httplib2 0.32.1

Source: https://github.com/httplib2/httplib2
Artifact scanned: httplib2-0.32.1-py3-none-any.whl (wheel · 90.1 KB · SHA-256 82e7a6ab08fc…)
Compared with: httplib2-0.32.0-py3-none-any.whl (0 signals introduced since)
Files: 8 scanned, 4 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 43 info
Scan time: 28.6 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 43 of 43 warn and critical signals; 43 demoted to info.
Disclude version: 4.3.0
Scanned (UTC): 2026-10-29 08:46

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review encoding-base64 httplib2/cacerts.txt:9:1

base64-like blob (808 bytes over 13 lines, compression ratio 0.73) (raw pass, confidence 0.60)
```
-----BEGIN CERTIFICATE-----
MIICWjCCAcMCAgGlMA0GCSqGSIb3DQEBBAUAMHUxCzAJBgNVBAYTAlVTMRgwFgYD
VQQKEw9HVEUgQ29ycG9yYXRpb24xJzAlBgNVBAsTHkdURSBDeWJlclRydXN0IFNv
bHV0aW9ucywgSW5jLjEjMCEGA1UEAxMaR1RFIEN5YmVyVHJ1c3QgR2xvYmFsIFJv
```
dismissed LLM, confidence 0.97 A PEM-encoded root CA certificate in httplib2's bundled cacerts.txt.
Reasoning
The snippet is a PEM certificate block (BEGIN CERTIFICATE) inside httplib2's bundled CA certificate file. Base64 DER data is the expected content of a CA bundle, and the raw pass has a high false-positive rate on such data.
info ~~warn~~ → info by review encoding-base64 httplib2/cacerts.txt:59:1

base64-like blob (1084 bytes over 17 lines, compression ratio 0.71) (raw pass, confidence 0.60)
```
-----BEGIN CERTIFICATE-----
MIIDJzCCApCgAwIBAgIBATANBgkqhkiG9w0BAQQFADCBzjELMAkGA1UEBhMCWkEx
FTATBgNVBAgTDFdlc3Rlcm4gQ2FwZTESMBAGA1UEBxMJQ2FwZSBUb3duMR0wGwYD
VQQKExRUaGF3dGUgQ29uc3VsdGluZyBjYzEoMCYGA1UECxMfQ2VydGlmaWNhdGlv
```
dismissed LLM, confidence 0.97 A PEM-encoded CA certificate in httplib2's bundled cacerts.txt.
Reasoning
The snippet is a PEM certificate block in httplib2's standard CA bundle. The base64 flag is a byproduct of certificate encoding, not obfuscation.
info ~~warn~~ → info by review encoding-base64 httplib2/cacerts.txt:140:1

base64-like blob (1188 bytes over 19 lines, compression ratio 0.75) (raw pass, confidence 0.60)
```
-----BEGIN CERTIFICATE-----
MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkG
A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv
b3QgQ0ExGzAZBgNVBAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw05ODA5MDExMjAw
```
dismissed LLM, confidence 0.97 A PEM-encoded GlobalSign root CA certificate in the httplib2 CA bundle.
Reasoning
This is a standard PEM certificate entry (GlobalSign root) within a CA trust bundle. The base64 blob is expected certificate data.
info ~~warn~~ → info by review encoding-base64 httplib2/cacerts.txt:169:1

base64-like blob (1280 bytes over 20 lines, compression ratio 0.73) (raw pass, confidence 0.60)
```
-----BEGIN CERTIFICATE-----
MIIDujCCAqKgAwIBAgILBAAAAAABD4Ym5g0wDQYJKoZIhvcNAQEFBQAwTDEgMB4G
A1UECxMXR2xvYmFsU2lnbiBSb290IENBIC0gUjIxEzARBgNVBAoTCkdsb2JhbFNp
Z24xEzARBgNVBAMTCkdsb2JhbFNpZ24wHhcNMDYxMjE1MDgwMDAwWhcNMjExMjE1
```
dismissed LLM, confidence 0.97 A PEM-encoded GlobalSign root CA certificate in the httplib2 CA bundle.
Reasoning
A PEM certificate block in a CA trust bundle. Base64 encoding of DER certificate data is normal and the file is a known certificate store.
info ~~warn~~ → info by review encoding-base64 httplib2/cacerts.txt:377:1

