Skip to content

Repository navigation

THIRD_PARTY_NOTICES.md

Latest commit

 

History

History
42 lines (29 loc) · 3.59 KB

THIRD_PARTY_NOTICES.md

File metadata and controls

42 lines (29 loc) · 3.59 KB
Raw

Third-party benchmark notices

PQCensus uses two forms of third-party benchmark material: small pinned excerpts for curated call-site measurements, and complete pinned source snapshots for repository-scale end-to-end smoke tests. Labels and required observations are manually derived from upstream API/source semantics and are not generated by the scanner.

Curated excerpts

  • pyca/cryptography 46.0.7, commit 622d672e429a7cff836a23c5903683dbec1901f5: used under Apache-2.0 (the upstream project also offers BSD-3-Clause). Copyright pyca/cryptography contributors.
  • PyJWT 2.13.0, commit 7144e4534c34810f4525dc4578a32addd8212cff: MIT License, copyright 2015-2022 Jose Padilla. Permission is granted under the MIT terms; the copyright and permission notice must remain with substantial copies.
  • PyCryptodome v3.23.0, commit cde63f8f9b64f1c8cd86249128cfd5986c2c43af: the selected file carries a public-domain dedication and a worldwide, perpetual, royalty-free permissive fallback.

Exact source paths, line selections, file hashes, and label bases are recorded in provenance.json. No upstream project endorses PQCensus or these labels.

The machine-readable registration for complete snapshots is benchmarks/third-party-corpus.json. It records the upstream repository, immutable commit, snapshot tree hash, SPDX license, applicable license-file hash, purpose, and modification status. The validator scripts/validate_third_party_notices.py checks those fields against the checked-out bytes before a release gate can pass.

End-to-end source snapshots

The directories under corpus/end-to-end/ are complete source snapshots with their .git directories removed. They are pinned and manually reviewed as documented in end-to-end-provenance.json:

Each snapshot retains its upstream LICENSE file. The current license-file SHA-256 values are:

  • PyJWT-2.10.1/LICENSE: 797a7a20231d4c433e9f1911db1731d06b5828b98f499819a034f7c0f56f5ce5
  • python-jose-3.3.0/LICENSE: a5e618eee6d496f77ad8ae70fea6edf148159558e2d228787d9076c900a2f926

Complete upstream test trees can contain intentionally public test certificates and private-key fixtures used by the upstream project's own tests. Those fixture keys are not PQCensus credentials, are not used for any live identity or service, and are retained only because exact upstream bytes are part of the reproducible benchmark corpus. They must never be replaced with production or private credentials.

Pinned benchmark versions may also preserve historical upstream vulnerabilities by design. They are static test data, not PQCensus runtime dependencies, and PQCensus never imports, installs, executes, or recommends those snapshot packages. A vulnerability or license alert attached to a snapshot is not automatically a PQCensus runtime finding; its disposition must use the provenance and VEX boundary in docs/BENCHMARK_CORPUS_POLICY.md. The PyPI wheel and source distribution intentionally exclude the end-to-end snapshots and all other benchmark corpora; the full corpora remain in the GitHub source repository solely for transparent reproduction.

PQCensus does not execute these repositories or their test suites; it only parses bounded source and metadata. The corpus must not contain private repositories, user credentials, customer material, or secrets that were not already deliberate public upstream test fixtures.