# SBOM for decentriq-transparency-verification 0.3.0 The Python package decentriq-transparency-verification 0.3.0 ships 18 SBOM files (CycloneDX) inside its wheels, under `.dist-info/sboms/` ([PEP 770](https://peps.python.org/pep-0770/)). - Package URL (PURL): `pkg:pypi/decentriq-transparency-verification@0.3.0` - PyPI: https://pypi.org/project/decentriq-transparency-verification/0.3.0/ - Requires Python: \>=3.11 ## SBOMs ### decentriq\_transparency\_verification-0.3.0-cp311-cp311-macosx\_10\_12\_x86\_64.macosx\_11\_0\_arm64.macosx\_10\_12\_universal2.whl - [decentriq\_transparency\_verification-0.3.0.dist-info/sboms/delta-transparency-verification-python.cyclonedx.json](https://pypi.sbomify.com/artifact/bcc4d29c-10e4-5d32-b6c3-c347708bf7b3/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 12 known vulnerabilities ### decentriq\_transparency\_verification-0.3.0-cp311-cp311-macosx\_10\_12\_x86\_64.whl - [decentriq\_transparency\_verification-0.3.0.dist-info/sboms/delta-transparency-verification-python.cyclonedx.json](https://pypi.sbomify.com/artifact/64903747-0c01-5356-9217-f9aa3ea2e584/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 12 known vulnerabilities ### decentriq\_transparency\_verification-0.3.0-cp311-cp311-manylinux\_2\_17\_aarch64.manylinux2014\_aarch64.whl - [decentriq\_transparency\_verification-0.3.0.dist-info/sboms/delta-transparency-verification-python.cyclonedx.json](https://pypi.sbomify.com/artifact/fd56a2d9-720d-5b1c-ae0a-96ae2e5df516/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 12 known vulnerabilities ### decentriq\_transparency\_verification-0.3.0-cp311-cp311-manylinux\_2\_17\_x86\_64.manylinux2014\_x86\_64.whl - [decentriq\_transparency\_verification-0.3.0.dist-info/sboms/delta-transparency-verification-python.cyclonedx.json](https://pypi.sbomify.com/artifact/731221d4-6aae-5e10-95ae-39427b2c9cd6/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 12 known vulnerabilities ### decentriq\_transparency\_verification-0.3.0-cp311-cp311-win32.whl - [decentriq\_transparency\_verification-0.3.0.dist-info/sboms/delta-transparency-verification-python.cyclonedx.json](https://pypi.sbomify.com/artifact/f4cc2dcc-0950-5a93-80c0-c5b865eca9ef/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 13 known vulnerabilities ### decentriq\_transparency\_verification-0.3.0-cp311-cp311-win\_amd64.whl - [decentriq\_transparency\_verification-0.3.0.dist-info/sboms/delta-transparency-verification-python.cyclonedx.json](https://pypi.sbomify.com/artifact/d628186e-4c0e-5290-9479-aa2b59b975e0/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 13 known vulnerabilities ### decentriq\_transparency\_verification-0.3.0-cp312-cp312-macosx\_10\_12\_x86\_64.macosx\_11\_0\_arm64.macosx\_10\_12\_universal2.whl - [decentriq\_transparency\_verification-0.3.0.dist-info/sboms/delta-transparency-verification-python.cyclonedx.json](https://pypi.sbomify.com/artifact/60043033-fea6-57e1-b06b-a8e1d6de40d5/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 12 known vulnerabilities ### decentriq\_transparency\_verification-0.3.0-cp312-cp312-macosx\_10\_12\_x86\_64.whl - [decentriq\_transparency\_verification-0.3.0.dist-info/sboms/delta-transparency-verification-python.cyclonedx.json](https://pypi.sbomify.com/artifact/2b01712e-a3a1-5742-8595-4370c8c71edc/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 12 