base64-like blob (1496 bytes over 24 lines, compression ratio 0.72) (raw pass, confidence 0.60)
```
-----BEGIN CERTIFICATE-----
MIIEXDCCA0SgAwIBAgIEOGO5ZjANBgkqhkiG9w0BAQUFADCBtDEUMBIGA1UEChML
RW50cnVzdC5uZXQxQDA+BgNVBAsUN3d3dy5lbnRydXN0Lm5ldC9DUFNfMjA0OCBp
bmNvcnAuIGJ5IHJlZi4gKGxpbWl0cyBsaWFiLikxJTAjBgNVBAsTHChjKSAxOTk5
```
dismissed LLM, confidence 0.97 A PEM-encoded Entrust CA certificate in the httplib2 CA bundle.
Reasoning
A PEM certificate entry (Entrust) in a CA bundle. The base64 content is the certificate itself, consistent with the file's purpose.
info ~~warn~~ → info by review encoding-base64 httplib2/cacerts.txt:411:1

base64-like blob (1188 bytes over 19 lines, compression ratio 0.76) (raw pass, confidence 0.60)
```
-----BEGIN CERTIFICATE-----
MIIDdzCCAl+gAwIBAgIEAgAAuTANBgkqhkiG9w0BAQUFADBaMQswCQYDVQQGEwJJ
RTESMBAGA1UEChMJQmFsdGltb3JlMRMwEQYDVQQLEwpDeWJlclRydXN0MSIwIAYD
VQQDExlCYWx0aW1vcmUgQ3liZXJUcnVzdCBSb290MB4XDTAwMDUxMjE4NDYwMFoX
```
dismissed LLM, confidence 0.97 A PEM-encoded Baltimore CyberTrust root CA certificate in the httplib2 CA bundle.
Reasoning
A PEM certificate block (Baltimore CyberTrust root) in a CA trust bundle. Expected content for this file.
info ~~warn~~ → info by review encoding-base64 httplib2/cacerts.txt:440:1

base64-like blob (880 bytes over 14 lines, compression ratio 0.73) (raw pass, confidence 0.60)
```
-----BEGIN CERTIFICATE-----
MIICkDCCAfmgAwIBAgIBATANBgkqhkiG9w0BAQQFADBaMQswCQYDVQQGEwJVUzEc
MBoGA1UEChMTRXF1aWZheCBTZWN1cmUgSW5jLjEtMCsGA1UEAxMkRXF1aWZheCBT
ZWN1cmUgR2xvYmFsIGVCdXNpbmVzcyBDQS0xMB4XDTk5MDYyMTA0MDAwMFoXDTIw
```
dismissed LLM, confidence 0.97 A PEM-encoded Equifax root CA certificate in the httplib2 CA bundle.
Reasoning
A PEM certificate entry (Equifax root) in a CA trust bundle. The base64 flag reflects normal certificate encoding.
info ~~warn~~ → info by review encoding-base64 httplib2/cacerts.txt:580:1

base64-like blob (1400 bytes over 22 lines, compression ratio 0.71) (raw pass, confidence 0.60)
```
-----BEGIN CERTIFICATE-----
MIIEFTCCAv2gAwIBAgIBATANBgkqhkiG9w0BAQUFADBkMQswCQYDVQQGEwJTRTEU
MBIGA1UEChMLQWRkVHJ1c3QgQUIxHTAbBgNVBAsTFEFkZFRydXN0IFRUUCBOZXR3
b3JrMSAwHgYDVQQDExdBZGRUcnVzdCBQdWJsaWMgQ0EgUm9vdDAeFw0wMDA1MzAx
```
dismissed LLM, confidence 0.97 A PEM-encoded AddTrust root CA certificate in the httplib2 CA bundle.
Reasoning
A PEM certificate block (AddTrust root) in a CA trust bundle. Base64 DER data is the expected format here.
info ~~warn~~ → info by review encoding-base64 httplib2/cacerts.txt:612:1

