# SBOM for pqcrypto 1.0.0

> Python bindings for post-quantum cryptography — ML-KEM, ML-DSA, SLH-DSA, Classic McEliece, HQC, and SNTRUP

The Python package pqcrypto 1.0.0 ships 7 SBOM files (CycloneDX) inside its wheels, under `.dist-info/sboms/` ([PEP 770](https://peps.python.org/pep-0770/)). Its wheels carry a verified PEP 740 attestation.

- Package URL (PURL): `pkg:pypi/pqcrypto@1.0.0`
- PyPI: https://pypi.org/project/pqcrypto/1.0.0/
- Requires Python: \>=3.9
- Documentation: <https://github.com/backbone-hq/pqcrypto>
- Homepage: <https://github.com/backbone-hq/pqcrypto>
- Repository: <https://github.com/backbone-hq/pqcrypto>

## SBOMs

### pqcrypto-1.0.0-cp39-abi3-macosx\_10\_12\_x86\_64.whl

PEP 740 attestation verified (GitHub, backbone-hq/pqcrypto, workflow ci.yml).

- [pqcrypto-1.0.0.dist-info/sboms/pqcrypto-python.cyclonedx.json](https://pypi.sbomify.com/artifact/67af285f-59a3-5578-abd9-82577952b80f/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 1 known vulnerability

### pqcrypto-1.0.0-cp39-abi3-macosx\_11\_0\_arm64.whl

PEP 740 attestation verified (GitHub, backbone-hq/pqcrypto, workflow ci.yml).

- [pqcrypto-1.0.0.dist-info/sboms/pqcrypto-python.cyclonedx.json](https://pypi.sbomify.com/artifact/bfe89d12-778f-5327-ac35-ec7547580986/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 1 known vulnerability

### pqcrypto-1.0.0-cp39-abi3-manylinux\_2\_34\_aarch64.whl

PEP 740 attestation verified (GitHub, backbone-hq/pqcrypto, workflow ci.yml).

- [pqcrypto-1.0.0.dist-info/sboms/pqcrypto-python.cyclonedx.json](https://pypi.sbomify.com/artifact/17e44f18-cee0-523a-bfc7-727275dd4b34/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 1 known vulnerability

### pqcrypto-1.0.0-cp39-abi3-manylinux\_2\_34\_x86\_64.whl

PEP 740 attestation verified (GitHub, backbone-hq/pqcrypto, workflow ci.yml).

- [pqcrypto-1.0.0.dist-info/sboms/pqcrypto-python.cyclonedx.json](https://pypi.sbomify.com/artifact/44fe3ce2-1a11-572b-aeb6-8ef1f5a57714/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 1 known vulnerability

### pqcrypto-1.0.0-cp39-abi3-musllinux\_1\_2\_aarch64.whl

PEP 740 attestation verified (GitHub, backbone-hq/pqcrypto, workflow ci.yml).

- [pqcrypto-1.0.0.dist-info/sboms/pqcrypto-python.cyclonedx.json](https://pypi.sbomify.com/artifact/cd8ae951-aa3e-5893-be47-859c5c1c108a/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 1 known vulnerability

### pqcrypto-1.0.0-cp39-abi3-musllinux\_1\_2\_x86\_64.whl

PEP 740 attestation verified (GitHub, backbone-hq/pqcrypto, workflow ci.yml).

- [pqcrypto-1.0.0.dist-info/sboms/pqcrypto-python.cyclonedx.json](https://pypi.sbomify.com/artifact/e6107159-abc2-5295-8fed-4b1f2929fa77/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 1 known vulnerability

### pqcrypto-1.0.0-cp39-abi3-win\_amd64.whl

PEP 740 attestation verified (GitHub, backbone-hq/pqcrypto, workflow ci.yml).

- [pqcrypto-1.0.0.dist-info/sboms/pqcrypto-python.cyclonedx.json](https://pypi.sbomify.com/artifact/376374f6-c1cd-557e-a41c-7856a9824321/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 1 known vulnerability

## Known vulnerabilities

Components listed in these SBOMs, matched against the [OSV database](https://osv.dev/) as of 2026-11-10.

| Vulnerability | Severity | Component | Fixed in | Summary |
|---|---|---|---|---|
| [RUSTSEC-2026-0385](https://osv.dev/vulnerability/RUSTSEC-2026-0385) | unknown | ctutils 0.4.2 (crates.io) | 0.4.4 | Non-constant-time mask generation and \`u128\` comparisons |

## Fetch it over TEA

This SBOM is served over the [Transparency Exchange API](https://github.com/CycloneDX/transparency-exchange-api) (TEA). With the `libtea` client:

```
pip install libtea
python -m libtea https://pypi.sbomify.com pkg:pypi/pqcrypto@1.0.0
```

Machine-readable copy of this page: https://pypi.sbomify.com/package/pqcrypto/1.0.0.json

---
From pypi-tea by sbomify: https://pypi.sbomify.com/package/pqcrypto/1.0.0