# SBOM for caf 0.5.0

> Content addressable file store command-line tool

The Python package caf 0.5.0 ships 6 SBOM files (CycloneDX) inside its wheels, under `.dist-info/sboms/` ([PEP 770](https://peps.python.org/pep-0770/)). Its wheels carry a verified PEP 740 attestation.

- Package URL (PURL): `pkg:pypi/caf@0.5.0`
- PyPI: https://pypi.org/project/caf/0.5.0/
- Requires Python: \>=3.8
- Homepage: <https://github.com/jamesls/caf>

## SBOMs

### caf-0.5.0-py3-none-macosx\_10\_12\_x86\_64.whl

PEP 740 attestation verified (GitHub, jamesls/caf, workflow publish.yml).

- [caf-0.5.0.dist-info/sboms/caf.cyclonedx.json](https://pypi.sbomify.com/artifact/afb99a38-1a97-595d-bb10-9946f1a45d4b/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities

### caf-0.5.0-py3-none-macosx\_11\_0\_arm64.whl

PEP 740 attestation verified (GitHub, jamesls/caf, workflow publish.yml).

- [caf-0.5.0.dist-info/sboms/caf.cyclonedx.json](https://pypi.sbomify.com/artifact/38758b80-f714-5440-a60a-85b4a3aa3e1a/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities

### caf-0.5.0-py3-none-manylinux\_2\_17\_aarch64.manylinux2014\_aarch64.whl

PEP 740 attestation verified (GitHub, jamesls/caf, workflow publish.yml).

- [caf-0.5.0.dist-info/sboms/caf.cyclonedx.json](https://pypi.sbomify.com/artifact/38bc4553-a721-58f5-b2a2-84171450f9ad/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities

### caf-0.5.0-py3-none-manylinux\_2\_17\_x86\_64.manylinux2014\_x86\_64.whl

PEP 740 attestation verified (GitHub, jamesls/caf, workflow publish.yml).

- [caf-0.5.0.dist-info/sboms/caf.cyclonedx.json](https://pypi.sbomify.com/artifact/1027620d-5df0-5f30-baae-ae0444654b2e/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities

### caf-0.5.0-py3-none-musllinux\_1\_2\_aarch64.whl

PEP 740 attestation verified (GitHub, jamesls/caf, workflow publish.yml).

- [caf-0.5.0.dist-info/sboms/caf.cyclonedx.json](https://pypi.sbomify.com/artifact/6e75ec57-ec65-5a7e-a34e-e13f6c3721e9/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities

### caf-0.5.0-py3-none-musllinux\_1\_2\_x86\_64.whl

PEP 740 attestation verified (GitHub, jamesls/caf, workflow publish.yml).

- [caf-0.5.0.dist-info/sboms/caf.cyclonedx.json](https://pypi.sbomify.com/artifact/1b0c0092-3cab-576b-8d65-670e5312f582/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities

## Known vulnerabilities

Components listed in these SBOMs, matched against the [OSV database](https://osv.dev/) as of 2026-11-10.

OSV has no known vulnerabilities for the components these SBOMs list.

## Fetch it over TEA

This SBOM is served over the [Transparency Exchange API](https://github.com/CycloneDX/transparency-exchange-api) (TEA). With the `libtea` client:

```
pip install libtea
python -m libtea https://pypi.sbomify.com pkg:pypi/caf@0.5.0
```

Machine-readable copy of this page: https://pypi.sbomify.com/package/caf/0.5.0.json

---
From pypi-tea by sbomify: https://pypi.sbomify.com/package/caf/0.5.0