base64-like blob (1412 bytes over 23 lines, compression ratio 0.71) (raw pass, confidence 0.60)
```
-----BEGIN CERTIFICATE-----
MIIEHjCCAwagAwIBAgIBATANBgkqhkiG9w0BAQUFADBnMQswCQYDVQQGEwJTRTEU
MBIGA1UEChMLQWRkVHJ1c3QgQUIxHTAbBgNVBAsTFEFkZFRydXN0IFRUUCBOZXR3
b3JrMSMwIQYDVQQDExpBZGRUcnVzdCBRdWFsaWZpZWQgQ0EgUm9vdDAeFw0wMDA1
```
dismissed LLM, confidence 0.97 A PEM-encoded AddTrust Qualified CA root certificate in the httplib2 CA bundle.
Reasoning
A PEM certificate entry (AddTrust qualified CA root) in a CA trust bundle. Expected content with no sign of obfuscation.
info ~~warn~~ → info by review encoding-base64 httplib2/cacerts.txt:645:1

base64-like blob (1564 bytes over 25 lines, compression ratio 0.73) (raw pass, confidence 0.60)
```
-----BEGIN CERTIFICATE-----
MIIEkTCCA3mgAwIBAgIERWtQVDANBgkqhkiG9w0BAQUFADCBsDELMAkGA1UEBhMC
VVMxFjAUBgNVBAoTDUVudHJ1c3QsIEluYy4xOTA3BgNVBAsTMHd3dy5lbnRydXN0
Lm5ldC9DUFMgaXMgaW5jb3Jwb3JhdGVkIGJ5IHJlZmVyZW5jZTEfMB0GA1UECxMW
```
dismissed LLM, confidence 0.97 A PEM-encoded Entrust root CA certificate in the httplib2 CA bundle.
Reasoning
A PEM certificate block (Entrust root) in a CA trust bundle. The base64 is the certificate, as expected.
info ~~warn~~ → info by review encoding-base64 httplib2/cacerts.txt:680:1

base64-like blob (1144 bytes over 18 lines, compression ratio 0.73) (raw pass, confidence 0.60)
```
-----BEGIN CERTIFICATE-----
MIIDVDCCAjygAwIBAgIDAjRWMA0GCSqGSIb3DQEBBQUAMEIxCzAJBgNVBAYTAlVT
MRYwFAYDVQQKEw1HZW9UcnVzdCBJbmMuMRswGQYDVQQDExJHZW9UcnVzdCBHbG9i
YWwgQ0EwHhcNMDIwNTIxMDQwMDAwWhcNMjIwNTIxMDQwMDAwWjBCMQswCQYDVQQG
```
dismissed LLM, confidence 0.97 A PEM-encoded GeoTrust Global CA certificate in the httplib2 CA bundle.
Reasoning
A PEM certificate entry (GeoTrust Global CA) in a CA trust bundle. Base64 encoding of certificate data is normal.
info ~~warn~~ → info by review encoding-base64 httplib2/cacerts.txt:737:1

base64-like blob (1852 bytes over 29 lines, compression ratio 0.74) (raw pass, confidence 0.60)
```
-----BEGIN CERTIFICATE-----
MIIFaDCCA1CgAwIBAgIBATANBgkqhkiG9w0BAQUFADBFMQswCQYDVQQGEwJVUzEW
MBQGA1UEChMNR2VvVHJ1c3QgSW5jLjEeMBwGA1UEAxMVR2VvVHJ1c3QgVW5pdmVy
c2FsIENBMB4XDTA0MDMwNDA1MDAwMFoXDTI5MDMwNDA1MDAwMFowRTELMAkGA1UE
```
dismissed LLM, confidence 0.97 A PEM-encoded GeoTrust Universal CA certificate in the httplib2 CA bundle.
Reasoning
A PEM certificate block (GeoTrust Universal CA) in a CA trust bundle. Expected content for a certificate store, not a dropper or hidden payload.
info ~~warn~~ → info by review encoding-base64 httplib2/cacerts.txt:776:1

base64-like blob (1856 bytes over 29 lines, compression ratio 0.71) (raw pass, confidence 0.60)
```
-----BEGIN CERTIFICATE-----
MIIFbDCCA1SgAwIBAgIBATANBgkqhkiG9w0BAQUFADBHMQswCQYDVQQGEwJVUzEW
MBQGA1UEChMNR2VvVHJ1c3QgSW5jLjEgMB4GA1UEAxMXR2VvVHJ1c3QgVW5pdmVy
c2FsIENBIDIwHhcNMDQwMzA0MDUwMDAwWhcNMjkwMzA0MDUwMDAwWjBHMQswCQYD
```
likely benign LLM, confidence 0.96 A GeoTrust root CA certificate in PEM form within httplib2's bundled CA file.
Reasoning
The snippet is a PEM-encoded X.509 certificate (GeoTrust root) inside the CA bundle that httplib2 ships. Base64 is the standard encoding for certificates, and a raw-pass base64 heuristic firing on it is a false positive.
info ~~warn~~ → info by review encoding-base64 httplib2/cacerts.txt:815:1

