{
  "module": "pyjwt_quantum_external",
  "claim_type": "classification",
  "provenance": "third_party",
  "tool_version": "1.171.0",
  "elapsed_seconds": 3.77,
  "notes": [
    "semgrep available: True",
    "4 files vendored unmodified from jpadilla/pyjwt (MIT license, pinned commit 7144e4534c34810f4525dc4578a32addd8212cff) -- see benchmark/corpus/vendor/pyjwt/NOTICE.md",
    "Ground truth is QShield's own file-level classification, not borrowed from any PyJWT documentation -- see benchmark/corpus/pyjwt_quantum.py CLASSIFICATION for the evidence behind every verdict. Surfaced a real ES256/PS256 (JWA ECDSA/RSA-PSS) detection gap during construction, fixed before this corpus was scored."
  ],
  "case_count": 4,
  "reproduction_recipe": [
    "Fetch the unmodified file expected_context.filename from https://github.com/jpadilla/pyjwt, path expected_context.source_path, pinned commit 7144e4534c34810f4525dc4578a32addd8212cff (MIT license -- see benchmark/corpus/vendor/pyjwt/NOTICE.md).",
    "Run QShield's source-code scanner against it unmodified (this is the one third-party tier that exercises the bundled semgrep ruleset, not just the regex fallback -- PyJWT is Python).",
    "Check whether it reported any quantum_vulnerable finding anywhere in the file.",
    "Ground truth (expected.vulnerable) was derived by QShield's team reading the file directly, not borrowed from any PyJWT documentation -- see expected_note for the specific evidence, and benchmark/corpus/pyjwt_quantum.py CLASSIFICATION for the full list."
  ],
  "cases": [
    {
      "case_id": "pyjwt_quantum:algorithms.py",
      "claim_type": "classification",
      "expected": {
        "vulnerable": true,
        "present": null
      },
      "expected_context": {
        "filename": "algorithms.py",
        "source": "jpadilla/pyjwt (MIT)",
        "source_path": "jwt/"
      },
      "expected_note": "Registers RSAAlgorithm/ECAlgorithm/RSAPSSAlgorithm/OKPAlgorithm for \"RS256\"/\"RS384\"/\"RS512\"/\"ES256\"/\"ES256K\"/\"ES384\"/\"ES512\"/\"PS256\"/\"EdDSA\"; real cryptography.hazmat imports for rsa/ec/ed25519/ed448 padding and verification -- also registers HMACAlgorithm for HS256/HS384/HS512 (symmetric) in the same file, which does not change the file-level verdict.",
      "actual_outcome": "TP",
      "actual_detail": {
        "filename": "algorithms.py"
      }
    },
    {
      "case_id": "pyjwt_quantum:exceptions.py",
      "claim_type": "classification",
      "expected": {
        "vulnerable": false,
        "present": null
      },
      "expected_context": {
        "filename": "exceptions.py",
        "source": "jpadilla/pyjwt (MIT)",
        "source_path": "jwt/"
      },
      "expected_note": "Pure exception class hierarchy -- no algorithm reference of any kind.",
      "actual_outcome": "TN",
      "actual_detail": {
        "filename": "exceptions.py"
      }
    },
    {
      "case_id": "pyjwt_quantum:types.py",
      "claim_type": "classification",
      "expected": {
        "vulnerable": false,
        "present": null
      },
      "expected_context": {
        "filename": "types.py",
        "source": "jpadilla/pyjwt (MIT)",
        "source_path": "jwt/"
      },
      "expected_note": "Pure typing aliases (HashlibHash, JWKDict) -- no algorithm reference.",
      "actual_outcome": "TN",
      "actual_detail": {
        "filename": "types.py"
      }
    },
    {
      "case_id": "pyjwt_quantum:warnings.py",
      "claim_type": "classification",
      "expected": {
        "vulnerable": false,
        "present": null
      },
      "expected_context": {
        "filename": "warnings.py",
        "source": "jpadilla/pyjwt (MIT)",
        "source_path": "jwt/"
      },
      "expected_note": "A single DeprecationWarning subclass -- no algorithm reference.",
      "actual_outcome": "TN",
      "actual_detail": {
        "filename": "warnings.py"
      }
    }
  ]
}