{"bomFormat":"CycloneDX","components":[{"bom-ref":"crypto/algorithm/3DES","cryptoProperties":{"algorithmProperties":{"executionEnvironment":"unknown","implementationPlatform":"unknown","primitive":"block-cipher"},"assetType":"algorithm"},"description":"3DES is deprecated.","evidence":{"occurrences":[{"additionalContext":"[comment]","line":50,"location":"paramiko/pkey.py"},{"line":59,"location":"paramiko/pkey.py"},{"line":61,"location":"paramiko/pkey.py"},{"line":140,"location":"paramiko/pkey.py"},{"line":141,"location":"paramiko/pkey.py"},{"additionalContext":"[comment]","line":126,"location":"paramiko/transport.py"},{"line":135,"location":"paramiko/transport.py"},{"line":137,"location":"paramiko/transport.py"},{"line":183,"location":"paramiko/transport.py"},{"line":266,"location":"paramiko/transport.py"},{"line":267,"location":"paramiko/transport.py"}]},"name":"3DES","properties":[{"name":"qrp:classification","value":"deprecated_weak"},{"name":"qrp:severity","value":"high"},{"name":"qrp:occurrences","value":"1"}],"type":"cryptographic-asset"},{"bom-ref":"crypto/algorithm/DH","cryptoProperties":{"algorithmProperties":{"executionEnvironment":"unknown","implementationPlatform":"unknown","primitive":"key-agree"},"assetType":"algorithm","oid":"1.2.840.113549.1.3.1"},"description":"DH is broken by a large-scale quantum computer (Shor's algorithm).","evidence":{"occurrences":[{"additionalContext":"[comment]","line":2,"location":"paramiko/kex_ecdh_nist.py"},{"line":51,"location":"paramiko/kex_gex.py"},{"additionalContext":"[comment]","line":21,"location":"paramiko/kex_group14.py"},{"line":45,"location":"paramiko/kex_group14.py"},{"additionalContext":"[comment]","line":20,"location":"paramiko/kex_group16.py"},{"line":30,"location":"paramiko/kex_group16.py"},{"line":35,"location":"paramiko/kex_group16.py"},{"line":219,"location":"paramiko/transport.py"},{"line":220,"location":"paramiko/transport.py"},{"line":221,"location":"paramiko/transport.py"},{"line":327,"location":"paramiko/transport.py"},{"line":328,"location":"paramiko/transport.py"},{"line":329,"location":"paramiko/transport.py"},{"additionalContext":"[comment]","line":412,"location":"paramiko/transport.py"},{"additionalContext":"[comment]","line":415,"location":"paramiko/transport.py"},{"line":2273,"location":"paramiko/transport.py"},{"line":1122,"location":"tests/test_transport.py"},{"line":1123,"location":"tests/test_transport.py"},{"line":1161,"location":"tests/test_transport.py"}]},"name":"DH","properties":[{"name":"qrp:classification","value":"classical_vulnerable"},{"name":"qrp:severity","value":"high"},{"name":"qrp:occurrences","value":"1"},{"name":"qrp:observedKeySizes","value":"2048, 4096"},{"name":"qrp:quantumPosture","value":"quantum-vulnerable"}],"type":"cryptographic-asset"},{"bom-ref":"crypto/algorithm/EC","cryptoProperties":{"algorithmProperties":{"executionEnvironment":"unknown","implementationPlatform":"unknown","primitive":"signature"},"assetType":"algorithm"},"description":"EC is broken by a large-scale quantum computer (Shor's algorithm).","evidence":{"occurrences":[{"additionalContext":"[comment]","line":43,"location":"paramiko/ecdsakey.py"},{"line":105,"location":"paramiko/ecdsakey.py"},{"line":106,"location":"paramiko/ecdsakey.py"},{"line":107,"location":"paramiko/ecdsakey.py"},{"line":167,"location":"paramiko/ecdsakey.py"},{"line":250,"location":"paramiko/ecdsakey.py"},{"line":254,"location":"paramiko/ecdsakey.py"},{"line":268,"location":"paramiko/ecdsakey.py"},{"line":305,"location":"paramiko/ecdsakey.py"},{"line":21,"location":"paramiko/kex_ecdh_nist.py"},{"line":23,"location":"paramiko/kex_ecdh_nist.py"},{"line":59,"location":"paramiko/kex_ecdh_nist.py"},{"line":67,"location":"paramiko/kex_ecdh_nist.py"},{"line":113,"location":"paramiko/kex_ecdh_nist.py"},{"line":143,"location":"paramiko/kex_ecdh_nist.py"},{"line":145,"location":"paramiko/kex_ecdh_nist.py"},{"line":149,"location":"paramiko/kex_ecdh_nist.py"},{"line":151,"location":"paramiko/kex_ecdh_nist.py"},{"line":216,"location":"paramiko/pkey.py"},{"line":200,"location":"paramiko/transport.py"},{"line":201,"location":"paramiko/transport.py"},{"line":202,"location":"paramiko/transport.py"},{"line":209,"location":"paramiko/transport.py"},{"line":210,"location":"paramiko/transport.py"},{"line":211,"location":"paramiko/transport.py"},{"line":216,"location":"paramiko/transport.py"},{"line":217,"location":"paramiko/transport.py"},{"line":218,"location":"paramiko/transport.py"},{"line":316,"location":"paramiko/transport.py"},{"line":317,"location":"paramiko/transport.py"},{"line":318,"location":"paramiko/transport.py"},{"line":319,"location":"paramiko/transport.py"},{"line":320,"location":"paramiko/transport.py"},{"line":321,"location":"paramiko/transport.py"},{"line":330,"location":"paramiko/transport.py"},{"line":331,"location":"paramiko/transport.py"},{"line":332,"location":"paramiko/transport.py"},{"line":1,"location":"tests/_support/ecdsa-256.key"},{"line":146,"location":"tests/conftest.py"},{"additionalContext":"[comment]","line":163,"location":"tests/conftest.py"},{"line":5,"location":"tests/pkey.py"},{"line":236,"location":"tests/pkey.py"},{"line":237,"location":"tests/pkey.py"},{"line":238,"location":"tests/pkey.py"},{"line":51,"location":"tests/test_client.py"},{"line":278,"location":"tests/test_client.py"},{"line":321,"location":"tests/test_client.py"},{"line":1,"location":"tests/test_ecdsa_384.key"},{"line":1,"location":"tests/test_ecdsa_521.key"},{"line":1,"location":"tests/test_ecdsa_password_256.key"},{"line":1,"location":"tests/test_ecdsa_password_384.key"},{"line":1,"location":"tests/test_ecdsa_password_521.key"},{"line":43,"location":"tests/test_hostkeys.py"},{"line":57,"location":"tests/test_hostkeys.py"},{"line":61,"location":"tests/test_kex.py"},{"line":62,"location":"tests/test_kex.py"},{"line":64,"location":"tests/test_kex.py"},{"line":68,"location":"tests/test_kex.py"},{"line":69,"location":"tests/test_kex.py"},{"line":72,"location":"tests/test_kex.py"},{"line":73,"location":"tests/test_kex.py"},{"line":297,"location":"tests/test_kex.py"},{"line":322,"location":"tests/test_kex.py"},{"line":51,"location":"tests/test_pkey.py"},{"line":52,"location":"tests/test_pkey.py"},{"line":53,"location":"tests/test_pkey.py"},{"line":57,"location":"tests/test_pkey.py"},{"line":222,"location":"tests/test_pkey.py"},{"line":229,"location":"tests/test_pkey.py"},{"line":236,"location":"tests/test_pkey.py"},{"line":243,"location":"tests/test_pkey.py"},{"line":247,"location":"tests/test_pkey.py"},{"line":265,"location":"tests/test_pkey.py"},{"line":287,"location":"tests/test_pkey.py"},{"line":298,"location":"tests/test_pkey.py"},{"line":316,"location":"tests/test_pkey.py"},{"line":349,"location":"tests/test_pkey.py"},{"line":360,"location":"tests/test_pkey.py"},{"line":381,"location":"tests/test_pkey.py"},{"line":403,"location":"tests/test_pkey.py"},{"line":438,"location":"tests/test_pkey.py"},{"line":442,"location":"tests/test_pkey.py"},{"line":443,"location":"tests/test_pkey.py"},{"line":1228,"location":"tests/test_transport.py"}]},"name":"EC","properties":[{"name":"qrp:classification","value":"classical_vulnerable"},{"name":"qrp:severity","value":"high"},{"name":"qrp:occurrences","value":"1"},{"name":"qrp:observedKeySizes","value":"256, 384, 521"},{"name":"qrp:observedCurves","value":"P-256, P-384, P-521"},{"name":"qrp:quantumPosture","value":"quantum-vulnerable"}],"type":"cryptographic-asset"},{"bom-ref":"crypto/algorithm/ECDH","cryptoProperties":{"algorithmProperties":{"executionEnvironment":"unknown","implementationPlatform":"unknown","primitive":"key-agree"},"assetType":"algorithm"},"description":"ECDH is broken by a large-scale quantum computer (Shor's