base64-like blob (1248 bytes over 20 lines, compression ratio 0.73) (raw pass, confidence 0.60)
```
-----BEGIN CERTIFICATE-----
MIIDpDCCAoygAwIBAgIBATANBgkqhkiG9w0BAQUFADBjMQswCQYDVQQGEwJVUzEc
MBoGA1UEChMTQW1lcmljYSBPbmxpbmUgSW5jLjE2MDQGA1UEAxMtQW1lcmljYSBP
bmxpbmUgUm9vdCBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSAxMB4XDTAyMDUyODA2
```
likely benign LLM, confidence 0.96 An America Online root CA certificate in PEM form in httplib2's CA bundle.
Reasoning
The snippet is a PEM certificate block (America Online Root CA 1) in the httplib2 CA bundle. This is ordinary certificate data, and the raw base64 heuristic matches it only because of the encoding.
info ~~warn~~ → info by review encoding-base64 httplib2/cacerts.txt:845:1

base64-like blob (1932 bytes over 31 lines, compression ratio 0.74) (raw pass, confidence 0.60)
```
-----BEGIN CERTIFICATE-----
MIIFpDCCA4ygAwIBAgIBATANBgkqhkiG9w0BAQUFADBjMQswCQYDVQQGEwJVUzEc
MBoGA1UEChMTQW1lcmljYSBPbmxpbmUgSW5jLjE2MDQGA1UEAxMtQW1lcmljYSBP
bmxpbmUgUm9vdCBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSAyMB4XDTAyMDUyODA2
```
likely benign LLM, confidence 0.96 An America Online root CA certificate in PEM form in httplib2's CA bundle.
Reasoning
The snippet is a PEM certificate (America Online Root CA 2) inside the standard CA bundle file. The base64 finding reflects the normal certificate encoding, not obfuscation.
info ~~warn~~ → info by review encoding-base64 httplib2/cacerts.txt:886:1

base64-like blob (1456 bytes over 23 lines, compression ratio 0.74) (raw pass, confidence 0.60)
```
-----BEGIN CERTIFICATE-----
MIIEPzCCAyegAwIBAgIBATANBgkqhkiG9w0BAQUFADB+MQswCQYDVQQGEwJHQjEb
MBkGA1UECAwSR3JlYXRlciBNYW5jaGVzdGVyMRAwDgYDVQQHDAdTYWxmb3JkMRow
GAYDVQQKDBFDb21vZG8gQ0EgTGltaXRlZDEkMCIGA1UEAwwbU2VjdXJlIENlcnRp
```
likely benign LLM, confidence 0.96 A Comodo root CA certificate in PEM form in httplib2's CA bundle.
Reasoning
The snippet is a PEM certificate (Comodo root CA) within the httplib2 CA bundle. Base64-encoded certificate data is expected in this file and is not a dropper or hidden payload.
info ~~warn~~ → info by review encoding-base64 httplib2/cacerts.txt:919:1

base64-like blob (1460 bytes over 23 lines, compression ratio 0.72) (raw pass, confidence 0.60)
```
-----BEGIN CERTIFICATE-----
MIIEQzCCAyugAwIBAgIBATANBgkqhkiG9w0BAQUFADB/MQswCQYDVQQGEwJHQjEb
MBkGA1UECAwSR3JlYXRlciBNYW5jaGVzdGVyMRAwDgYDVQQHDAdTYWxmb3JkMRow
GAYDVQQKDBFDb21vZG8gQ0EgTGltaXRlZDElMCMGA1UEAwwcVHJ1c3RlZCBDZXJ0
```
likely benign LLM, confidence 0.96 A Comodo trusted root CA certificate in PEM form in httplib2's CA bundle.
Reasoning
The snippet is a PEM certificate (Comodo trusted root) in the CA bundle. The raw base64 heuristic fires on standard certificate encoding, so this is a false positive.
info ~~warn~~ → info by review encoding-base64 httplib2/cacerts.txt:952:1

