lmmx/mibz2

Review signals: 6 known vulnerability.

Reviewed as expected for a test run: attempted writes that failed, so nothing was written; wrote only to its own open file handles.

OSV reports a known vulnerability in this dependency version. zip 3 findings.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• Output is byte-for-byte libbzip2's and every block and stream CRC is checked: Real input produced the expected result: every block CRC checked: identical in libbzip2, lbzip2

  Source: Its output is byte for byte libbzip2's, and every block CRC and stream CRC is checked.

  Input: sample.txt.bz2 (bzip2 -9 of a 5200-byte text)

  Expected: decoded blocks identical in libbzip2 and lbzip2 with CRC checked

  Command: /tmp/rust-user/cargo/bin/cargo run --release --example windows -- /tmp/mibz-out/claim-1 /tmp/mibz-data/sample.txt.bz2

  Observed: every block CRC checked: identical in libbzip2, lbzip2, mibz2 scalar, mibz2 simd, mibz2 simd 3t, mibz2 decode_blocks 1 blocks, 5200 bytes, 0 windows failed Finished `release` profile [optimized + debuginfo] target(s) in 0.21s Running `target/release/examples/windows /tmp/mibz-out/claim-1 /tmp/mibz-data/sample.txt.bz2`

• Documented windows example command decodes a .bz2 window file: Real input produced the expected result: 1 blocks, 5200 bytes, 0 windows failed

  Source: cargo run --release --example windows -- OUT w.bin...

  Input: sample.txt.bz2

  Expected: 1 blocks, 5200 bytes, 0 windows failed

  Command: /tmp/rust-user/cargo/bin/cargo run --release --example windows -- /tmp/mibz-out/claim-2 /tmp/mibz-data/sample.txt.bz2

  Observed: 1 blocks, 5200 bytes, 0 windows failed Finished `release` profile [optimized + debuginfo] target(s) in 0.24s Running `target/release/examples/windows /tmp/mibz-out/claim-2 /tmp/mibz-data/sample.txt.bz2`

Examples

• Repository Python test suite (CI pytest step) runs against the installed mibz2 package: command completed successfully

  Source: README.md ## Python

  Input: python/tests

  Expected: all tests pass

  Command: /tmp/mibz-venv/bin/pytest -q --import-mode=importlib <guest-path>

  Observed: .............. [100%] 14 passed in 0.68s

Local or hosted: local

Decode a real bzip2 (.bz2) file with mibz2 and verify its output and CRCs against libbzip2 and lbzip2, using the README's documented windows example command, plus the repo's Python test suite against the installed wheel.