algorithm).","evidence":{"occurrences":[{"additionalContext":"[comment]","line":2,"location":"paramiko/kex_ecdh_nist.py"},{"line":21,"location":"paramiko/kex_ecdh_nist.py"},{"line":71,"location":"paramiko/kex_ecdh_nist.py"},{"line":117,"location":"paramiko/kex_ecdh_nist.py"},{"line":143,"location":"paramiko/kex_ecdh_nist.py"},{"line":149,"location":"paramiko/kex_ecdh_nist.py"},{"additionalContext":"[comment]","line":9,"location":"paramiko/kex_mlkem.py"},{"line":100,"location":"paramiko/transport.py"},{"line":216,"location":"paramiko/transport.py"},{"line":217,"location":"paramiko/transport.py"},{"line":218,"location":"paramiko/transport.py"},{"line":330,"location":"paramiko/transport.py"},{"line":331,"location":"paramiko/transport.py"},{"line":332,"location":"paramiko/transport.py"},{"line":303,"location":"tests/test_kex.py"},{"line":315,"location":"tests/test_kex.py"},{"line":328,"location":"tests/test_kex.py"},{"line":339,"location":"tests/test_kex.py"}]},"name":"ECDH","properties":[{"name":"qrp:classification","value":"classical_vulnerable"},{"name":"qrp:severity","value":"high"},{"name":"qrp:occurrences","value":"1"},{"name":"qrp:observedKeySizes","value":"256, 384, 521"},{"name":"qrp:observedCurves","value":"P-256, P-384, P-521"},{"name":"qrp:quantumPosture","value":"quantum-vulnerable"}],"type":"cryptographic-asset"},{"bom-ref":"crypto/algorithm/ECDSA","cryptoProperties":{"algorithmProperties":{"executionEnvironment":"unknown","implementationPlatform":"unknown","primitive":"signature"},"assetType":"algorithm","oid":"1.2.840.10045.2.1"},"description":"ECDSA is broken by a large-scale quantum computer (Shor's algorithm).","evidence":{"occurrences":[{"line":70,"location":"paramiko/__init__.py"},{"line":115,"location":"paramiko/__init__.py"},{"line":690,"location":"paramiko/client.py"},{"line":730,"location":"paramiko/client.py"},{"additionalContext":"[comment]","line":20,"location":"paramiko/ecdsakey.py"},{"line":41,"location":"paramiko/ecdsakey.py"},{"additionalContext":"[comment]","line":43,"location":"paramiko/ecdsakey.py"},{"additionalContext":"[comment]","line":46,"location":"paramiko/ecdsakey.py"},{"line":55,"location":"paramiko/ecdsakey.py"},{"line":68,"location":"paramiko/ecdsakey.py"},{"additionalContext":"[comment]","line":70,"location":"paramiko/ecdsakey.py"},{"additionalContext":"[comment]","line":71,"location":"paramiko/ecdsakey.py"},{"line":75,"location":"paramiko/ecdsakey.py"},{"line":76,"location":"paramiko/ecdsakey.py"},{"line":79,"location":"paramiko/ecdsakey.py"},{"line":82,"location":"paramiko/ecdsakey.py"},{"line":87,"location":"paramiko/ecdsakey.py"},{"line":92,"location":"paramiko/ecdsakey.py"},{"line":97,"location":"paramiko/ecdsakey.py"},{"additionalContext":"[comment]","line":99,"location":"paramiko/ecdsakey.py"},{"line":103,"location":"paramiko/ecdsakey.py"},{"line":105,"location":"paramiko/ecdsakey.py"},{"line":106,"location":"paramiko/ecdsakey.py"},{"line":107,"location":"paramiko/ecdsakey.py"},{"line":137,"location":"paramiko/ecdsakey.py"},{"additionalContext":"[comment]","line":139,"location":"paramiko/ecdsakey.py"},{"additionalContext":"[comment]","line":144,"location":"paramiko/ecdsakey.py"},{"line":149,"location":"paramiko/ecdsakey.py"},{"line":152,"location":"paramiko/ecdsakey.py"},{"line":160,"location":"paramiko/ecdsakey.py"},{"line":168,"location":"paramiko/ecdsakey.py"},{"line":176,"location":"paramiko/ecdsakey.py"},{"line":186,"location":"paramiko/ecdsakey.py"},{"line":187,"location":"paramiko/ecdsakey.py"},{"line":215,"location":"paramiko/ecdsakey.py"},{"line":218,"location":"paramiko/ecdsakey.py"},{"line":224,"location":"paramiko/ecdsakey.py"},{"line":225,"location":"paramiko/ecdsakey.py"},{"line":229,"location":"paramiko/ecdsakey.py"},{"line":234,"location":"paramiko/ecdsakey.py"},{"line":242,"location":"paramiko/ecdsakey.py"},{"additionalContext":"[comment]","line":256,"location":"paramiko/ecdsakey.py"},{"additionalContext":"[comment]","line":260,"location":"paramiko/ecdsakey.py"},{"line":263,"location":"paramiko/ecdsakey.py"},{"line":269,"location":"paramiko/ecdsakey.py"},{"line":301,"location":"paramiko/ecdsakey.py"},{"line":302,"location":"paramiko/ecdsakey.py"},{"line":318,"location":"paramiko/ecdsakey.py"},{"line":173,"location":"paramiko/pkey.py"},{"line":217,"location":"paramiko/pkey.py"},{"additionalContext":"[comment]","line":268,"location":"paramiko/pkey.py"},{"additionalContext":"[comment]","line":357,"location":"paramiko/pkey.py"},{"additionalContext":"[comment]","line":852,"location":"paramiko/pkey.py"},{"additionalContext":"[comment]","line":855,"location":"paramiko/pkey.py"},{"additionalContext":"[comment]","line":928,"location":"paramiko/pkey.py"},{"line":97,"location":"paramiko/transport.py"},{"line":200,"location":"paramiko/transport.py"},{"line":201,"location":"paramiko/transport.py"},{"line":202,"location":"paramiko/transport.py"},{"line":209,"location":"paramiko/transport.py"},{"line":210,"location":"paramiko/transport.py"},{"line":211,"location":"paramiko/transport.py"},{"line":316,"location":"paramiko/transport.py"},{"line":317,"location":"paramiko/transport.py"},{"line":318,"location":"paramiko/transport.py"},{"line":319,"location":"paramiko/transport.py"},{"line":320,"location":"paramiko/transport.py"},{"line":321,"location":"paramiko/transport.py"},{"line":1,"location":"tests/_support/ecdsa-256.key-cert.pub"},{"line":14,"location":"tests/conftest.py"},{"line":145,"location":"tests/conftest.py"},{"line":146,"location":"tests/conftest.py"},{"line":147,"location":"tests/conftest.py"},{"additionalContext":"[comment]","line":161,"location":"tests/conftest.py"},{"additionalContext":"[comment]","line":163,"location":"tests/conftest.py"},{"line":13,"location":"tests/pkey.py"},{"line":186,"location":"tests/pkey.py"},{"line":187,"location":"tests/pkey.py"},{"line":234,"location":"tests/pkey.py"},{"line":235,"location":"tests/pkey.py"},{"line":236,"location":"tests/pkey.py"},{"line":237,"location":"tests/pkey.py"},{"line":238,"location":"tests/pkey.py"},{"line":246,"location":"tests/pkey.py"},{"line":261,"location":"tests/pkey.py"},{"line":51,"location":"tests/test_client.py"},{"line":176,"location":"tests/test_client.py"},{"line":177,"location":"tests/test_client.py"},{"line":260,"location":"tests/test_client.py"},{"additionalContext":"[comment]","line":262,"location":"tests/test_client.py"},{"line":264,"location":"tests/test_client.py"},{"line":278,"location":"tests/test_client.py"},{"line":293,"location":"tests/test_client.py"},{"additionalContext":"[comment]","line":295,"location":"tests/test_client.py"},{"line":296,"location":"tests/test_client.py"},{"line":321,"location":"tests/test_client.py"},{"line":329,"location":"tests/test_client.py"},{"line":343,"location":"tests/test_client.py"},{"line":362,"location":"tests/test_client.py"},{"line":363,"location":"tests/test_client.py"},{"line":608,"location":"tests/test_client.py"},{"line":617,"location":"tests/test_client.py"},{"line":43,"location":"tests/test_hostkeys.py"},{"line":37,"location":"tests/test_pkey.py"},{"line":51,"location":"tests/test_pkey.py"},{"line":52,"location":"tests/test_pkey.py"},{"line":53,"location":"tests/test_pkey.py"},{"line":57,"location":"tests/test_pkey.py"},{"line":60,"location":"tests/test_pkey.py"},{"line":61,"location":"tests/test_pkey.py"},{"line":62,"location":"tests/test_pkey.py"},{"line":87,"location":"tests/test_pkey.py"},{"line":95,"location":"tests/test_pkey.py"},{"line":104,"location":"tests/test_pkey.py"},{"line":216,"location":"tests/test_pkey.py"},{"line":217,"location":"tests/test_pkey.py"},{"line":222,"location":"tests/test_pkey.py"},{"line":224,"location":"tests/test_pkey.py"},{"line":229,"location":"tests/test_pkey.py"},{"line":231,"location":"tests/test_pkey.py"},{"line":236,"location":"tests/test_pkey.py"},{"line":238,"location":"tests/test_pkey.py"},{"line":243,"location":"tests/test_pkey.py"},{"line":245,"location":"tests/test_pkey.py"},{"line":246,"location":"tests/test_pkey.py"},{"line":247,"location":"tests/test_pkey.py"},{"line":248,"location":"tests/test_pkey.py"},{"line":249,"location":"tests/test_pkey.py"},{"line":250,"location":"tests/test_pkey.py"},{"line":251,"location":"tests/test_pkey.py"},{"line":256,"location":"tests/test_pkey.py"},{"line":258,"location":"tests/test_pkey.py"},{"line":261,"location":"tests/test_pkey.py"},{"line":262,"location":"tests/test_pkey.py"},{"line":263,"location":"tests/test_pkey.py"},{"line":265,"location":"tests/test_pkey.py"},{"line":266,"location":"tests/test_pkey.py"},{"line":267,"location":"tests/test_pkey.py"},{"line":268,"location":"tests/test_pkey.py"},{"line":269,"location":"tests/test_pkey.py"},{"line":272,"location":"tests/test_pkey.py"},{"line":274,"location