base64-like blob (1496 bytes over 24 lines, compression ratio 0.73) (raw pass, confidence 0.60)
```
-----BEGIN CERTIFICATE-----
MIIEXjCCA0agAwIBAgIQRL4Mi1AAIbQR0ypoBqmtaTANBgkqhkiG9w0BAQUFADCB
kzELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAlVUMRcwFQYDVQQHEw5TYWx0IExha2Ug
Q2l0eTEeMBwGA1UEChMVVGhlIFVTRVJUUlVTVCBOZXR3b3JrMSEwHwYDVQQLExho
```
likely benign LLM, confidence 0.96 A USERTrust root CA certificate in PEM form in httplib2's CA bundle.
Reasoning
The snippet is a PEM certificate (UTN/USERTrust root) inside the httplib2 CA file. Its base64 content is ordinary certificate data consistent with the file's purpose.
info ~~warn~~ → info by review encoding-base64 httplib2/cacerts.txt:1199:1

base64-like blob (1264 bytes over 20 lines, compression ratio 0.73) (raw pass, confidence 0.60)
```
-----BEGIN CERTIFICATE-----
MIIDrzCCApegAwIBAgIQCDvgVpBCRrGhdWrJWZHHSjANBgkqhkiG9w0BAQUFADBh
MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3
d3cuZGlnaWNlcnQuY29tMSAwHgYDVQQDExdEaWdpQ2VydCBHbG9iYWwgUm9vdCBD
```
likely benign LLM, confidence 0.96 A DigiCert global root CA certificate in PEM form in httplib2's CA bundle.
Reasoning
The snippet is a PEM certificate (DigiCert Global Root CA) in the httplib2 CA bundle. Base64 encoding of certificates is the standard format and is expected here.
info ~~warn~~ → info by review encoding-base64 httplib2/cacerts.txt:1229:1

base64-like blob (1292 bytes over 21 lines, compression ratio 0.73) (raw pass, confidence 0.60)
```
-----BEGIN CERTIFICATE-----
MIIDxTCCAq2gAwIBAgIQAqxcJmoLQJuPC3nyrkYldzANBgkqhkiG9w0BAQUFADBs
MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3
d3cuZGlnaWNlcnQuY29tMSswKQYDVQQDEyJEaWdpQ2VydCBIaWdoIEFzc3VyYW5j
```
likely benign LLM, confidence 0.96 A DigiCert high assurance root CA certificate in PEM form in httplib2's CA bundle.
Reasoning
The snippet is a PEM certificate (DigiCert High Assurance root) in the CA bundle. The base64 match is a false positive caused by the normal certificate format.
info ~~warn~~ → info by review encoding-base64 httplib2/cacerts.txt:1260:1

base64-like blob (1196 bytes over 19 lines, compression ratio 0.76) (raw pass, confidence 0.60)
```
-----BEGIN CERTIFICATE-----
MIIDfDCCAmSgAwIBAgIQGKy1av1pthU6Y2yv2vrEoTANBgkqhkiG9w0BAQUFADBY
MQswCQYDVQQGEwJVUzEWMBQGA1UEChMNR2VvVHJ1c3QgSW5jLjExMC8GA1UEAxMo
R2VvVHJ1c3QgUHJpbWFyeSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw0wNjEx
```
likely benign LLM, confidence 0.96 A GeoTrust primary root CA certificate in PEM form in httplib2's CA bundle.
Reasoning
The snippet is a PEM certificate (GeoTrust primary root) inside httplib2's CA bundle. Certificate base64 is the expected content of this file.
info ~~warn~~ → info by review encoding-base64 httplib2/cacerts.txt:1358:1

base64-like blob (1412 bytes over 23 lines, compression ratio 0.73) (raw pass, confidence 0.60)
```
-----BEGIN CERTIFICATE-----
MIIEHTCCAwWgAwIBAgIQToEtioJl4AsC7j41AkblPTANBgkqhkiG9w0BAQUFADCB
gTELMAkGA1UEBhMCR0IxGzAZBgNVBAgTEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4G
A1UEBxMHU2FsZm9yZDEaMBgGA1UEChMRQ09NT0RPIENBIExpbWl0ZWQxJzAlBgNV
```
likely benign LLM, confidence 0.96 A COMODO root CA certificate in PEM form in httplib2's CA bundle.
Reasoning
The snippet is a PEM certificate (COMODO root) in the httplib2 CA bundle. The base64 blob is standard certificate encoding and not a concealed payload.
info ~~warn~~ → info by review encoding-base64 httplib2/cacerts.txt:1516:1