cd <guest-path> && ls -la && cat README.md 2>/dev/null | head -200; id -u; python3 --version; git status 2>&1 | head -3
cd <guest-path> && git init -q && git remote add origin https://github.com/lmmx/mibz2 && git fetch --depth 1 origin 24169e657c1fe7a4d1d2eb741178266fcf38dea4 2>&1 | tail -3; git reset --mixed FETCH_HEAD 2>&1; git log --oneline -1; git status --short | head; sed -n '/## Benchmark disclosure/,$p' README.md | tail -n +1 | head -60; ls .coldpass
cd /tmp && (python3 -m venv /tmp/mibz-venv 2>&1 || (sudo -n apt-get -o DPkg::Lock::Timeout=300 install -y python3-venv >/tmp/apt.log 2>&1 && python3 -m venv /tmp/mibz-venv)) && /tmp/mibz-venv/bin/pip install -q mibz2 2>&1 | tail -5; /tmp/mibz-venv/bin/pip show mibz2 | head -2; /tmp/mibz-venv/bin/python -c "import mibz2,sys;print(sys.version, mibz2.__file__)"
cd <guest-path> && ls python python/* examples tests | head -40; grep -n "scripts\|\[project" -A3 pyproject.toml | head -30; which bzip2 cargo; cat Justfile | head -40; ls .github/workflows
cd <guest-path> && cat examples/bzcat.rs | head -60; cat .github/workflows/test.yml | grep -n "run:" -A2 | head -40; cat python/tests/test_decode.py | head -30
cd <guest-path> && ls; grep -n "stdin\|stdin_file\|input_file\|expected_file\|output_directory" check.py | head -60
cd <guest-path> && head -30 examples/windows.rs; echo ----; head -25 examples/fuzz.rs
mkdir -p /tmp/mibz-data && cd /tmp/mibz-data && printf 'hello mibz2 pinned sample\n%.0s' $(seq 1 200) > sample.txt && bzip2 -kf -9 sample.txt && ls -l && cd <guest-path> && cargo --version && timeout 900 cargo build --release --example windows 2>&1 | tail -15
cd <guest-path> && grep -n "rust-version\|edition" Cargo.toml; cat rust-toolchain* 2>/dev/null; which rustup; ls ~/.cargo/bin 2>/dev/null; grep -rn "toolchain" .github/workflows/test.yml | head -5
cd /tmp && (curl -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal --default-toolchain stable > /tmp/rustup.log 2>&1; echo rc=$?); tail -3 /tmp/rustup.log; ~/.cargo/bin/cargo --version; ~/.cargo/bin/rustc --version
echo HOME=$HOME; ls -d $HOME/.cargo <guest-path> 2>&1; grep -i "error\|installed\|Rust is installed" /tmp/rustup.log | head -5; <guest-path> --version 2>&1; ls <guest-path>; cat <guest-path> 2>/dev/null | head -20
cd /tmp && (curl -sSf https://sh.rustup.rs | RUSTUP_INIT_SKIP_PATH_CHECK=yes sh -s -- -y --profile minimal --default-toolchain stable > /tmp/rustup2.log 2>&1; echo rc=$?); grep -i "installed\|error" /tmp/rustup2.log | tail -3; <guest-path> --version; <guest-path> --version
ls <host-path> 2>&1 | head; <host-path> --version && <host-path> --version
mkdir -p /tmp/rust-user && cd /tmp/rust-user && curl -sSfO https://static.rust-lang.org/rustup/dist/x86_64-unknown-linux-gnu/rustup-init && chmod +x rustup-init && CARGO_HOME=/tmp/rust-user/cargo RUSTUP_HOME=/tmp/rust-user/rustup RUSTUP_INIT_SKIP_PATH_CHECK=yes ./rustup-init -y --profile minimal --default-toolchain stable --no-modify-path > install.log 2>&1; echo rc=$?; tail -2 install.log; /tmp/rust-user/cargo/bin/cargo --version; /tmp/rust-user/cargo/bin/rustc --version
export PATH=/tmp/rust-user/cargo/bin:$PATH CARGO_HOME=/tmp/rust-user/cargo RUSTUP_HOME=/tmp/rust-user/rustup; cd <guest-path> && timeout 1200 cargo run --release --example windows -- /tmp/mibz-out/windows /tmp/mibz-data/sample.txt.bz2 2>&1 | tail -25; echo rc=${PIPESTATUS[0]}; ls -la /tmp/mibz-out/windows 2>&1
cd <guest-path> && sed -n 30,130p examples/windows.rs