":"tests/test_pkey.py"},{"line":276,"location":"tests/test_pkey.py"},{"line":281,"location":"tests/test_pkey.py"},{"line":283,"location":"tests/test_pkey.py"},{"line":287,"location":"tests/test_pkey.py"},{"additionalContext":"[comment]","line":288,"location":"tests/test_pkey.py"},{"line":293,"location":"tests/test_pkey.py"},{"line":296,"location":"tests/test_pkey.py"},{"line":297,"location":"tests/test_pkey.py"},{"line":298,"location":"tests/test_pkey.py"},{"line":299,"location":"tests/test_pkey.py"},{"line":300,"location":"tests/test_pkey.py"},{"line":301,"location":"tests/test_pkey.py"},{"line":302,"location":"tests/test_pkey.py"},{"line":307,"location":"tests/test_pkey.py"},{"line":309,"location":"tests/test_pkey.py"},{"line":312,"location":"tests/test_pkey.py"},{"line":313,"location":"tests/test_pkey.py"},{"line":314,"location":"tests/test_pkey.py"},{"line":316,"location":"tests/test_pkey.py"},{"line":317,"location":"tests/test_pkey.py"},{"line":318,"location":"tests/test_pkey.py"},{"line":319,"location":"tests/test_pkey.py"},{"line":320,"location":"tests/test_pkey.py"},{"line":323,"location":"tests/test_pkey.py"},{"line":324,"location":"tests/test_pkey.py"},{"line":332,"location":"tests/test_pkey.py"},{"line":334,"location":"tests/test_pkey.py"},{"line":336,"location":"tests/test_pkey.py"},{"line":338,"location":"tests/test_pkey.py"},{"line":343,"location":"tests/test_pkey.py"},{"line":345,"location":"tests/test_pkey.py"},{"line":349,"location":"tests/test_pkey.py"},{"additionalContext":"[comment]","line":350,"location":"tests/test_pkey.py"},{"line":355,"location":"tests/test_pkey.py"},{"line":358,"location":"tests/test_pkey.py"},{"line":359,"location":"tests/test_pkey.py"},{"line":360,"location":"tests/test_pkey.py"},{"line":361,"location":"tests/test_pkey.py"},{"line":362,"location":"tests/test_pkey.py"},{"line":363,"location":"tests/test_pkey.py"},{"line":364,"location":"tests/test_pkey.py"},{"line":374,"location":"tests/test_pkey.py"},{"line":377,"location":"tests/test_pkey.py"},{"line":378,"location":"tests/test_pkey.py"},{"line":379,"location":"tests/test_pkey.py"},{"line":381,"location":"tests/test_pkey.py"},{"line":382,"location":"tests/test_pkey.py"},{"line":383,"location":"tests/test_pkey.py"},{"line":384,"location":"tests/test_pkey.py"},{"line":385,"location":"tests/test_pkey.py"},{"line":388,"location":"tests/test_pkey.py"},{"line":390,"location":"tests/test_pkey.py"},{"line":392,"location":"tests/test_pkey.py"},{"line":397,"location":"tests/test_pkey.py"},{"line":399,"location":"tests/test_pkey.py"},{"line":403,"location":"tests/test_pkey.py"},{"additionalContext":"[comment]","line":404,"location":"tests/test_pkey.py"},{"line":409,"location":"tests/test_pkey.py"},{"line":439,"location":"tests/test_pkey.py"},{"line":440,"location":"tests/test_pkey.py"},{"line":442,"location":"tests/test_pkey.py"},{"line":555,"location":"tests/test_pkey.py"},{"line":564,"location":"tests/test_pkey.py"},{"line":588,"location":"tests/test_pkey.py"},{"line":591,"location":"tests/test_pkey.py"},{"line":598,"location":"tests/test_pkey.py"},{"line":1228,"location":"tests/test_transport.py"},{"line":65,"location":"tests/test_util.py"}]},"name":"ECDSA","properties":[{"name":"qrp:classification","value":"classical_vulnerable"},{"name":"qrp:severity","value":"high"},{"name":"qrp:occurrences","value":"1"},{"name":"qrp:observedKeySizes","value":"256, 384, 521"},{"name":"qrp:observedCurves","value":"P-256, P-384, P-521"},{"name":"qrp:quantumPosture","value":"quantum-vulnerable"}],"type":"cryptographic-asset"},{"bom-ref":"crypto/algorithm/Ed25519","cryptoProperties":{"algorithmProperties":{"executionEnvironment":"unknown","implementationPlatform":"unknown","primitive":"signature"},"assetType":"algorithm","oid":"1.3.101.112"},"description":"Ed25519 is broken by a large-scale quantum computer (Shor's algorithm).","evidence":{"occurrences":[{"line":71,"location":"paramiko/__init__.py"},{"line":115,"location":"paramiko/__init__.py"},{"line":690,"location":"paramiko/client.py"},{"line":731,"location":"paramiko/client.py"},{"line":30,"location":"paramiko/ed25519key.py"},{"additionalContext":"[comment]","line":32,"location":"paramiko/ed25519key.py"},{"additionalContext":"[comment]","line":35,"location":"paramiko/ed25519key.py"},{"line":42,"location":"paramiko/ed25519key.py"},{"line":55,"location":"paramiko/ed25519key.py"},{"line":57,"location":"paramiko/ed25519key.py"},{"additionalContext":"[comment]","line":74,"location":"paramiko/ed25519key.py"},{"line":150,"location":"paramiko/ed25519key.py"},{"line":193,"location":"paramiko/ed25519key.py"},{"line":103,"location":"paramiko/pkey.py"},{"line":214,"location":"paramiko/pkey.py"},{"line":215,"location":"paramiko/pkey.py"},{"additionalContext":"[comment]","line":234,"location":"paramiko/pkey.py"},{"additionalContext":"[comment]","line":235,"location":"paramiko/pkey.py"},{"additionalContext":"[comment]","line":238,"location":"paramiko/pkey.py"},{"additionalContext":"[comment]","line":928,"location":"paramiko/pkey.py"},{"line":98,"location":"paramiko/transport.py"},{"line":199,"location":"paramiko/transport.py"},{"line":208,"location":"paramiko/transport.py"},{"line":322,"location":"paramiko/transport.py"},{"line":323,"location":"paramiko/transport.py"},{"line":1,"location":"tests/_support/ed25519.key-cert.pub"},{"line":19,"location":"tests/_util.py"},{"line":91,"location":"tests/_util.py"},{"line":20,"location":"tests/auth.py"},{"line":83,"location":"tests/auth.py"},{"line":293,"location":"tests/auth.py"},{"line":297,"location":"tests/auth.py"},{"line":301,"location":"tests/auth.py"},{"line":306,"location":"tests/auth.py"},{"line":15,"location":"tests/conftest.py"},{"line":138,"location":"tests/conftest.py"},{"line":139,"location":"tests/conftest.py"},{"line":140,"location":"tests/conftest.py"},{"line":14,"location":"tests/pkey.py"},{"line":173,"location":"tests/pkey.py"},{"additionalContext":"[comment]","line":174,"location":"tests/pkey.py"},{"line":188,"location":"tests/pkey.py"},{"line":189,"location":"tests/pkey.py"},{"line":231,"location":"tests/pkey.py"},{"line":232,"location":"tests/pkey.py"},{"additionalContext":"[comment]","line":247,"location":"tests/pkey.py"},{"additionalContext":"[comment]","line":256,"location":"tests/pkey.py"},{"line":288,"location":"tests/pkey.py"},{"additionalContext":"[comment]","line":295,"location":"tests/pkey.py"},{"line":302,"location":"tests/pkey.py"},{"line":310,"location":"tests/pkey.py"},{"line":52,"location":"tests/test_client.py"},{"line":266,"location":"tests/test_client.py"},{"line":267,"location":"tests/test_client.py"},{"line":277,"location":"tests/test_client.py"},{"line":285,"location":"tests/test_client.py"},{"line":286,"location":"tests/test_client.py"},{"additionalContext":"[comment]","line":287,"location":"tests/test_client.py"},{"line":289,"location":"tests/test_client.py"},{"line":290,"location":"tests/test_client.py"},{"line":293,"location":"tests/test_client.py"},{"line":294,"location":"tests/test_client.py"},{"line":329,"location":"tests/test_client.py"},{"line":343,"location":"tests/test_client.py"},{"line":712,"location":"tests/test_client.py"},{"line":717,"location":"tests/test_client.py"},{"line":41,"location":"tests/test_hostkeys.py"},{"line":55,"location":"tests/test_hostkeys.py"},{"line":113,"location":"tests/test_hostkeys.py"},{"line":114,"location":"tests/test_hostkeys.py"},{"line":118,"location":"tests/test_hostkeys.py"},{"line":132,"location":"tests/test_hostkeys.py"},{"line":38,"location":"tests/test_pkey.py"},{"line":476,"location":"tests/test_pkey.py"},{"line":477,"location":"tests/test_pkey.py"},{"line":478,"location":"tests/test_pkey.py"},{"line":479,"location":"tests/test_pkey.py"},{"line":483,"location":"tests/test_pkey.py"},{"line":485,"location":"tests/test_pkey.py"},{"line":486,"location":"tests/test_pkey.py"},{"line":489,"location":"tests/test_pkey.py"},{"line":491,"location":"tests/test_pkey.py"},{"line":492,"location":"tests/test_pkey.py"},{"line":495,"location":"tests/test_pkey.py"},{"line":497,"location":"tests/test_pkey.py"},{"line":499,"location":"tests/test_pkey.py"},{"line":508,"location":"tests/test_pkey.py"},{"line":511,"location":"tests/test_pkey.py"},{"line":512,"location":"tests/test_pkey.py"},{"line":514,"location":"tests/test_pkey.py"},{"line":515,"location":"tests/test_pkey.py"},{"line":519,"location":"tests/test_pkey.py"},{"line":521,"location":"tests/test_pkey.py"},{"line":522,"location":"tests/test_pkey.py"},{"line":529,"location":"tests/test_pkey.py"},{"line":530,"location":"tests/test_pkey.py"},{"line":531,"location":"tests/test_pkey.py"},{"line":1228,"location":"tests/test_transport.py"},{"line":66,"location":"tests/test_util.py"}]},"name":"Ed25519","properties":[{"name":"qrp:classification","value":"classical_vulnerable"},{"name":"qrp:severity","value":"high"},{"name":"qrp:occurrences","value":"1"},{"name":"qrp:quantumPosture","value":"quantum-vulnerable"}],"type":"cryptographic-asset"},{"bom-ref":"crypto/algorithm/Ed448","cryptoProperties":{"algorithmProperties":{"executionEnvironment":"unknown","implementationPlatform":"unknown","parameterSetIdentifier":"456","primitive":"signature"},"assetType":"algorithm","oid":"1.3.101.113"},"description":"Ed448 