base64-like blob (1324 bytes over 21 lines, compression ratio 0.73) (raw pass, confidence 0.60)
```
-----BEGIN CERTIFICATE-----
MIID3TCCAsWgAwIBAgIOHaIAAQAC7LdggHiNtgYwDQYJKoZIhvcNAQEFBQAweTEL
MAkGA1UEBhMCREUxHDAaBgNVBAoTE1RDIFRydXN0Q2VudGVyIEdtYkgxJDAiBgNV
BAsTG1RDIFRydXN0Q2VudGVyIFVuaXZlcnNhbCBDQTEmMCQGA1UEAxMdVEMgVHJ1
```
likely benign LLM, confidence 0.96 A T-Systems trust center root CA certificate in PEM form in httplib2's CA bundle.
Reasoning
The snippet is a PEM certificate (T-Systems / Deutsche Telekom trust center root) in the CA bundle. The base64 flag is a false positive on normal certificate data.
info ~~warn~~ → info by review encoding-base64 httplib2/cacerts.txt:1547:1

base64-like blob (1244 bytes over 20 lines, compression ratio 0.72) (raw pass, confidence 0.60)
```
-----BEGIN CERTIFICATE-----
MIIDoTCCAomgAwIBAgILBAAAAAABD4WqLUgwDQYJKoZIhvcNAQEFBQAwOzEYMBYG
A1UEChMPQ3liZXJ0cnVzdCwgSW5jMR8wHQYDVQQDExZDeWJlcnRydXN0IEdsb2Jh
bCBSb290MB4XDTA2MTIxNTA4MDAwMFoXDTIxMTIxNTA4MDAwMFowOzEYMBYGA1UE
```
likely benign LLM, confidence 0.96 A Cybertrust global root CA certificate in PEM form in httplib2's CA bundle.
Reasoning
The snippet is a PEM certificate (Cybertrust Global Root) in httplib2's CA bundle. Base64-encoded certificate content is expected here and is not malicious.
info ~~warn~~ → info by review encoding-base64 httplib2/cacerts.txt:1577:1

base64-like blob (1368 bytes over 22 lines, compression ratio 0.74) (raw pass, confidence 0.60)
```
-----BEGIN CERTIFICATE-----
MIID/jCCAuagAwIBAgIQFaxulBmyeUtB9iepwxgPHzANBgkqhkiG9w0BAQsFADCB
mDELMAkGA1UEBhMCVVMxFjAUBgNVBAoTDUdlb1RydXN0IEluYy4xOTA3BgNVBAsT
MChjKSAyMDA4IEdlb1RydXN0IEluYy4gLSBGb3IgYXV0aG9yaXplZCB1c2Ugb25s
```
dismissed LLM, confidence 0.97 A PEM certificate block in the httplib2 CA certificate bundle.
Reasoning
The snippet is a PEM-encoded X.509 certificate (DER in base64, GeoTrust) inside httplib2's standard CA bundle. Base64 is the expected encoding for certificates, and the raw-pass signal fires on format, not on any hidden payload.
info ~~warn~~ → info by review encoding-base64 httplib2/cacerts.txt:1609:1

base64-like blob (872 bytes over 14 lines, compression ratio 0.75) (raw pass, confidence 0.60)
```
-----BEGIN CERTIFICATE-----
MIICiDCCAg2gAwIBAgIQNfwmXNmET8k9Jj1Xm67XVjAKBggqhkjOPQQDAzCBhDEL
MAkGA1UEBhMCVVMxFTATBgNVBAoTDHRoYXd0ZSwgSW5jLjE4MDYGA1UECxMvKGMp
IDIwMDcgdGhhd3RlLCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxJDAi
```
dismissed LLM, confidence 0.97 A PEM certificate block in the httplib2 CA certificate bundle.
Reasoning
The snippet is a PEM-encoded certificate (thawte) in a CA trust bundle. The base64 blob is the normal certificate encoding, so this is a false positive from the raw pass.
info ~~warn~~ → info by review encoding-base64 httplib2/cacerts.txt:1633:1

