replayed probe: 'Install CCCL - Success')"],"deviations":["Installed cmake via apt because the VM had no cmake; the README's install section assumes cmake is present.","Used ci/install_cccl.sh (the README's documented convenience script, which runs cmake --preset install) rather than the in-source 'cmake . && make install' form, to keep build files out of the source tree. Both are documented.","examples/basic (CPM-based CUDA demo) not run: needs nvcc and network fetch from GitHub; no CUDA toolkit or GPU in the VM. Recorded as a blocked example.","README's nvcc compile example not run for the same reason."],"stuck_step":null,"main_blocker":null,"plain_failure":null,"suggested_fix":"None for the install path. To test GPU usage, run the VM with a CUDA toolkit and an NVIDIA GPU, then compile the README example with nvcc."}
EOF
python3 -m json.tool .coldpass/report.json >/dev/null && echo REPORT_OK; <env-var>=<guest-path> python3 -I <guest-path> --validate --replay 2>&1 | head -c 400
cd <guest-path> && rm -rf <guest-path> <guest-path> <guest-path> && <env-var>=<guest-path> python3 -I <guest-path> --validate --replay > <guest-path> 2>&1; echo EXIT=$?; python3 -c "
import json,sys
d=json.load(open('<guest-path>'))
print('valid',d.get('valid'),'problems',d.get('problems'))
print('replay',d.get('replay',{}).get('status'))
" ; rm -rf <guest-path> <guest-path> <guest-path>; ls -la <guest-path>