# SBOM for fixr 0.2.3

> Python bindings to xrif, the extreme reordered image format

The Python package fixr 0.2.3 ships 14 SBOM files (CycloneDX) inside its wheels, under `.dist-info/sboms/` ([PEP 770](https://peps.python.org/pep-0770/)). Its wheels carry a verified PEP 740 attestation.

- Package URL (PURL): `pkg:pypi/fixr@0.2.3`
- PyPI: https://pypi.org/project/fixr/0.2.3/
- Requires Python: \>=3.9

## SBOMs

### fixr-0.2.3-cp310-cp310-manylinux2014\_aarch64.manylinux\_2\_17\_aarch64.manylinux\_2\_28\_aarch64.whl

PEP 740 attestation verified (GitHub, joseph-long/fixr, workflow publish-to-pypi.yml).

- [fixr-0.2.3.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/74837b1c-df60-5fdf-bd07-cf4f49431698/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities

### fixr-0.2.3-cp310-cp310-manylinux2014\_x86\_64.manylinux\_2\_17\_x86\_64.manylinux\_2\_28\_x86\_64.whl

PEP 740 attestation verified (GitHub, joseph-long/fixr, workflow publish-to-pypi.yml).

- [fixr-0.2.3.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/589cb8ac-a1ad-579b-88c7-e5b5daebc5db/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities

### fixr-0.2.3-cp311-cp311-manylinux2014\_aarch64.manylinux\_2\_17\_aarch64.manylinux\_2\_28\_aarch64.whl

PEP 740 attestation verified (GitHub, joseph-long/fixr, workflow publish-to-pypi.yml).

- [fixr-0.2.3.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/4d8d2e36-549f-5919-bbcc-4c52f5a817ca/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities

### fixr-0.2.3-cp311-cp311-manylinux2014\_x86\_64.manylinux\_2\_17\_x86\_64.manylinux\_2\_28\_x86\_64.whl

PEP 740 attestation verified (GitHub, joseph-long/fixr, workflow publish-to-pypi.yml).

- [fixr-0.2.3.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/a27b2cfe-63a5-54a7-9932-548cd7a5374b/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities

### fixr-0.2.3-cp312-cp312-manylinux2014\_aarch64.manylinux\_2\_17\_aarch64.manylinux\_2\_28\_aarch64.whl

PEP 740 attestation verified (GitHub, joseph-long/fixr, workflow publish-to-pypi.yml).

- [fixr-0.2.3.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/0ccd93b6-dbc4-5b9d-b5b5-9abf5353a029/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities

### fixr-0.2.3-cp312-cp312-manylinux2014\_x86\_64.manylinux\_2\_17\_x86\_64.manylinux\_2\_28\_x86\_64.whl

PEP 740 attestation verified (GitHub, joseph-long/fixr, workflow publish-to-pypi.yml).

- [fixr-0.2.3.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/2b71a3d9-1eec-5f3b-ab34-417f9f685a4f/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities

### fixr-0.2.3-cp313-cp313-manylinux2014\_aarch64.manylinux\_2\_17\_aarch64.manylinux\_2\_28\_aarch64.whl

PEP 740 attestation verified (GitHub, joseph-long/fixr, workflow publish-to-pypi.yml).

- [fixr-0.2.3.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/2328d6bc-4574-57a8-adb9-00fb1f496c29/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities

### fixr-0.2.3-cp313-cp313-manylinux2014\_x86\_64.manylinux\_2\_17\_x86\_64.manylinux\_2\_28\_x86\_64.whl

PEP 740 attestation verified (GitHub, joseph-long/fixr, workflow publish-to-pypi.yml).

- [fixr-0.2.3.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/ebfb58d6-a2a1-56a4-b92d-d9d37a19b9ac/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities

### fixr-0.2.3-cp314-cp314-manylinux2014\_aarch64.manylinux\_2\_17\_aarch64.manylinux\_2\_28\_aarch64.whl

PEP 740 attestation verified (GitHub, joseph-long/fixr, workflow publish-to-pypi.yml).

- [fixr-0.2.3.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/70666c2c-e209-579e-bee4-09b598c6c1a7/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities

### fixr-0.2.3-cp314-cp314-manylinux2014\_x86\_64.manylinux\_2\_17\_x86\_64.manylinux\_2\_28\_x86\_64.whl

PEP 740 attestation verified (GitHub, joseph-long/fixr, workflow publish-to-pypi.yml).

- [fixr-0.2.3.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/7f190910-b72d-55fd-b6c1-1f8bdb8a0fa9/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities

### fixr-0.2.3-cp314-cp314t-manylinux2014\_aarch64.manylinux\_2\_17\_aarch64.manylinux\_2\_28\_aarch64.whl

PEP 740 attestation verified (GitHub, joseph-long/fixr, workflow publish-to-pypi.yml).

- [fixr-0.2.3.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/c0940d07-c9f3-5717-8105-18cf660eca10/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities

### fixr-0.2.3-cp314-cp314t-manylinux2014\_x86\_64.manylinux\_2\_17\_x86\_64.manylinux\_2\_28\_x86\_64.whl

PEP 740 attestation verified (GitHub, joseph-long/fixr, workflow publish-to-pypi.yml).

- [fixr-0.2.3.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/bb03ccf8-b136-50d7-aa4d-35fa0d77788c/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities

### fixr-0.2.3-cp39-cp39-manylinux2014\_aarch64.manylinux\_2\_17\_aarch64.manylinux\_2\_28\_aarch64.whl

PEP 740 attestation verified (GitHub, joseph-long/fixr, workflow publish-to-pypi.yml).

- [fixr-0.2.3.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/00e23edd-57ce-5c15-950f-f852b602bb07/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities

### fixr-0.2.3-cp39-cp39-manylinux2014\_x86\_64.manylinux\_2\_17\_x86\_64.manylinux\_2\_28\_x86\_64.whl

PEP 740 attestation verified (GitHub, joseph-long/fixr, workflow publish-to-pypi.yml).

- [fixr-0.2.3.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/9e8e5760-7b1e-5084-9ba8-8cfb03b05b63/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities

## Known vulnerabilities

Components listed in these SBOMs, matched against the [OSV database](https://osv.dev/) as of 2026-11-10.

OSV has no known vulnerabilities for the components these SBOMs list.

## Fetch it over TEA

This SBOM is served over the [Transparency Exchange API](https://github.com/CycloneDX/transparency-exchange-api) (TEA). With the `libtea` client:

```
pip install libtea
python -m libtea https://pypi.sbomify.com pkg:pypi/fixr@0.2.3
```

Machine-readable copy of this page: https://pypi.sbomify.com/package/fixr/0.2.3.json

---
From pypi-tea by sbomify: https://pypi.sbomify.com/package/fixr/0.2.3