base64-like blob (1428 bytes over 23 lines, compression ratio 0.74) (raw pass, confidence 0.60)
```
-----BEGIN CERTIFICATE-----
MIIEKjCCAxKgAwIBAgIQYAGXt0an6rS0mtZLL/eQ+zANBgkqhkiG9w0BAQsFADCB
rjELMAkGA1UEBhMCVVMxFTATBgNVBAoTDHRoYXd0ZSwgSW5jLjEoMCYGA1UECxMf
Q2VydGlmaWNhdGlvbiBTZXJ2aWNlcyBEaXZpc2lvbjE4MDYGA1UECxMvKGMpIDIw
```
dismissed LLM, confidence 0.97 A PEM certificate block in the httplib2 CA certificate bundle.
Reasoning
The snippet is a PEM-encoded certificate (thawte) in a CA trust bundle. The base64 content is ordinary certificate data, not an obfuscated payload.
info ~~warn~~ → info by review encoding-base64 httplib2/cacerts.txt:1666:1

base64-like blob (920 bytes over 15 lines, compression ratio 0.74) (raw pass, confidence 0.60)
```
-----BEGIN CERTIFICATE-----
MIICrjCCAjWgAwIBAgIQPLL0SAoA4v7rJDteYD7DazAKBggqhkjOPQQDAzCBmDEL
MAkGA1UEBhMCVVMxFjAUBgNVBAoTDUdlb1RydXN0IEluYy4xOTA3BgNVBAsTMChj
KSAyMDA3IEdlb1RydXN0IEluYy4gLSBGb3IgYXV0aG9yaXplZCB1c2Ugb25seTE2
```
dismissed LLM, confidence 0.97 A PEM certificate block in the httplib2 CA certificate bundle.
Reasoning
The snippet is a PEM-encoded certificate (GeoTrust) in a CA trust bundle. The base64 is standard certificate encoding and the finding is a raw-pass false positive.
info ~~warn~~ → info by review encoding-base64 httplib2/cacerts.txt:1691:1

base64-like blob (1620 bytes over 26 lines, compression ratio 0.72) (raw pass, confidence 0.60)
```
-----BEGIN CERTIFICATE-----
MIIEuTCCA6GgAwIBAgIQQBrEZCGzEyEDDrvkEhrFHTANBgkqhkiG9w0BAQsFADCB
vTELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQL
ExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMTowOAYDVQQLEzEoYykgMjAwOCBWZXJp
```
dismissed LLM, confidence 0.97 A PEM certificate block in the httplib2 CA certificate bundle.
Reasoning
The snippet is a PEM-encoded certificate (VeriSign) in a CA trust bundle. Base64 is the expected encoding here, so this is benign.
info ~~warn~~ → info by review encoding-base64 httplib2/cacerts.txt:1756:1

base64-like blob (1156 bytes over 19 lines, compression ratio 0.73) (raw pass, confidence 0.60)
```
-----BEGIN CERTIFICATE-----
MIIDXzCCAkegAwIBAgILBAAAAAABIVhTCKIwDQYJKoZIhvcNAQELBQAwTDEgMB4G
A1UECxMXR2xvYmFsU2lnbiBSb290IENBIC0gUjMxEzARBgNVBAoTCkdsb2JhbFNp
Z24xEzARBgNVBAMTCkdsb2JhbFNpZ24wHhcNMDkwMzE4MTAwMDAwWhcNMjkwMzE4
```
dismissed LLM, confidence 0.97 A PEM certificate block in the httplib2 CA certificate bundle.
Reasoning
The snippet is a PEM-encoded certificate (GlobalSign root) in a CA trust bundle. The base64 is ordinary certificate data and the raw-pass hit is a false positive.
info ~~warn~~ → info by review encoding-base64 httplib2/cacerts.txt:1785:1

base64-like blob (1332 bytes over 21 lines, compression ratio 0.73) (raw pass, confidence 0.60)
```
-----BEGIN CERTIFICATE-----
MIID4TCCAsmgAwIBAgIOYyUAAQACFI0zFQLkbPQwDQYJKoZIhvcNAQEFBQAwezEL
MAkGA1UEBhMCREUxHDAaBgNVBAoTE1RDIFRydXN0Q2VudGVyIEdtYkgxJDAiBgNV
BAsTG1RDIFRydXN0Q2VudGVyIFVuaXZlcnNhbCBDQTEoMCYGA1UEAxMfVEMgVHJ1
```
dismissed LLM, confidence 0.97 A PEM certificate block in the httplib2 CA certificate bundle.
Reasoning
The snippet is a PEM-encoded certificate (T-Systems/TC TrustCenter) in a CA trust bundle. Base64 is the normal encoding, so this is benign.
info ~~warn~~ → info by review encoding-base64 httplib2/cacerts.txt:1816:1