id -u; sudo -n apt-get -o DPkg::Lock::Timeout=300 install -y lbzip2 > /tmp/apt-lbzip2.log 2>&1; echo apt_rc=$?; tail -2 /tmp/apt-lbzip2.log; which lbzip2; export PATH=/tmp/rust-user/cargo/bin:$PATH CARGO_HOME=/tmp/rust-user/cargo RUSTUP_HOME=/tmp/rust-user/rustup; cd <guest-path> && rm -rf /tmp/mibz-out/windows && timeout 1200 cargo run --release --example windows -- /tmp/mibz-out/windows /tmp/mibz-data/sample.txt.bz2 2>&1 | tail -8; echo rc=${PIPESTATUS[0]}; ls -la /tmp/mibz-out/windows
sudo -n apt-get -o DPkg::Lock::Timeout=300 update > /tmp/apt-update.log 2>&1; echo upd_rc=$?; sudo -n apt-get -o DPkg::Lock::Timeout=300 install -y lbzip2 > /tmp/apt-lbzip2.log 2>&1; echo apt_rc=$?; tail -2 /tmp/apt-lbzip2.log; which lbzip2
export PATH=/tmp/rust-user/cargo/bin:$PATH CARGO_HOME=/tmp/rust-user/cargo RUSTUP_HOME=/tmp/rust-user/rustup; cd <guest-path> && rm -rf /tmp/mibz-out/windows && timeout 1200 cargo run --release --example windows -- /tmp/mibz-out/windows /tmp/mibz-data/sample.txt.bz2 2>&1 | tail -8; echo rc=${PIPESTATUS[0]}; ls -la /tmp/mibz-out/windows
cd <guest-path> && /tmp/mibz-venv/bin/pip install -q pytest 2>&1 | tail -2; timeout 900 /tmp/mibz-venv/bin/pytest -q python/tests 2>&1 | tail -6; echo rc=${PIPESTATUS[0]}
cd /tmp && timeout 900 /tmp/mibz-venv/bin/pytest -q --import-mode=importlib <guest-path> 2>&1 | tail -6; echo rc=${PIPESTATUS[0]}
cd <guest-path> && rm -rf /tmp/mibz-out/windows && mkdir -p /tmp/mibz-out && CARGO=/tmp/rust-user/cargo/bin/cargo && ENV='{"PATH":"/tmp/rust-user/cargo/bin:/usr/local/bin:/usr/bin:/bin","CARGO_HOME":"/tmp/rust-user/cargo","RUSTUP_HOME":"/tmp/rust-user/rustup"}' && cat > .coldpass/probe.json <<EOF
{"kind":"cli","argv":["$CARGO","run","--release","--example","windows","--","/tmp/mibz-out/probe","/tmp/mibz-data/sample.txt.bz2"],"cwd":"<guest-path>","env":$ENV,"output_directory":"/tmp/mibz-out/probe","expected_text":"identical in libbzip2, lbzip2"}
EOF
cat > .coldpass/claims.json <<EOF
[
{"kind":"claim","claim":"Output is byte-for-byte libbzip2's and every block and stream CRC is checked","source":"Its output is byte for byte libbzip2's, and every block CRC and stream CRC is checked.","input":"sample.txt.bz2 (bzip2 -9 of a 5200-byte text)","expected":"decoded blocks identical in libbzip2 and lbzip2 with CRC checked","probe_kind":"cli","argv":["$CARGO","run","--release","--example","windows","--","/tmp/mibz-out/claim-1","/tmp/mibz-data/sample.txt.bz2"],"cwd":"<guest-path>","env":$ENV,"output_directory":"/tmp/mibz-out/claim-1","expected_text":"every block CRC checked: identical in libbzip2, lbzip2"},
{"kind":"claim","claim":"Documented windows example command decodes a .bz2 window file","source":"cargo run --release --example windows -- OUT w.bin...","input":"sample.txt.bz2","expected":"1 blocks, 5200 bytes, 0 windows failed","probe_kind":"cli","argv":["$CARGO","run","--release","--example","windows","--","/tmp/mibz-out/claim-2","/tmp/mibz-data/sample.txt.bz2"],"cwd":"<guest-path>","env":$ENV,"output_directory":"/tmp/mibz-out/claim-2","expected_text":"1 blocks, 5200 bytes, 0 windows failed"}
]
EOF
cat > .coldpass/examples.json <<EOF
[
{"kind":"example","claim":"Repository Python test suite (CI pytest step) runs against the installed mibz2 package","source":"README.md ## Python","input":"python/tests","expected":"all tests pass","argv":["/tmp/mibz-venv/bin/pytest","-q","--import-mode=importlib","<guest-path>"],"cwd":"/tmp","env":{},"expected_text":"14 passed"}
]
EOF
echo '{"detected":false,"reason":"Inspected README, src, examples, Justfile and .github workflows: mibz2 is a bzip2 decoder library and CLI-style examples (bzcat, windows); it has no scheduler, cron, daemon, loop, webhook, --once or --now entry point, so there is no product cycle to trigger.","checks":[]}' > .coldpass/cycles.json