is broken by a large-scale quantum computer (Shor's algorithm).","evidence":{"occurrences":[{"line":1,"location":"tests/_support/ed448.key"},{"additionalContext":"[comment]","line":74,"location":"tests/pkey.py"},{"line":76,"location":"tests/pkey.py"},{"line":79,"location":"tests/pkey.py"}]},"name":"Ed448","properties":[{"name":"qrp:classification","value":"classical_vulnerable"},{"name":"qrp:severity","value":"high"},{"name":"qrp:occurrences","value":"1"},{"name":"qrp:quantumPosture","value":"quantum-vulnerable"}],"type":"cryptographic-asset"},{"bom-ref":"crypto/algorithm/MD5","cryptoProperties":{"algorithmProperties":{"executionEnvironment":"unknown","implementationPlatform":"unknown","primitive":"hash"},"assetType":"algorithm","oid":"1.2.840.113549.2.5"},"description":"MD5 is cryptographically broken.","evidence":{"occurrences":[{"line":390,"location":"paramiko/pkey.py"},{"line":193,"location":"paramiko/transport.py"},{"line":195,"location":"paramiko/transport.py"},{"line":295,"location":"paramiko/transport.py"},{"line":296,"location":"paramiko/transport.py"},{"line":232,"location":"tests/test_transport.py"},{"line":1116,"location":"tests/test_transport.py"},{"line":1117,"location":"tests/test_transport.py"},{"line":1159,"location":"tests/test_transport.py"}]},"name":"MD5","properties":[{"name":"qrp:classification","value":"deprecated_weak"},{"name":"qrp:severity","value":"high"},{"name":"qrp:occurrences","value":"1"}],"type":"cryptographic-asset"},{"bom-ref":"crypto/algorithm/ML-KEM","cryptoProperties":{"algorithmProperties":{"executionEnvironment":"unknown","implementationPlatform":"unknown","primitive":"kem"},"assetType":"algorithm"},"description":"ML-KEM is a post-quantum structured lattice scheme (standardised); quantum-resistant.","evidence":{"occurrences":[{"additionalContext":"[comment]","line":2,"location":"paramiko/kex_mlkem.py"},{"additionalContext":"[comment]","line":5,"location":"paramiko/kex_mlkem.py"},{"additionalContext":"[comment]","line":6,"location":"paramiko/kex_mlkem.py"},{"additionalContext":"[comment]","line":8,"location":"paramiko/kex_mlkem.py"},{"line":28,"location":"paramiko/kex_mlkem.py"},{"additionalContext":"[comment]","line":37,"location":"paramiko/kex_mlkem.py"},{"additionalContext":"[comment]","line":47,"location":"paramiko/kex_mlkem.py"},{"additionalContext":"[comment]","line":49,"location":"paramiko/kex_mlkem.py"},{"additionalContext":"[comment]","line":50,"location":"paramiko/kex_mlkem.py"},{"line":54,"location":"paramiko/kex_mlkem.py"},{"additionalContext":"[comment]","line":56,"location":"paramiko/kex_mlkem.py"},{"line":57,"location":"paramiko/kex_mlkem.py"},{"line":58,"location":"paramiko/kex_mlkem.py"},{"line":60,"location":"paramiko/kex_mlkem.py"},{"line":61,"location":"paramiko/kex_mlkem.py"},{"additionalContext":"[comment]","line":65,"location":"paramiko/kex_mlkem.py"},{"line":66,"location":"paramiko/kex_mlkem.py"},{"line":72,"location":"paramiko/kex_mlkem.py"},{"line":75,"location":"paramiko/kex_mlkem.py"},{"line":88,"location":"paramiko/kex_mlkem.py"},{"line":90,"location":"paramiko/kex_mlkem.py"},{"line":131,"location":"paramiko/kex_mlkem.py"},{"line":132,"location":"paramiko/kex_mlkem.py"},{"additionalContext":"[comment]","line":134,"location":"paramiko/kex_mlkem.py"},{"line":135,"location":"paramiko/kex_mlkem.py"},{"line":136,"location":"paramiko/kex_mlkem.py"},{"line":189,"location":"paramiko/kex_mlkem.py"},{"line":190,"location":"paramiko/kex_mlkem.py"},{"line":192,"location":"paramiko/kex_mlkem.py"},{"line":197,"location":"paramiko/kex_mlkem.py"},{"line":104,"location":"paramiko/transport.py"},{"line":226,"location":"paramiko/transport.py"},{"line":337,"location":"paramiko/transport.py"},{"additionalContext":"[comment]","line":1869,"location":"paramiko/transport.py"},{"line":483,"location":"tests/test_kex.py"},{"additionalContext":"[comment]","line":485,"location":"tests/test_kex.py"},{"additionalContext":"[comment]","line":486,"location":"tests/test_kex.py"},{"line":489,"location":"tests/test_kex.py"},{"additionalContext":"[comment]","line":554,"location":"tests/test_kex.py"},{"additionalContext":"[comment]","line":555,"location":"tests/test_kex.py"},{"line":567,"location":"tests/test_kex.py"},{"line":589,"location":"tests/test_kex.py"}]},"name":"ML-KEM","properties":[{"name":"qrp:classification","value":"pqc_ready"},{"name":"qrp:severity","value":"info"},{"name":"qrp:occurrences","value":"1"},{"name":"qrp:quantumPosture","value":"post-quantum"}],"type":"cryptographic-asset"},{"bom-ref":"crypto/algorithm/RSA","cryptoProperties":{"algorithmProperties":{"executionEnvironment":"unknown","implementationPlatform":"unknown","primitive":"pke"},"assetType":"algorithm"},"description":"RSA is broken by a large-scale quantum computer (Shor's algorithm). Whether the RSA key is below the classical minimum is not established: key size not read on the lines that name it; NIST SP 800-131A Rev. 2 (March 2019), Table 2 (signature generation: len(n) < 2048 disallowed; verification: legacy use down to 1024) and Table 5 (key agreement and transport: len(n) < 2048 disallowed) not applied.","evidence":{"occurrences":[{"line":69,"location":"paramiko/__init__.py"},{"line":115,"location":"paramiko/__init__.py"},{"line":45,"location":"paramiko/agent.py"},{"line":46,"location":"paramiko/agent.py"},{"line":53,"location":"paramiko/agent.py"},{"line":54,"location":"paramiko/agent.py"},{"additionalContext":"[comment]","line":490,"location":"paramiko/agent.py"},{"additionalContext":"[comment]","line":473,"location":"paramiko/auth_handler.py"},{"additionalContext":"[comment]","line":474,"location":"paramiko/auth_handler.py"},{"additionalContext":"[comment]","line":475,"location":"paramiko/auth_handler.py"},{"additionalContext":"[comment]","line":478,"location":"paramiko/auth_handler.py"},{"additionalContext":"[comment]","line":714,"location":"paramiko/auth_handler.py"},{"additionalContext":"[comment]","line":715,"location":"paramiko/auth_handler.py"},{"additionalContext":"[comment]","line":421,"location":"paramiko/client.py"},{"line":430,"location":"paramiko/client.py"},{"line":431,"location":"paramiko/client.py"},{"line":432,"location":"paramiko/client.py"},{"line":433,"location":"paramiko/client.py"},{"line":434,"location":"paramiko/client.py"},{"additionalContext":"[comment]","line":453,"location":"paramiko/client.py"},{"additionalContext":"[comment]","line":454,"location":"paramiko/client.py"},{"additionalContext":"[comment]","line":455,"location":"paramiko/client.py"},{"line":690,"location":"paramiko/client.py"},{"line":729,"location":"paramiko/client.py"},{"line":103,"location":"paramiko/pkey.py"},{"line":212,"location":"paramiko/pkey.py"},{"line":213,"location":"paramiko/pkey.py"},{"additionalContext":"[comment]","line":338,"location":"paramiko/pkey.py"},{"additionalContext":"[comment]","line":453,"location":"paramiko/pkey.py"},{"additionalContext":"[comment]","line":928,"location":"paramiko/pkey.py"},{"additionalContext":"[comment]","line":948,"location":"paramiko/pkey.py"},{"line":35,"location":"paramiko/rsakey.py"},{"line":41,"location":"paramiko/rsakey.py"},{"line":43,"location":"paramiko/rsakey.py"},{"line":44,"location":"paramiko/rsakey.py"},{"line":