# SBOM for devolutions-crypto 2026.6.22 > An abstraction layer for the cryptography used by Devolutions The Python package devolutions-crypto 2026.6.22 ships 8 SBOM files (CycloneDX) inside its wheels, under `.dist-info/sboms/` ([PEP 770](https://peps.python.org/pep-0770/)). Its wheels carry a verified PEP 740 attestation. - Package URL (PURL): `pkg:pypi/devolutions-crypto@2026.6.22` - PyPI: https://pypi.org/project/devolutions-crypto/2026.6.22/ - License: MIT OR Apache-2.0 - Requires Python: \>=3.10 - Homepage: - Repository: ## SBOMs ### devolutions\_crypto-2026.6.22-py3-none-macosx\_10\_12\_x86\_64.whl PEP 740 attestation verified (GitHub, Devolutions/devolutions-crypto, workflow release-others.yml). - [devolutions\_crypto-2026.6.22.dist-info/sboms/devolutions-crypto-uniffi.cyclonedx.json](https://pypi.sbomify.com/artifact/6de4d4bb-56cd-51f4-927d-4b7e3730cf6f/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities ### devolutions\_crypto-2026.6.22-py3-none-macosx\_11\_0\_arm64.whl PEP 740 attestation verified (GitHub, Devolutions/devolutions-crypto, workflow release-others.yml). - [devolutions\_crypto-2026.6.22.dist-info/sboms/devolutions-crypto-uniffi.cyclonedx.json](https://pypi.sbomify.com/artifact/ed553aff-1172-5370-86cf-a08a731e7a3e/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities ### devolutions\_crypto-2026.6.22-py3-none-manylinux\_2\_34\_aarch64.whl PEP 740 attestation verified (GitHub, Devolutions/devolutions-crypto, workflow release-others.yml). - [devolutions\_crypto-2026.6.22.dist-info/sboms/devolutions-crypto-uniffi.cyclonedx.json](https://pypi.sbomify.com/artifact/b120fbe8-5fcc-5a83-9177-ae47f4acd010/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities ### devolutions\_crypto-2026.6.22-py3-none-manylinux\_2\_34\_i686.whl PEP 740 attestation verified (GitHub, Devolutions/devolutions-crypto, workflow release-others.yml). - [devolutions\_crypto-2026.6.22.dist-info/sboms/devolutions-crypto-uniffi.cyclonedx.json](https://pypi.sbomify.com/artifact/d1e943b7-3cb1-5932-93f1-0d62ebe02cd1/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities ### devolutions\_crypto-2026.6.22-py3-none-manylinux\_2\_34\_x86\_64.whl PEP 740 attestation verified (GitHub, Devolutions/devolutions-crypto, workflow release-others.yml). - [devolutions\_crypto-2026.6.22.dist-info/sboms/devolutions-crypto-uniffi.cyclonedx.json](https://pypi.sbomify.com/artifact/0c6f8dff-af4c-5f62-b8cf-54598178929c/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities ### devolutions\_crypto-2026.6.22-py3-none-win32.whl PEP 740 attestation verified (GitHub, Devolutions/devolutions-crypto, workflow release-others.yml). - [devolutions\_crypto-2026.6.22.dist-info/sboms/devolutions-crypto-uniffi.cyclonedx.json](https://pypi.sbomify.com/artifact/b14263ae-dff5-5cd0-9c56-cfc59838de18/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities ### devolutions\_crypto-2026.6.22-py3-none-win\_amd64.whl PEP 740 attestation verified (GitHub, Devolutions/devolutions-crypto, workflow release-others.yml). - [devolutions\_crypto-2026.6.22.dist-info/sboms/devolutions-crypto-uniffi.cyclonedx.json](https://pypi.sbomify.com/artifact/bbfad598-3a93-5a11-91c7-b061fb198d28/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities ### devolutions\_crypto-2026.6.22-py3-none-win\_arm64.whl PEP 740 attestation verified (GitHub, Devolutions/devolutions-crypto, workflow release-others.yml). - [devolutions\_crypto-2026.6.22.dist-info/sboms/devolutions-crypto-uniffi.cyclonedx.json](https://pypi.sbomify.com/artifact/09fc52b9-20dd-55eb-876f-e812efcb65df/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities ## Known vulnerabilities Components listed in these SBOMs, matched against the [OSV database](https://osv.dev/) as of 2026-11-10. | Vulnerability | Severity | Component | Fixed in | Summary | |---|---|---|---|---| | [GHSA-qwgh-2vcv-g2f7](https://osv.dev/vulnerability/GHSA-qwgh-2vcv-g2f7) | medium (6.3) | block-buffer 0.12.0 (crates.io) | none listed | block\_buffer: panic corrupts inline buffer position | | [RUSTSEC-2026-0190](https://osv.dev/vulnerability/RUSTSEC-2026-0190) | unknown | anyhow 1.0.102 (crates.io) | 1.0.103 | Unsoundness in \`Error::downcast\_mut()\` | | [RUSTSEC-2026-0374](https://osv.dev/vulnerability/RUSTSEC-2026-0374) | unknown | basic-toml 0.1.10 (crates.io) | none listed | \`basic-toml\` is unmaintained | | [RUSTSEC-2026-0385](https://osv.dev/vulnerability/RUSTSEC-2026-0385) | unknown | ctutils 0.4.2 (crates.io) | 0.4.4 | Non-constant-time mask generation and \`u128\` comparisons | | [RUSTSEC-2024-0436](https://osv.dev/vulnerability/RUSTSEC-2024-0436) | unknown | paste 1.0.15 (crates.io) | none listed | paste - no longer maintained | ## Fetch it over TEA This SBOM is served over the [Transparency Exchange API](https://github.com/CycloneDX/transparency-exchange-api) (TEA). With the `libtea` client: ``` pip install libtea python -m libtea https://pypi.sbomify.com pkg:pypi/devolutions-crypto@2026.6.22 ``` Machine-readable copy of this page: https://pypi.sbomify.com/package/devolutions-crypto/2026.6.22.json --- From pypi-tea by sbomify: https://pypi.sbomify.com/package/devolutions-crypto/2026.6.22