wheel-crypto-scan
Reports crypto-relevant evidence found inside Python wheels: which primitive families and libraries are present, how they are linked, what the Python code does with TLS, hashing and randomness, and whether post-quantum algorithms show up. That is the account a package index's consumers get, wheel by wheel.
FIPS compatibility is one lens over that account, not its whole purpose: whether a FIPS-enforcing host can run the wheel's crypto as shipped, so consuming teams can gauge FIPS risk before they ship it. It gathers evidence. It does not decide FIPS compliance.
Install and run
uv tool install . # or: uv run wheel-crypto-scan
wheel-crypto-scan scan /path/to/wheels -o index.jsonl --jobs 8
Full docs — the FIPS lens, every flag, the output schema, the ruleset, and the design calls that cost something: https://my1.fr/wheel-crypto-scan/
Development
uvx --with tox-uv tox # tests across py311-py314, plus ruff lint and format
uvx --with tox-uv tox -e lint
See Contributing for adding policy, changing extraction, writing up a design call, and releasing.
Licence
Apache 2.0. See LICENSE.
Release files for wheel-crypto-scan 0.1.8
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | Actions |
|---|---|---|---|---|
| wheel_crypto_scan-0.1.8.tar.gz | 843.9 kB | With provenance | Details for wheel_crypto_scan-0.1.8.tar.gz |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Actions Reset |
|---|---|---|---|---|
| wheel_crypto_scan-0.1.8-py3-none-any.whl | Python 3 | none | any | Details for wheel_crypto_scan-0.1.8-py3-none-any.whl |
Total release size: 1.1 MB
Release files / wheel_crypto_scan-0.1.8.tar.gz
| Download URL | wheel_crypto_scan-0.1.8.tar.gz |
|---|---|
| Size | 843.9 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
fffa0af4ecf176a08270cae02a17692d99cb6332c8d9f97644c5a04ecc82b9c3
|
|
BLAKE2b-256 checksum How to use checksums |
6b6fbe1c1ca8ca61f40c93d07b4733a229c755667f49d1c3e90d0880c81d6d38
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Sep 22, 2026.
Transparency logRelease files / wheel_crypto_scan-0.1.8-py3-none-any.whl
| Download URL | wheel_crypto_scan-0.1.8-py3-none-any.whl |
|---|---|
| Size | 293.1 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
9006ede6e943dee89124acb38cd1f1a733fe3bf40ed44eb2d178c7f80a7f06a3
|
|
BLAKE2b-256 checksum How to use checksums |
ae3683b12a06f63703b3c82b715c2e774350103a0ad3153f88b75bd69a168ff3
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Sep 22, 2026.
Transparency logSecurity for wheel-crypto-scan 0.1.8
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
Full provenance
Both files in this release have been uploaded with provenance metadata.
Attestation for wheel_crypto_scan-0.1.8.tar.gz
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Sep 22, 2026.
Transparency logA note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
To learn more about protecting yourself from malicious actors, visit our package security documentation.
