# SBOM for fontc 1.0.0

> A font compiler written in Rust.

The Python package fontc 1.0.0 ships 7 SBOM files (CycloneDX) inside its wheels, under `.dist-info/sboms/` ([PEP 770](https://peps.python.org/pep-0770/)). Its wheels carry a verified PEP 740 attestation.

- Package URL (PURL): `pkg:pypi/fontc@1.0.0`
- PyPI: https://pypi.org/project/fontc/1.0.0/

## SBOMs

### fontc-1.0.0-py3-none-macosx\_10\_12\_x86\_64.macosx\_11\_0\_arm64.macosx\_10\_12\_universal2.whl

PEP 740 attestation verified (GitHub, googlefonts/fontc, workflow release.yml).

- [fontc-1.0.0.dist-info/sboms/fontc.cyclonedx.json](https://pypi.sbomify.com/artifact/279bbfb5-ad90-512e-ba04-41d8dd8dbd8a/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 4 known vulnerabilities

### fontc-1.0.0-py3-none-manylinux\_2\_17\_aarch64.manylinux2014\_aarch64.whl

PEP 740 attestation verified (GitHub, googlefonts/fontc, workflow release.yml).

- [fontc-1.0.0.dist-info/sboms/fontc.cyclonedx.json](https://pypi.sbomify.com/artifact/6c2093e8-9935-58c0-b38f-c4fcf9dff11f/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 4 known vulnerabilities

### fontc-1.0.0-py3-none-manylinux\_2\_17\_x86\_64.manylinux2014\_x86\_64.whl

PEP 740 attestation verified (GitHub, googlefonts/fontc, workflow release.yml).

- [fontc-1.0.0.dist-info/sboms/fontc.cyclonedx.json](https://pypi.sbomify.com/artifact/f183649f-aadf-591b-9b42-541eca494740/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 4 known vulnerabilities

### fontc-1.0.0-py3-none-musllinux\_1\_1\_aarch64.whl

PEP 740 attestation verified (GitHub, googlefonts/fontc, workflow release.yml).

- [fontc-1.0.0.dist-info/sboms/fontc.cyclonedx.json](https://pypi.sbomify.com/artifact/752f905c-718d-5348-9c7f-2bfb5b6962d2/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 4 known vulnerabilities

### fontc-1.0.0-py3-none-musllinux\_1\_1\_x86\_64.whl

PEP 740 attestation verified (GitHub, googlefonts/fontc, workflow release.yml).

- [fontc-1.0.0.dist-info/sboms/fontc.cyclonedx.json](https://pypi.sbomify.com/artifact/3dd7b96b-9c10-56f2-9fa2-b9f64b867738/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 4 known vulnerabilities

### fontc-1.0.0-py3-none-win32.whl

PEP 740 attestation verified (GitHub, googlefonts/fontc, workflow release.yml).

- [fontc-1.0.0.dist-info/sboms/fontc.cyclonedx.json](https://pypi.sbomify.com/artifact/2de56b2b-59e3-5f19-badc-5a907961d984/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 4 known vulnerabilities

### fontc-1.0.0-py3-none-win\_amd64.whl

PEP 740 attestation verified (GitHub, googlefonts/fontc, workflow release.yml).

- [fontc-1.0.0.dist-info/sboms/fontc.cyclonedx.json](https://pypi.sbomify.com/artifact/c622ec51-57c3-5639-9d1b-3fb023a33750/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 4 known vulnerabilities

## Known vulnerabilities

Components listed in these SBOMs, matched against the [OSV database](https://osv.dev/) as of 2026-11-10.

| Vulnerability | Severity | Component | Fixed in | Summary |
|---|---|---|---|---|
| [RUSTSEC-2026-0194](https://osv.dev/vulnerability/RUSTSEC-2026-0194) | high (7.5) | quick-xml 0.38.4 (crates.io) | 0.41.0 | Quadratic run time when checking a start tag for duplicate attribute names |
| [RUSTSEC-2026-0195](https://osv.dev/vulnerability/RUSTSEC-2026-0195) | high (7.5) | quick-xml 0.38.4 (crates.io) | 0.41.0 | Unbounded namespace-declaration allocation in \`NsReader\` enables memory-exhaustion denial of service |
| [RUSTSEC-2021-0139](https://osv.dev/vulnerability/RUSTSEC-2021-0139) | unknown | ansi\_term 0.12.1 (crates.io) | none listed | ansi\_term is Unmaintained |
| [RUSTSEC-2024-0449](https://osv.dev/vulnerability/RUSTSEC-2024-0449) | unknown | unsafe-libyaml 0.2.11 (crates.io) | none listed | unsafe-libyaml is unmaintained |

## Fetch it over TEA

This SBOM is served over the [Transparency Exchange API](https://github.com/CycloneDX/transparency-exchange-api) (TEA). With the `libtea` client:

```
pip install libtea
python -m libtea https://pypi.sbomify.com pkg:pypi/fontc@1.0.0
```

Machine-readable copy of this page: https://pypi.sbomify.com/package/fontc/1.0.0.json

---
From pypi-tea by sbomify: https://pypi.sbomify.com/package/fontc/1.0.0