45,"location":"paramiko/rsakey.py"},{"line":46,"location":"paramiko/rsakey.py"},{"line":76,"location":"paramiko/rsakey.py"},{"line":78,"location":"paramiko/rsakey.py"},{"additionalContext":"[comment]","line":84,"location":"paramiko/rsakey.py"},{"additionalContext":"[comment]","line":85,"location":"paramiko/rsakey.py"},{"line":89,"location":"paramiko/rsakey.py"},{"line":90,"location":"paramiko/rsakey.py"},{"line":98,"location":"paramiko/rsakey.py"},{"line":99,"location":"paramiko/rsakey.py"},{"line":103,"location":"paramiko/rsakey.py"},{"line":132,"location":"paramiko/rsakey.py"},{"line":140,"location":"paramiko/rsakey.py"},{"line":143,"location":"paramiko/rsakey.py"},{"line":159,"location":"paramiko/rsakey.py"},{"line":171,"location":"paramiko/rsakey.py"},{"additionalContext":"[comment]","line":186,"location":"paramiko/rsakey.py"},{"line":188,"location":"paramiko/rsakey.py"},{"line":191,"location":"paramiko/rsakey.py"},{"line":214,"location":"paramiko/rsakey.py"},{"line":215,"location":"paramiko/rsakey.py"},{"line":226,"location":"paramiko/rsakey.py"},{"line":203,"location":"paramiko/transport.py"},{"line":204,"location":"paramiko/transport.py"},{"line":212,"location":"paramiko/transport.py"},{"line":213,"location":"paramiko/transport.py"},{"additionalContext":"[comment]","line":301,"location":"paramiko/transport.py"},{"additionalContext":"[comment]","line":304,"location":"paramiko/transport.py"},{"additionalContext":"[comment]","line":307,"location":"paramiko/transport.py"},{"additionalContext":"[comment]","line":311,"location":"paramiko/transport.py"},{"line":312,"location":"paramiko/transport.py"},{"line":313,"location":"paramiko/transport.py"},{"line":314,"location":"paramiko/transport.py"},{"line":315,"location":"paramiko/transport.py"},{"line":794,"location":"paramiko/transport.py"},{"line":795,"location":"paramiko/transport.py"},{"line":796,"location":"paramiko/transport.py"},{"line":1320,"location":"paramiko/transport.py"},{"line":1322,"location":"paramiko/transport.py"},{"line":1323,"location":"paramiko/transport.py"},{"additionalContext":"[comment]","line":1858,"location":"paramiko/transport.py"},{"line":1,"location":"tests/_support/rsa-lonely.key"},{"line":1,"location":"tests/_support/rsa-missing.key-cert.pub"},{"line":1,"location":"tests/_support/rsa.key"},{"line":1,"location":"tests/_support/rsa.key-cert.pub"},{"line":21,"location":"tests/_util.py"},{"line":287,"location":"tests/_util.py"},{"line":8,"location":"tests/agent.py"},{"line":9,"location":"tests/agent.py"},{"line":103,"location":"tests/agent.py"},{"line":104,"location":"tests/agent.py"},{"line":109,"location":"tests/agent.py"},{"line":110,"location":"tests/agent.py"},{"line":113,"location":"tests/agent.py"},{"line":114,"location":"tests/agent.py"},{"line":143,"location":"tests/agent.py"},{"line":27,"location":"tests/auth.py"},{"line":154,"location":"tests/auth.py"},{"line":169,"location":"tests/auth.py"},{"line":196,"location":"tests/auth.py"},{"line":199,"location":"tests/auth.py"},{"line":206,"location":"tests/auth.py"},{"line":209,"location":"tests/auth.py"},{"line":216,"location":"tests/auth.py"},{"line":17,"location":"tests/conftest.py"},{"line":86,"location":"tests/conftest.py"},{"line":125,"location":"tests/conftest.py"},{"line":126,"location":"tests/conftest.py"},{"line":132,"location":"tests/conftest.py"},{"line":133,"location":"tests/conftest.py"},{"additionalContext":"[comment]","line":162,"location":"tests/conftest.py"},{"line":18,"location":"tests/pkey.py"},{"line":55,"location":"tests/pkey.py"},{"line":94,"location":"tests/pkey.py"},{"line":104,"location":"tests/pkey.py"},{"line":108,"location":"tests/pkey.py"},{"line":131,"location":"tests/pkey.py"},{"line":135,"location":"tests/pkey.py"},{"line":138,"location":"tests/pkey.py"},{"line":140,"location":"tests/pkey.py"},{"line":146,"location":"tests/pkey.py"},{"line":150,"location":"tests/pkey.py"},{"line":165,"location":"tests/pkey.py"},{"line":167,"location":"tests/pkey.py"},{"additionalContext":"[comment]","line":174,"location":"tests/pkey.py"},{"line":184,"location":"tests/pkey.py"},{"line":220,"location":"tests/pkey.py"},{"line":221,"location":"tests/pkey.py"},{"line":222,"location":"tests/pkey.py"},{"line":223,"location":"tests/pkey.py"},{"line":224,"location":"tests/pkey.py"},{"line":227,"location":"tests/pkey.py"},{"line":228,"location":"tests/pkey.py"},{"line":245,"location":"tests/pkey.py"},{"line":260,"location":"tests/pkey.py"},{"line":50,"location":"tests/test_client.py"},{"line":128,"location":"tests/test_client.py"},{"line":129,"location":"tests/test_client.py"},{"line":174,"location":"tests/test_client.py"},{"additionalContext":"[comment]","line":203,"location":"tests/test_client.py"},{"line":206,"location":"tests/test_client.py"},{"line":254,"location":"tests/test_client.py"},{"line":276,"location":"tests/test_client.py"},{"line":385,"location":"tests/test_client.py"},{"line":386,"location":"tests/test_client.py"},{"line":397,"location":"tests/test_client.py"},{"line":399,"location":"tests/test_client.py"},{"line":488,"location":"tests/test_client.py"},{"line":489,"location":"tests/test_client.py"},{"line":495,"location":"tests/test_client.py"},{"line":613,"location":"tests/test_client.py"},{"line":620,"location":"tests/test_client.py"},{"line":34,"location":"tests/test_hostkeys.py"},{"line":37,"location":"tests/test_hostkeys.py"},{"line":38,"location":"tests/test_hostkeys.py"},{"line":82,"location":"tests/test_hostkeys.py"},{"line":89,"location":"tests/test_hostkeys.py"},{"line":90,"location":"tests/test_hostkeys.py"},{"line":93,"location":"tests/test_hostkeys.py"},{"line":105,"location":"tests/test_hostkeys.py"},{"line":112,"location":"tests/test_hostkeys.py"},{"line":117,"location":"tests/test_hostkeys.py"},{"line":121,"location":"tests/test_hostkeys.py"},{"line":128,"location":"tests/test_hostkeys.py"},{"line":503,"location":"tests/test_kex.py"},{"line":517,"location":"tests/test_kex.py"},{"line":40,"location":"tests/test_pkey.py"},{"line":50,"location":"tests/test_pkey.py"},{"line":54,"location":"tests/test_pkey.py"},{"line":55,"location":"tests/test_pkey.py"},{"line":56,"location":"tests/test_pkey.py"},{"line":59,"location":"tests/test_pkey.py"},{"line":63,"location":"tests/test_pkey.py"},{"line":64,"location":"tests/test_pkey.py"},{"line":65,"location":"tests/test_pkey.py"},{"line":66,"location":"tests/test_pkey.py"},{"line":69,"location":"tests/test_pkey.py"},{"line":116,"location":"tests/test_pkey.py"},{"line":136,"location":"tests/test_pkey.py"},{"line":137,"location":"tests/test_pkey.py"},{"line":138,"location":"tests/test_pkey.py"},{"line":139,"location":"tests/test_pkey.py"},{"line":140,"location":"tests/test_pkey.py"},{"line":141,"location":"tests/test_pkey.py"},{"line":142,"location":"tests/test_pkey.py"},{"line":147,"location":"tests/test_pkey.py"},{"line":149,"location":"tests/test_pkey.py"},{"line":152,"location":"tests/test_pkey.py"},{"line":160,"location":"tests/test_pkey.py"},{"line":165,"location":"tests/test_pkey.py"},{"line":167,"location":"tests/test_pkey.py"},{"line":168,"location":"tests/test_pkey.py"},{"line":171,"location":"tests/test_pkey.py"},{"line":172,"location":"tests/test_pkey.py"},{"line":173,"location":"tests/test_pkey.py"},{"line":174,"location":"tests/test_pkey.py"},{"line":175,"location":"tests/test_pkey.py"},{"line":178,"location":"tests/test_pkey.py"},{"line":180,"location":"tests/test_pkey.py"},{"line":182,"location":"tests/test_pkey.py"},{"line":187,"location":"tests/test_pkey.py"},{"line":188,"location":"tests/test_pkey.py"},{"line":198,"location":"tests/test_pkey.py"},{"line":201,"location":"tests/test_pkey.py"},{"line":202,"location":"tests/test_pkey.py"},{"line":204,"location":"tests/test_pkey.py"},{"line":205,"location":"tests/test_pkey.py"},{"line":207,"location":"tests/test_pkey.py"},{"line":208,"location":"tests/test_pkey.py"},{"line":214,"location":"tests/test_pkey.py"},{"line":412,"location":"tests/test_pkey.py"},{"line":413,"location":"tests/test_pkey.py"},{"line":416,"location":"tests/test_pkey.py"},{"line":417,"location":"tests/test_pkey.py"},{"line":419,"location":"tests/test_pkey.py"},{"line":420,"location":"tests/test_pkey.py"},{"line":421,"location":"tests/test_pkey.py