known vulnerabilities ### decentriq\_transparency\_verification-0.3.0-cp312-cp312-manylinux\_2\_17\_aarch64.manylinux2014\_aarch64.whl - [decentriq\_transparency\_verification-0.3.0.dist-info/sboms/delta-transparency-verification-python.cyclonedx.json](https://pypi.sbomify.com/artifact/ad15505d-d1c7-5baf-8c1a-937dde221e34/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 12 known vulnerabilities ### decentriq\_transparency\_verification-0.3.0-cp312-cp312-manylinux\_2\_17\_x86\_64.manylinux2014\_x86\_64.whl - [decentriq\_transparency\_verification-0.3.0.dist-info/sboms/delta-transparency-verification-python.cyclonedx.json](https://pypi.sbomify.com/artifact/3b15a372-4c36-5bce-a45d-bcede66080d9/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 12 known vulnerabilities ### decentriq\_transparency\_verification-0.3.0-cp312-cp312-win32.whl - [decentriq\_transparency\_verification-0.3.0.dist-info/sboms/delta-transparency-verification-python.cyclonedx.json](https://pypi.sbomify.com/artifact/546c1473-aa11-5421-880f-60055f865511/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 13 known vulnerabilities ### decentriq\_transparency\_verification-0.3.0-cp312-cp312-win\_amd64.whl - [decentriq\_transparency\_verification-0.3.0.dist-info/sboms/delta-transparency-verification-python.cyclonedx.json](https://pypi.sbomify.com/artifact/8168a017-4749-59f2-838a-50425c51c4ac/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 13 known vulnerabilities ### decentriq\_transparency\_verification-0.3.0-cp313-cp313-macosx\_10\_12\_x86\_64.macosx\_11\_0\_arm64.macosx\_10\_12\_universal2.whl - [decentriq\_transparency\_verification-0.3.0.dist-info/sboms/delta-transparency-verification-python.cyclonedx.json](https://pypi.sbomify.com/artifact/82b89c69-171a-5330-b90c-c80518c47c1a/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 12 known vulnerabilities ### decentriq\_transparency\_verification-0.3.0-cp313-cp313-macosx\_10\_12\_x86\_64.whl - [decentriq\_transparency\_verification-0.3.0.dist-info/sboms/delta-transparency-verification-python.cyclonedx.json](https://pypi.sbomify.com/artifact/d8518d9a-5f19-51d9-943c-80d655c104a1/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 12 known vulnerabilities ### decentriq\_transparency\_verification-0.3.0-cp313-cp313-manylinux\_2\_17\_aarch64.manylinux2014\_aarch64.whl - [decentriq\_transparency\_verification-0.3.0.dist-info/sboms/delta-transparency-verification-python.cyclonedx.json](https://pypi.sbomify.com/artifact/d3a958f3-e49e-5d7a-accb-66318219bb95/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 12 known vulnerabilities ### decentriq\_transparency\_verification-0.3.0-cp313-cp313-manylinux\_2\_17\_x86\_64.manylinux2014\_x86\_64.whl - [decentriq\_transparency\_verification-0.3.0.dist-info/sboms/delta-transparency-verification-python.cyclonedx.json](https://pypi.sbomify.com/artifact/9a1b4d9a-65d1-5f11-9a9f-80234abc96cd/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 12 known vulnerabilities ### decentriq\_transparency\_verification-0.3.0-cp313-cp313-win32.whl - [decentriq\_transparency\_verification-0.3.0.dist-info/sboms/delta-transparency-verification-python.cyclonedx.json](https://pypi.sbomify.com/artifact/979e2c5e-4a5b-5018-8569-c403e1b4002b/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 13 known vulnerabilities ### decentriq\_transparency\_verification-0.3.0-cp313-cp313-win\_amd64.whl - [decentriq\_transparency\_verification-0.3.0.dist-info/sboms/delta-transparency-verification-python.cyclonedx.json](https://pypi.sbomify.com/artifact/a3539a11-0ef8-5f58-a8df-9fdec0795c00/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 13 known vulnerabilities ## Known vulnerabilities Components listed in these SBOMs, matched against the [OSV database](https://osv.dev/) as of 2026-11-10. | Vulnerability | Severity | Component | Fixed in | Summary | |---|---|---|---|---| | [CVE-2026-6967](https://insights.sbomify.com/CVE-2026-6967/) | high (7.1) | tough 0.17.1 (crates.io) | 0.22.0 | awslabs/tough is Missing Delegated Metadata Validation | | [CVE-2026-6966](https://insights.sbomify.com/CVE-2026-6966/) | high (7.0) | tough 0.17.1 (crates.io) | 0.22.0 | awslabs/tough Delegated Roles have a Signature Threshold Bypass | | [CVE-2023-49092](https://insights.sbomify.com/CVE-2023-49092/) | medium (5.9) | rsa 0.9.8 (crates.io) | 0.10.0 | Marvin Attack: potential key recovery through timing sidechannels | | [CVE-2025-2885](https://insights.sbomify.com/CVE-2025-2885/) | medium (5.7) | tough 0.17.1 (crates.io) | 0.20.0 | tough root metadata version is not checked for sequential versioning | | [CVE-2025-2886](https://insights.sbomify.com/CVE-2025-2886/) | medium (5.7) | tough 0.17.1 (crates.io) | 0.20.0 | tough terminating targets role delegations are not respected | | [CVE-2025-2887](https://insights.sbomify.com/CVE-2025-2887/) | medium (5.7) | tough 0.17.1 (crates.io) | 0.20.0 | tough failure to detect delegated target rollback | | [CVE-2025-2888](https://insights.sbomify.com/CVE-2025-2888/) | medium (5.7) | tough 0.17.1 (crates.io) | 0.20.0 | tough timestamp metadata is cached when it fails snapshot rollback check | | [CVE-2026-21895](https://insights.sbomify.com/CVE-2026-21895/) | low (2.7) | rsa 0.9.8 (crates.io) | 0.9.10 | rsa crate has potential panic on a prime being equal to 1 | | [GHSA-j8x2-777p-23fc](https://osv.dev/vulnerability/GHSA-j8x2-777p-23fc) | low (2.7) | tough 0.17.1 (crates.io) | 0.20.0 | tough cyclic delegation graphs are not detected | | [RUSTSEC-2026-0387](https://osv.dev/vulnerability/RUSTSEC-2026-0387) | unknown | crypto-bigint 0.5.5 (crates.io) | 0.7.6 | Multiple timing variability issues in operations intended to be constant-time | | [RUSTSEC-2026-0418](https://osv.dev/vulnerability/RUSTSEC-2026-0418) | unknown | libz-sys 1.1.22 (crates.io) | 1.1.31 | libz-sys build script leaks environment variables in the build directory | | [RUSTSEC-2026-0441](https://osv.dev/vulnerability/RUSTSEC-2026-0441) | unknown | pin-utils 0.1.0 (crates.io) | none listed | \`pin-utils\` is unmaintained | | [RUSTSEC-2026-0386](https://osv.dev/vulnerability/RUSTSEC-2026-0386) | unknown | tokio 1.46.0 (crates.io) | 1.51.6 | \`AsyncFd::new\` and related constructors violate I/O safety | ## Fetch it over TEA This SBOM is served over the [Transparency Exchange API](https://github.com/CycloneDX/transparency-exchange-api) (TEA). With the `libtea` client: ``` pip install libtea python -m libtea https://pypi.sbomify.com pkg:pypi/decentriq-transparency-verification@0.3.0 ``` Machine-readable copy of this page: https://pypi.sbomify.com/package/decentriq-transparency-verification/0.3.0.json --- From pypi-tea by sbomify: https://pypi.sbomify.com/package/decentriq-transparency-verification/0.3.0