python3 -I -c 'import json;[json.load(open(f"<guest-path>")) for n in ["probe.json","claims.json","examples.json","cycles.json"]];print("json ok")'
cd <guest-path> && rm -rf /tmp/mibz-out/probe /tmp/mibz-out/claim-1 /tmp/mibz-out/claim-2 && <env-var>=<guest-path> timeout 1500 python3 -I <guest-path> --validate --replay 2>&1 | tail -60
cd <guest-path> && cat > .coldpass/report.json <<'EOF'
{"outcome":"working","fault_owner":null,"operation":"Decode a real bzip2 (.bz2) file with mibz2 and verify its output and CRCs against libbzip2 and lbzip2, using the README's documented windows example command, plus the repo's Python test suite against the installed wheel.","operation_scope":"Linux x86-64 guest (Ubuntu, Python 3.12.3, Rust 1.99.1 user-local). Covers the README Install step (pip install mibz2, from PyPI, version 0.1.5) and the Rust example 'cargo run --release --example windows'. Not covered: the README's Python API calls (mibz2.decompress / mibz2.open) and bzcat, because the README has no Python CLI and the checker's stdin is UTF-8 text, which cannot carry binary .bz2 data.","steps":["git init; git remote add origin https://github.com/lmmx/mibz2; git fetch --depth 1 origin 24169e657c1fe7a4d1d2eb741178266fcf38dea4; git reset --mixed FETCH_HEAD","python3 -m venv /tmp/mibz-venv; /tmp/mibz-venv/bin/pip install mibz2  (README: pip install mibz2)","bzip2 -9 sample.txt -> sample.txt.bz2 (test input, outside the checkout)","cargo run --release --example windows -- /tmp/mibz-out/probe /tmp/mibz-data/sample.txt.bz2  (README: cargo run --release --example windows -- OUT w.bin...)","/tmp/mibz-venv/bin/pytest -q --import-mode=importlib python/tests  (repo's CI pytest step): 14 passed","<env-var>=<guest-path> python3 -I <guest-path> --validate --replay: valid true, replay PASS"],"deviations":["Guest cargo was 1.75 (distro), too old for Cargo.lock v4 and rust-version 1.80. Installed Rust 1.99.1 with rustup-init into /tmp/rust-user (CARGO_HOME/RUSTUP_HOME there); plain rustup.sh refused because a system Rust was on PATH, so RUSTUP_INIT_SKIP_PATH_CHECK=yes was set. Probes use the absolute cargo path.","'windows' example needs lbzip2 (it compares output against lbzip2; not documented in README). Ran sudo apt-get update, then apt-get install lbzip2 (first install attempt failed: 'Unable to locate package' because the index was stale).","pip install mibz2 resolved to PyPI 0.1.5, while the pinned commit's Rust crate is 0.1.3; the Python tests were run against the PyPI wheel, not a build of the pinned commit.","pytest run from the checkout failed to import (\"No module named mibz2._mibz2\") because the repo's python/ source dir shadowed the installed wheel. Re-ran with --import-mode=importlib from /tmp; 14 passed.","Python API (mibz2.decompress, mibz2.open) and bzcat (cargo run --release --example bzcat -- 4 < f.bz2 > f) were not replayed as probes: no documented Python CLI exists, and the checker's stdin is UTF-8 text so binary .bz2 input cannot be passed. The windows example exercises the same decoder on real .bz2 data.","No cycles: mibz2 has no scheduler/daemon/webhook entry point."],"stuck_step":null,"main_blocker":null,"plain_failure":null,"suggested_fix":null}
EOF
python3 -I -c 'import json;json.load(open("<guest-path>"));print("report ok")'; ls -la .coldpass; ls /tmp/mibz-out
rm -rf /tmp/mibz-out/probe /tmp/mibz-out/claim-1 /tmp/mibz-out/claim-2 && ls -la /tmp/mibz-out && cd <guest-path> && ls -la .coldpass && ls report.json 2>&1 | head -1