"},{"line":423,"location":"tests/test_pkey.py"},{"line":426,"location":"tests/test_pkey.py"},{"line":429,"location":"tests/test_pkey.py"},{"line":435,"location":"tests/test_pkey.py"},{"line":436,"location":"tests/test_pkey.py"},{"line":455,"location":"tests/test_pkey.py"},{"line":462,"location":"tests/test_pkey.py"},{"line":467,"location":"tests/test_pkey.py"},{"line":469,"location":"tests/test_pkey.py"},{"line":472,"location":"tests/test_pkey.py"},{"line":541,"location":"tests/test_pkey.py"},{"line":1,"location":"tests/test_rsa.key.pub"},{"line":1,"location":"tests/test_rsa_password.key"},{"line":60,"location":"tests/test_ssh_exception.py"},{"line":61,"location":"tests/test_ssh_exception.py"},{"line":42,"location":"tests/test_transport.py"},{"line":117,"location":"tests/test_transport.py"},{"line":118,"location":"tests/test_transport.py"},{"line":183,"location":"tests/test_transport.py"},{"line":184,"location":"tests/test_transport.py"},{"line":209,"location":"tests/test_transport.py"},{"line":210,"location":"tests/test_transport.py"},{"line":860,"location":"tests/test_transport.py"},{"line":861,"location":"tests/test_transport.py"},{"line":1118,"location":"tests/test_transport.py"},{"line":1119,"location":"tests/test_transport.py"},{"line":1121,"location":"tests/test_transport.py"},{"line":1160,"location":"tests/test_transport.py"},{"line":1176,"location":"tests/test_transport.py"},{"line":1183,"location":"tests/test_transport.py"},{"line":1210,"location":"tests/test_transport.py"},{"line":1215,"location":"tests/test_transport.py"},{"line":1228,"location":"tests/test_transport.py"},{"line":1232,"location":"tests/test_transport.py"},{"line":1243,"location":"tests/test_transport.py"},{"line":35,"location":"tests/test_util.py"},{"line":38,"location":"tests/test_util.py"},{"line":76,"location":"tests/test_util.py"},{"line":120,"location":"tests/test_util.py"}]},"name":"RSA","properties":[{"name":"qrp:classification","value":"classical_vulnerable"},{"name":"qrp:severity","value":"high"},{"name":"qrp:occurrences","value":"1"},{"name":"qrp:quantumPosture","value":"quantum-vulnerable"}],"type":"cryptographic-asset"},{"bom-ref":"crypto/algorithm/SHA1","cryptoProperties":{"algorithmProperties":{"executionEnvironment":"unknown","implementationPlatform":"unknown","primitive":"hash"},"assetType":"algorithm","oid":"1.3.14.3.2.26"},"description":"SHA-1 is deprecated and collision-prone.","evidence":{"occurrences":[{"line":449,"location":"paramiko/config.py"},{"line":294,"location":"paramiko/hostkeys.py"},{"line":299,"location":"paramiko/hostkeys.py"},{"additionalContext":"[comment]","line":376,"location":"paramiko/sftp_file.py"},{"additionalContext":"[comment]","line":382,"location":"paramiko/sftp_file.py"},{"line":83,"location":"paramiko/sftp_server.py"},{"line":192,"location":"paramiko/transport.py"},{"line":194,"location":"paramiko/transport.py"},{"line":289,"location":"paramiko/transport.py"},{"line":290,"location":"paramiko/transport.py"},{"additionalContext":"[comment]","line":301,"location":"paramiko/transport.py"},{"line":608,"location":"tests/test_sftp.py"}]},"name":"SHA1","properties":[{"name":"qrp:classification","value":"deprecated_weak"},{"name":"qrp:severity","value":"high"},{"name":"qrp:occurrences","value":"1"}],"type":"cryptographic-asset"},{"bom-ref":"crypto/algorithm/X25519","cryptoProperties":{"algorithmProperties":{"executionEnvironment":"unknown","implementationPlatform":"unknown","primitive":"key-agree"},"assetType":"algorithm","oid":"1.3.101.110"},"description":"X25519 is broken by a large-scale quantum computer (Shor's algorithm).","evidence":{"occurrences":[{"line":7,"location":"paramiko/kex_curve25519.py"},{"line":8,"location":"paramiko/kex_curve25519.py"},{"line":20,"location":"paramiko/kex_curve25519.py"},{"line":30,"location":"paramiko/kex_curve25519.py"},{"line":40,"location":"paramiko/kex_curve25519.py"},{"line":45,"location":"paramiko/kex_curve25519.py"},{"line":71,"location":"paramiko/kex_curve25519.py"},{"line":109,"location":"paramiko/kex_curve25519.py"},{"additionalContext":"[comment]","line":6,"location":"paramiko/kex_mlkem.py"},{"additionalContext":"[comment]","line":9,"location":"paramiko/kex_mlkem.py"},{"line":21,"location":"paramiko/kex_mlkem.py"},{"line":22,"location":"paramiko/kex_mlkem.py"},{"line":45,"location":"paramiko/kex_mlkem.py"},{"additionalContext":"[comment]","line":47,"location":"paramiko/kex_mlkem.py"},{"additionalContext":"[comment]","line":49,"location":"paramiko/kex_mlkem.py"},{"additionalContext":"[comment]","line":51,"location":"paramiko/kex_mlkem.py"},{"line":54,"location":"paramiko/kex_mlkem.py"},{"additionalContext":"[comment]","line":56,"location":"paramiko/kex_mlkem.py"},{"line":59,"location":"paramiko/kex_mlkem.py"},{"line":60,"location":"paramiko/kex_mlkem.py"},{"line":61,"location":"paramiko/kex_mlkem.py"},{"additionalContext":"[comment]","line":67,"location":"paramiko/kex_mlkem.py"},{"line":68,"location":"paramiko/kex_mlkem.py"},{"line":76,"location":"paramiko/kex_mlkem.py"},{"line":84,"location":"paramiko/kex_mlkem.py"},{"line":91,"location":"paramiko/kex_mlkem.py"},{"line":110,"location":"paramiko/kex_mlkem.py"},{"line":111,"location":"paramiko/kex_mlkem.py"},{"line":112,"location":"paramiko/kex_mlkem.py"},{"line":117,"location":"paramiko/kex_mlkem.py"},{"additionalContext":"[comment]","line":138,"location":"paramiko/kex_mlkem.py"},{"line":139,"location":"paramiko/kex_mlkem.py"},{"line":143,"location":"paramiko/kex_mlkem.py"},{"line":193,"location":"paramiko/kex_mlkem.py"},{"line":198,"location":"paramiko/kex_mlkem.py"},{"line":223,"location":"paramiko/transport.py"},{"line":224,"location":"paramiko/transport.py"},{"line":225,"location":"paramiko/transport.py"},{"line":226,"location":"paramiko/transport.py"},{"line":334,"location":"paramiko/transport.py"},{"line":335,"location":"paramiko/transport.py"},{"line":336,"location":"paramiko/transport.py"},{"line":337,"location":"paramiko/transport.py"},{"additionalContext":"[comment]","line":1869,"location":"paramiko/transport.py"},{"line":36,"location":"tests/test_kex.py"},{"line":141,"location":"tests/test_kex.py"},{"line":142,"location":"tests/test_kex.py"},{"line":147,"location":"tests/test_kex.py"},{"line":148,"location":"tests/test_kex.py"},{"line":150,"location":"tests/test_kex.py"},{"line":153,"location":"tests/test_kex.py"},{"line":158,"location":"tests/test_kex.py"},{"line":159,"location":"tests/test_kex.py"},{"line":436,"location":"tests/test_kex.py"},{"line":439,"location":"tests/test_kex.py"},{"line":451,"location":"tests/test_kex.py"},{"line":462,"location":"tests/test_kex.py"},{"line":465,"location":"tests/test_kex.py"},{"line":476,"location":"tests/test_kex.py"},{"line":482,"location":"tests/test_kex.py"},{"line":483,"location":"tests/test_kex.py"},{"additionalContext":"[comment]","line":485,"location":"tests/test_kex.py"},{"line":489,"location":"tests/test_kex.py"},{"line":493,"location":"tests/test_kex.py"},{"line":539,"location":"tests/test_kex.py"},{"line":544,"location":"tests/test_kex.py"},{"additionalContext":"[comment]","line":554,"location":"tests/test_kex.py"},{"additionalContext":"[comment]","line":555,"location":"tests/test_kex.py"},{"additionalContext":"[comment]","line":575,"location":"tests/test_kex.py"},{"additionalContext":"[comment]","line":576,"location":"tests/test_kex.py"},{"additionalContext":"[comment]","line":1316,"location":"tests/test_transport.py"}]},"name":"X25519","properties":[{"name":"qrp:classification","value":"classical_vulnerable"},{"name":"qrp:severity","value":"high"},{"name":"qrp:occurrences","value":"1"},{"name":"qrp:quantumPosture","value":"quantum-vulnerable"}],"type":"cryptographic-asset"},{"bom-ref":"crypto/algorithm/private_key","cryptoProperties":{"algorithmProperties":{"executionEnvironment":"unknown","implementationPlatform":"unknown","primitive":"other"},"assetType":"algorithm"},"description":"Embedded private key material committed to the repository; rotate the key and remove it from version control