Experimenting with valgrind - I don't intend to check this in as-is (for one, I'd need to make the OpenSSL suppressions work for everyone) but take a look? https://codereview.appspot.com/6811056/diff/1/src/suppressions File src/suppressions (right): https://codereview.appspot.com/6811056/diff/1/src/suppressions#newcode2 src/suppressions:2: <openssl-rand0> These two are by design (OpenSSL without -DPURIFY gathering randomness). https://codereview.appspot.com/6811056/diff/1/src/suppressions#newcode18 src/suppressions:18: fun:_ZN4util24WriteTemporaryBinaryFileERKSsS1_ Line 124 in util.cc: ssize_t bytes_written = write(fd, reinterpret_cast<const char*>(data.data()), data.length()); // line 124 The data in question is a serialized protobuf. https://codereview.appspot.com/6811056/diff/1/src/suppressions#newcode24 src/suppressions:24: fun:_ZN4util9HexStringERKSs Line 41 in util.cc: string HexString(const string &data) { string ret; for (unsigned int i = 0; i < data.size(); ++i) { ret.push_back(nibble[(data[i] >> 4) & 0xf]); // line 41 ret.push_back(nibble[data[i] & 0xf]); } return ret; } Ditto, data is a serialized protobuf. https://codereview.appspot.com/6811056/diff/1/src/suppressions#newcode34 src/suppressions:34: fun:_ZN8SQLiteDB30CreatePendingCertificateEntry_ERKN2ct17LoggedCertificateE The next two are from sqlite_db.cc