BuildTrace is a Linux-first Cargo build capability recorder and policy-diff tool. It helps Rust teams review what dependency build scripts and procedural macros do during a build: files they access, programs they start, and network connections they make.
Pre-alpha. cargo buildtrace inventory is implemented and tested. record, propose, and diff are designed but not implemented yet.
# Inventory build scripts and procedural macros without executing them.
cargo buildtrace inventory
# Record build-time behavior while Cargo runs as a child process.
cargo buildtrace record -- cargo check --workspace
# Propose a reviewable, source-pinned policy.
cargo buildtrace propose > buildtrace.toml
# Fail CI when a dependency expands approved capabilities.
cargo buildtrace diff --policy buildtrace.tomlBuildTrace records evidence; it does not grant permissions, sandbox a build, or claim that a clean report proves a dependency is safe.
The first release targets Linux and observes selected file, process, and network operations through ptrace. Reports are designed to be deterministic and reviewable in CI. Proc-macro attribution and trace completeness are reported with explicit confidence and limitation information.
Version 1 does not enforce permissions, trace application runtime behavior, support every operating system, send telemetry, or upload traces.
Requires a current Rust toolchain. From the repository root:
cargo fmt --all --check
cargo clippy --workspace --all-targets -- -D warnings
cargo test --workspace
cargo run -p buildtrace-cli -- inventoryRepository conventions for people and agents are in AGENTS.md.
Raw traces may contain sensitive local paths and command data. BuildTrace is designed to keep traces local, avoid recording environment-variable values by default, redact credentials from arguments and URLs, and label uncertain or incomplete attribution rather than overstate it.
The project is not ready for external contributions yet. Please open an issue before proposing a substantial change, so its scope can be agreed against the product plan. See CONTRIBUTING.md.
Licensed under either of MIT or Apache-2.0, at your option.