history.","evidence":{"occurrences":[{"location":"tests/_support/ecdsa-256.key:1"},{"location":"tests/_support/ed25519.key:1"},{"location":"tests/_support/ed448.key:1"},{"location":"tests/_support/rsa-lonely.key:1"},{"location":"tests/_support/rsa-passphrased.key:1"},{"location":"tests/_support/rsa.key:1"},{"location":"tests/badhash_key1.ed25519.key:1"},{"location":"tests/badhash_key2.ed25519.key:1"},{"location":"tests/test_ecdsa_384.key:1"},{"location":"tests/test_ecdsa_384_openssh.key:1"},{"location":"tests/test_ecdsa_521.key:1"},{"location":"tests/test_ecdsa_password_256.key:1"},{"location":"tests/test_ecdsa_password_384.key:1"},{"location":"tests/test_ecdsa_password_521.key:1"},{"location":"tests/test_ed25519-funky-padding.key:1"},{"location":"tests/test_ed25519-funky-padding_password.key:1"},{"location":"tests/test_ed25519_password.key:1"},{"location":"tests/test_pkey.py:70"},{"location":"tests/test_pkey.py:88"},{"location":"tests/test_pkey.py:96"},{"location":"tests/test_pkey.py:105"},{"location":"tests/test_rsa_openssh.key:1"},{"location":"tests/test_rsa_openssh_nopad.key:1"},{"location":"tests/test_rsa_password.key:1"}]},"name":"private_key","properties":[{"name":"qrp:classification","value":"unknown"},{"name":"qrp:severity","value":"critical"},{"name":"qrp:occurrences","value":"24"}],"type":"cryptographic-asset"}],"metadata":{"component":{"bom-ref":"target","name":"paramiko","type":"application"},"properties":[{"name":"qrp:scope","value":"source, CI and IaC files under the scanned path"},{"name":"qrp:filesScanned","value":"{\"certificate\": 26, \"ci_config\": 1, \"config\": 12, \"iac\": 0, \"source\": 71}"},{"name":"qrp:completeness","value":"partial: reflects only what was scanned; runtime keys, certificates and hardware are not observed"},{"name":"qrp:coverage:instrument:tool","value":"qrp-mcp"},{"name":"qrp:coverage:instrument:version","value":"0.44.0"},{"name":"qrp:coverage:instrument:revision","value":"cb4297acf558c04e5d556dcbf171ec6e055929b2 (built from)"},{"name":"qrp:coverage:instrument:source_commit:pinned","value":"true"},{"name":"qrp:coverage:instrument:source_commit:commit","value":"cb4297acf558c04e5d556dcbf171ec6e055929b2"},{"name":"qrp:coverage:instrument:source_commit:dirty","value":"false"},{"name":"qrp:coverage:instrument:source_commit:basis","value":"built_from"},{"name":"qrp:coverage:instrument:source_commit:meaning","value":"installed from a wheel built from this commit; the commit was recorded at build time, and the installed files were not compared with it"},{"name":"qrp:coverage:instrument:ruleset:algorithm_patterns","value":"281"},{"name":"qrp:coverage:instrument:ruleset:iac_algorithm_patterns","value":"2"},{"name":"qrp:coverage:instrument:ruleset:signing_command_patterns","value":"11"},{"name":"qrp:coverage:instrument:ruleset:certificate_oid_names","value":"43"},{"name":"qrp:coverage:instrument:ruleset:pem_labels","value":"8"},{"name":"qrp:coverage:instrument:ruleset:cipher_suite_components","value":"27"},{"name":"qrp:coverage:instrument:ruleset:openssl3_fetch_names","value":"32"},{"name":"qrp:coverage:instrument:ruleset:jca_names","value":"54"},{"name":"qrp:coverage:instrument:ruleset:tls_group_names","value":"53"},{"name":"qrp:coverage:instrument:ruleset:opcua_security_policies","value":"30"},{"name":"qrp:coverage:instrument:ruleset:aws_tls_policies","value":"45"},{"name":"qrp:coverage:instrument:ruleset:ike_fragmentation_products","value":"7"},{"name":"qrp:coverage:instrument:ruleset:dnssec_algorithm_numbers","value":"16"},{"name":"qrp:coverage:instrument:claimed_types:source","value":".bash,.bat,.c,.cairo,.cc,.cjs,.cmake,.cmd,.cpp,.cs,.cts,.cxx,.fs,.fsx,.go,.groovy,.h,.hh,.hpp,.in,.inc,.java,.js,.jsx,.ksh,.kt,.kts,.mjs,.move,.mts,.php,.pl,.pm,.ps1,.psd1,.psm1,.py,.rb,.rs,.sc,.scala,.sh,.sol,.t,.ts,.tsx,.vb,.zsh"},{"name":"qrp:coverage:instrument:claimed_types:iac","value":".tf,.tfvars"},{"name":"qrp:coverage:instrument:claimed_types:config","value":".cfg,.cnf,.conf,.gotmpl,.hcl,.inf,.ini,.json,.mk,.mqsc,.properties,.props,.reg,.targets,.toml,.tpl,.vcxproj,.wxs,.zone"},{"name":"qrp:coverage:instrument:claimed_types:config_filenames","value":"CMakeLists.txt,Caddyfile,Containerfile,Dockerfile,GNUmakefile,Kconfig,Makefile,authorized_keys,java.policy,java.security,known_hosts,krb5.conf,main.cf,makefile,master.cf,openid-configuration,ssh_config,sshd_config,ssl.conf"},{"name":"qrp:coverage:instrument:claimed_types:config_filename_pattern","value":"^(?:Dockerfile|Containerfile|Kconfig)[-.][\\w.-]+$|^[\\w.-]+\\.(?:Dockerfile|Containerfile)$|^sdkconfig(?:\\.[\\w.-]+)?$|^java\\.security\\.[\\w.-]+$,^(?:web|app|machine|applicationhost)(?:\\.[\\w-]+)?\\.config$,^dsset-[\\w.-]+$|^db\\.[\\w.-]+$,^K[\\w.-]*\\+\\d{3}\\+\\d{5}\\.(?:key|private)$"},{"name":"qrp:coverage:instrument:claimed_types:config_when_a_zone_file","value":".db"},{"name":"qrp:coverage:instrument:claimed_types:config_extensionless_in_directories","value":"mods-available,mods-enabled,sites-available,sites-enabled"},{"name":"qrp:coverage:instrument:claimed_types:codeowners","value":".github/CODEOWNERS,CODEOWNERS,docs/CODEOWNERS,.gitlab/CODEOWNERS"},{"name":"qrp:coverage:instrument:claimed_types:ci_filenames","value":".gitlab-ci.yml,Jenkinsfile,azure-pipelines.yml"},{"name":"qrp:coverage:instrument:claimed_types:certificate","value":".asc,.cer,.cert,.crt,.csr,.der,.gpg,.jks,.key,.keystore,.p12,.p7b,.p7c,.pem,.pfx,.pgp,.pub,.snk"},{"name":"qrp:coverage:instrument:claimed_types:openpgp_key_filenames","value":"KEYS"},{"name":"qrp:coverage:instrument:claimed_types:plist","value":".plist"},{"name":"qrp:coverage:instrument:claimed_types:config_when_naming_opcua_security_policy","value":".json5,.xml"},{"name":"qrp:coverage:instrument:claimed_types:yaml","value":".yaml,.yml"},{"name":"qrp:coverage:instrument:claimed_types:manifest","value":".csproj,.fsproj,.gemspec,.gradle,.gradle.kts,.podspec,.vbproj"},{"name":"qrp:coverage:instrument:claimed_types:manifest_filenames","value":"Cargo.lock,Cargo.toml,Directory.Packages.props,Gemfile,Gemfile.lock,Package.resolved,Pipfile,Pipfile.lock,build.gradle,build.gradle.kts,composer.json,composer.lock,go.mod,package-lock.json,package.json,packages.config,pnpm-lock.yaml,poetry.lock,pom.xml,pyproject.toml,requirements.txt,yarn.lock"},{"name":"qrp:coverage:instrument:claimed_types:jinja_template","value":".j2,.jinja2,.jinja"},{"name":"qrp:coverage:instrument:claimed_types:any_type_beginning_with_key_material","value":"*"},{"name":"qrp:coverage:instrument:excluded_dirs","value":".git,.mypy_cache,.pytest_cache,.ruff_cache,.tox,.venv,__pycache__,build,dist,node_modules,target,vendor,venv"},{"name":"qrp:coverage:corpus:pinned_at:pinned","value":"true"},{"name":"qrp:coverage:corpus:pinned_at:kind","value":"git"},{"name":"qrp:coverage:corpus:pinned_at:commit","value":"0e9ccb91e0f9a68f2587233d523ad7fe46e730fe"},{"name":"qrp:coverage:corpus:pinned_at:committed_at","value":"2026-10-17T22:36:52-04:00"},{"name":"qrp:coverage:corpus:pinned_at:dirty","value":"false"},{"name":"qrp:coverage:corpus:pinned_at:shallow","value":"false"},{"name":"qrp:coverage:corpus:content_digest","value":"sha256:775832f03275da59f1b5ba0b02c9b59237acfec258664e5f0450e05fff702d6f"},{"name":"qrp:coverage:scope:files_excluded_before_counting:total","value":"28"},{"name":"qrp:coverage:scope:files_excluded_before_counting:by_directory:.git","value":"28"},{"name":"qrp:coverage:scope:files_present","value":"196"},{"name":"qrp:coverage:scope:files_present_by_extension:.py","value":"70"},{"name":"qrp:coverage:scope:files_present_by_extension:(no extension)","value":"55"},{"name":"qrp:coverage:scope:files_present_by_extension:.rst","value":"26"},{"name":"qrp:coverage:scope:files_present_by_extension:.key","value":"21"},{"name":"qrp:coverage:scope:files_present_by_extension:.yml","value":"8"},{"name":"qrp:coverage:scope:files_present_by_extension:.pub","value":"5"},{"name":"qrp:coverage:scope:files_present_by_extension:.png","value":"2"},{"name":"qrp:coverage:scope:files_present_by_extension:.yaml","value":"2"},{"name":"qrp:coverage:scope:files_present_by_extension:.i386","value":"1"},{"name":"qrp:coverage:scope:files_present_by_extension:.in","value":"1"},{"name":"qrp:coverage:scope:files_present_by_extension:.ini","value":"1"},{"name":"qrp:coverage:scope:files_present_by_extension:.md","value":"1"},{"name":"qrp:coverage:scope:files_present_by_extension:.psd","value":"1"},{"name":"qrp:coverage:scope:files_present_by_extension:.toml","value":"1"},{"name":"qrp:coverage:scope:files_present_by_extension:.xml","value":"1"},{"name":"qrp:coverage:scope:concentration:partition","value":"files