# SBOM for thrift 0.25.0 > Python bindings for the Apache Thrift RPC system The Python package thrift 0.25.0 ships 10 SBOM files (CycloneDX) inside its wheels, under `.dist-info/sboms/` ([PEP 770](https://peps.python.org/pep-0770/)). Its wheels carry a verified PEP 740 attestation. - Package URL (PURL): `pkg:pypi/thrift@0.25.0` - PyPI: https://pypi.org/project/thrift/0.25.0/ - Author: Apache Thrift Developers - License: Apache License 2.0 - Homepage: ## SBOMs ### thrift-0.25.0-cp310-cp310-musllinux\_1\_2\_aarch64.whl PEP 740 attestation verified (GitHub, apache/thrift, workflow pypi.yml). - [thrift-0.25.0.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/391552b2-6f67-5826-995d-a144e32a0cc2/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities ### thrift-0.25.0-cp310-cp310-musllinux\_1\_2\_x86\_64.whl PEP 740 attestation verified (GitHub, apache/thrift, workflow pypi.yml). - [thrift-0.25.0.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/134a8b98-a2bf-5e56-827b-b1d24ecde9a5/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities ### thrift-0.25.0-cp311-cp311-musllinux\_1\_2\_aarch64.whl PEP 740 attestation verified (GitHub, apache/thrift, workflow pypi.yml). - [thrift-0.25.0.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/222eda70-6472-5a6e-8858-23be92533d97/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities ### thrift-0.25.0-cp311-cp311-musllinux\_1\_2\_x86\_64.whl PEP 740 attestation verified (GitHub, apache/thrift, workflow pypi.yml). - [thrift-0.25.0.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/6d20f99d-a597-5d0a-8547-c1f9379af079/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities ### thrift-0.25.0-cp312-cp312-musllinux\_1\_2\_aarch64.whl PEP 740 attestation verified (GitHub, apache/thrift, workflow pypi.yml). - [thrift-0.25.0.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/e473e2bc-bf96-5c39-baa4-dac7a4d35b7d/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities ### thrift-0.25.0-cp312-cp312-musllinux\_1\_2\_x86\_64.whl PEP 740 attestation verified (GitHub, apache/thrift, workflow pypi.yml). - [thrift-0.25.0.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/1aa7345b-219d-50e1-be92-c3ec477b2305/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities ### thrift-0.25.0-cp313-cp313-musllinux\_1\_2\_aarch64.whl PEP 740 attestation verified (GitHub, apache/thrift, workflow pypi.yml). - [thrift-0.25.0.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/9cccd304-4fc6-5fc9-a97c-fec45248b94c/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities ### thrift-0.25.0-cp313-cp313-musllinux\_1\_2\_x86\_64.whl PEP 740 attestation verified (GitHub, apache/thrift, workflow pypi.yml). - [thrift-0.25.0.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/768fddb4-b89e-5941-b392-e382afa55a51/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities ### thrift-0.25.0-cp314-cp314-musllinux\_1\_2\_aarch64.whl PEP 740 attestation verified (GitHub, apache/thrift, workflow pypi.yml). - [thrift-0.25.0.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/340d34d1-690c-5853-8f42-25e073e57b65/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities ### thrift-0.25.0-cp314-cp314-musllinux\_1\_2\_x86\_64.whl PEP 740 attestation verified (GitHub, apache/thrift, workflow pypi.yml). - [thrift-0.25.0.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/2730f1ac-0c95-5aa0-aca3-0392b582d892/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities ## Known vulnerabilities Components listed in these SBOMs, matched against the [OSV database](https://osv.dev/) as of 2026-11-10. OSV has no known vulnerabilities for the components these SBOMs list. ## Fetch it over TEA This SBOM is served over the [Transparency Exchange API](https://github.com/CycloneDX/transparency-exchange-api) (TEA). With the `libtea` client: ``` pip install libtea python -m libtea https://pypi.sbomify.com pkg:pypi/thrift@0.25.0 ``` Machine-readable copy of this page: https://pypi.sbomify.com/package/thrift/0.25.0.json --- From pypi-tea by sbomify: https://pypi.sbomify.com/package/thrift/0.25.0