by extension"},{"name":"qrp:coverage:scope:concentration:distinct_kinds","value":"15"},{"name":"qrp:coverage:scope:concentration:largest:kind","value":".py"},{"name":"qrp:coverage:scope:concentration:largest:files","value":"70"},{"name":"qrp:coverage:scope:concentration:largest:share_pct","value":"35.71"},{"name":"qrp:coverage:scope:concentration:largest_group:kinds","value":".py,(no extension)"},{"name":"qrp:coverage:scope:concentration:largest_group:files","value":"125"},{"name":"qrp:coverage:scope:concentration:largest_group:share_pct","value":"63.78"},{"name":"qrp:coverage:scope:files_examined","value":"110"},{"name":"qrp:coverage:scope:files_not_examined","value":"86"},{"name":"qrp:coverage:scope:coverage_pct","value":"56.12"},{"name":"qrp:coverage:scope:read_in_part","value":"5"},{"name":"qrp:coverage:scope:read_in_full_pct","value":"53.57"},{"name":"qrp:coverage:claims:axis","value":"reached"},{"name":"qrp:coverage:claims:meaning","value":"whether the instrument opened the file; measurable by the instrument about itself, and confessed when it fails"},{"name":"qrp:coverage:claims:second_axis_not_claimed","value":"whether what was present was found; NOT measurable by the instrument about itself, because a silent rule and an absent algorithm produce the same output. Only a control licenses a figure on this axis"},{"name":"qrp:coverage:claims:control:held","value":"false"},{"name":"qrp:coverage:claims:control:reason","value":"none_held"},{"name":"qrp:coverage:claims:control:meaning","value":"no corpus with independently established contents exists for this instrument; nothing here claims the second axis"},{"name":"qrp:coverage:claims:self_seeded_control:ran","value":"false"},{"name":"qrp:coverage:claims:self_seeded_control:name","value":"robustness on known patterns"},{"name":"qrp:coverage:claims:self_seeded_control:feeds","value":"nothing: claims.control.held and the CBOM's compositions[].aggregate are not read from this block"},{"name":"qrp:coverage:claims:self_seeded_control:how","value":"qrp-mcp control PATH --seed N, or qrp-mcp scan PATH --control-seed N"},{"name":"qrp:coverage:not_examined:0:reason","value":"type_not_claimed"},{"name":"qrp:coverage:not_examined:0:meaning","value":"the tool does not claim this file type; a declared boundary, not a failure"},{"name":"qrp:coverage:not_examined:0:count","value":"86"},{"name":"qrp:coverage:not_examined:0:by_extension:(no extension)","value":"55"},{"name":"qrp:coverage:not_examined:0:by_extension:.rst","value":"26"},{"name":"qrp:coverage:not_examined:0:by_extension:.png","value":"2"},{"name":"qrp:coverage:not_examined:0:by_extension:.md","value":"1"},{"name":"qrp:coverage:not_examined:0:by_extension:.psd","value":"1"},{"name":"qrp:coverage:not_examined:0:by_extension:.xml","value":"1"},{"name":"qrp:coverage:not_examined:0:concentration:partition","value":"unread files by extension"},{"name":"qrp:coverage:not_examined:0:concentration:distinct_kinds","value":"6"},{"name":"qrp:coverage:not_examined:0:concentration:largest:kind","value":"(no extension)"},{"name":"qrp:coverage:not_examined:0:concentration:largest:files","value":"55"},{"name":"qrp:coverage:not_examined:0:concentration:largest:share_pct","value":"63.95"},{"name":"qrp:coverage:not_examined:0:concentration:largest_group:kinds","value":"(no extension),.rst,.png"},{"name":"qrp:coverage:not_examined:0:concentration:largest_group:files","value":"83"},{"name":"qrp:coverage:not_examined:0:concentration:largest_group:share_pct","value":"96.51"},{"name":"qrp:coverage:not_examined:0:paths","value":"[\".bzrignore\", \".codespellrc\", \".coveragerc\", \".flake8\", \".git-blame-ignore-revs\", \".gitignore\", \"LICENSE\", \"README.rst\", \"SECURITY.md\", \"TODO\", \"images/paramiko-banner.png\", \"images/paramiko-banner.psd\", \"images/paramiko.png\", \"sites/docs/api/agent.rst\", \"sites/docs/api/auth.rst\", \"sites/docs/api/buffered_pipe.rst\", \"sites/docs/api/channel.rst\", \"sites/docs/api/client.rst\", \"sites/docs/api/config.rst\", \"sites/docs/api/file.rst\", \"sites/docs/api/hostkeys.rst\", \"sites/docs/api/keys.rst\", \"sites/docs/api/message.rst\", \"sites/docs/api/packet.rst\", \"sites/docs/api/pipe.rst\", \"sites/docs/api/proxy.rst\", \"sites/docs/api/server.rst\", \"sites/docs/api/sftp.rst\", \"sites/docs/api/ssh_exception.rst\", \"sites/docs/api/transport.rst\", \"sites/docs/index.rst\", \"sites/www/_templates/rss.xml\", \"sites/www/changelog.rst\", \"sites/www/contact.rst\", \"sites/www/contributing.rst\", \"sites/www/faq.rst\", \"sites/www/index.rst\", \"sites/www/installing-1.x.rst\", \"sites/www/installing.rst\", \"tests/configs/basic\", \"tests/configs/canon\", \"tests/configs/canon-always\", \"tests/configs/canon-ipv4\", \"tests/configs/canon-local\", \"tests/configs/canon-local-always\", \"tests/configs/deep-canon\", \"tests/configs/deep-canon-maxdots\", \"tests/configs/empty-canon\", \"tests/configs/fallback-no\", \"tests/configs/fallback-yes\", \"tests/configs/hostname-exec-tokenized\", \"tests/configs/hostname-tokenized\", \"tests/configs/invalid\", \"tests/configs/match-all\", \"tests/configs/match-all-after-canonical\", \"tests/configs/match-all-and-more\", \"tests/configs/match-all-and-more-before\", \"tests/configs/match-all-before-canonical\", \"tests/configs/match-canonical-no\", \"tests/configs/match-canonical-yes\", \"tests/configs/match-complex\", \"tests/configs/match-exec\", \"tests/configs/match-exec-canonical\", \"tests/configs/match-exec-negation\", \"tests/configs/match-exec-no-arg\", \"tests/configs/match-final\", \"tests/configs/match-host\", \"tests/configs/match-host-canonicalized\", \"tests/configs/match-host-from-match\", \"tests/configs/match-host-glob\", \"tests/configs/match-host-glob-list\", \"tests/configs/match-host-name\", \"tests/configs/match-host-negated\", \"tests/configs/match-host-no-arg\", \"tests/configs/match-localuser\", \"tests/configs/match-localuser-no-arg\", \"tests/configs/match-orighost\", \"tests/configs/match-orighost-canonical\", \"tests/configs/match-orighost-no-arg\", \"tests/configs/match-user\", \"tests/configs/match-user-explicit\", \"tests/configs/match-user-no-arg\", \"tests/configs/multi-canon-domains\", \"tests/configs/no-canon\", \"tests/configs/robey\", \"tests/configs/zero-maxdots\"]"},{"name":"qrp:coverage:not_examined:1:reason","value":"unreadable"},{"name":"qrp:coverage:not_examined:1:meaning","value":"opened and could not be read; attempted and failed"},{"name":"qrp:coverage:not_examined:1:count","value":"0"},{"name":"qrp:coverage:not_examined:1:paths","value":"[]"},{"name":"qrp:coverage:examined_without_result:reason","value":"claimed_but_not_decoded"},{"name":"qrp:coverage:examined_without_result:meaning","value":"a claimed file type that was read and gave up no algorithm: encrypted content, or a structure this tool does not parse"},{"name":"qrp:coverage:examined_without_result:count","value":"1"},{"name":"qrp:coverage:examined_without_result:paths","value":"[\"tests/blank_rsa.key\"]"},{"name":"qrp:coverage:symlinks_not_followed:reason","value":"a symbolic link, not followed: its target is chosen by the scanned tree rather than by the caller"},{"name":"qrp:coverage:symlinks_not_followed:count","value":"0"},{"name":"qrp:coverage:symlinks_not_followed:files","value":"0"},{"name":"qrp:coverage:symlinks_not_followed:directories","value":"0"},{"name":"qrp:coverage:symlinks_not_followed:directories_into_tree","value":"0"},{"name":"qrp:coverage:symlinks_not_followed:paths","value":"[]"},{"name":"qrp:coverage:directories_not_entered:count","value":"0"},{"name":"qrp:coverage:directories_not_entered:paths","value":"[]"},{"name":"qrp:coverage:directories_not_entered:meaning","value":"could not be entered or listed; the files inside are unknown and are not in files_present"},{"name":"qrp:coverage:accounts_for_every_file","value":"true"}],"timestamp":"2026-11-05T07:22:23Z","tools":{"components":[{"name":"qrp-dora","type":"application","version":"0.13.0"},{"name":"qrp-mcp","type":"application","version":"0.44.0"}]}},"specVersion":"1.6","version":1}