base64-like blob (1292 bytes over 21 lines, compression ratio 0.76) (raw pass, confidence 0.60)
```
-----BEGIN CERTIFICATE-----
MIIDxTCCAq2gAwIBAgIBADANBgkqhkiG9w0BAQsFADCBgzELMAkGA1UEBhMCVVMx
EDAOBgNVBAgTB0FyaXpvbmExEzARBgNVBAcTClNjb3R0c2RhbGUxGjAYBgNVBAoT
EUdvRGFkZHkuY29tLCBJbmMuMTEwLwYDVQQDEyhHbyBEYWRkeSBSb290IENlcnRp
```
dismissed LLM, confidence 0.97 A PEM certificate block in the httplib2 CA certificate bundle.
Reasoning
The snippet is a PEM-encoded certificate (GoDaddy root) in a CA trust bundle. The base64 content is expected certificate data, so the finding is a false positive.
info ~~warn~~ → info by review encoding-base64 httplib2/cacerts.txt:1847:1

base64-like blob (1324 bytes over 21 lines, compression ratio 0.75) (raw pass, confidence 0.60)
```
-----BEGIN CERTIFICATE-----
MIID3TCCAsWgAwIBAgIBADANBgkqhkiG9w0BAQsFADCBjzELMAkGA1UEBhMCVVMx
EDAOBgNVBAgTB0FyaXpvbmExEzARBgNVBAcTClNjb3R0c2RhbGUxJTAjBgNVBAoT
HFN0YXJmaWVsZCBUZWNobm9sb2dpZXMsIEluYy4xMjAwBgNVBAMTKVN0YXJmaWVs
```
dismissed LLM, confidence 0.97 A PEM certificate block in the httplib2 CA certificate bundle.
Reasoning
The snippet is a PEM-encoded certificate (Starfield root) in a CA trust bundle. The base64 is standard certificate encoding, not obfuscation.
info ~~warn~~ → info by review encoding-base64 httplib2/cacerts.txt:1878:1

base64-like blob (1348 bytes over 22 lines, compression ratio 0.75) (raw pass, confidence 0.60)
```
-----BEGIN CERTIFICATE-----
MIID7zCCAtegAwIBAgIBADANBgkqhkiG9w0BAQsFADCBmDELMAkGA1UEBhMCVVMx
EDAOBgNVBAgTB0FyaXpvbmExEzARBgNVBAcTClNjb3R0c2RhbGUxJTAjBgNVBAoT
HFN0YXJmaWVsZCBUZWNobm9sb2dpZXMsIEluYy4xOzA5BgNVBAMTMlN0YXJmaWVs
```
dismissed LLM, confidence 0.97 A PEM certificate block in the httplib2 CA certificate bundle.
Reasoning
The snippet is a PEM-encoded certificate (Starfield root) in a CA trust bundle. Base64 is expected here and the raw-pass signal is a false positive.
info ~~warn~~ → info by review encoding-base64 httplib2/cacerts.txt:1910:1

base64-like blob (1132 bytes over 18 lines, compression ratio 0.71) (raw pass, confidence 0.60)
```
-----BEGIN CERTIFICATE-----
MIIDTDCCAjSgAwIBAgIId3cGJyapsXwwDQYJKoZIhvcNAQELBQAwRDELMAkGA1UE
BhMCVVMxFDASBgNVBAoMC0FmZmlybVRydXN0MR8wHQYDVQQDDBZBZmZpcm1UcnVz
dCBDb21tZXJjaWFsMB4XDTEwMDEyOTE0MDYwNloXDTMwMTIzMTE0MDYwNlowRDEL
```
dismissed LLM, confidence 0.97 A PEM certificate block in the httplib2 CA certificate bundle.
Reasoning
The snippet is a PEM-encoded certificate (AffirmTrust) in a CA trust bundle. The base64 is ordinary certificate data, so this is benign.
info ~~warn~~ → info by review encoding-base64 httplib2/cacerts.txt:1938:1

base64-like blob (1132 bytes over 18 lines, compression ratio 0.71) (raw pass, confidence 0.60)
```
-----BEGIN CERTIFICATE-----
MIIDTDCCAjSgAwIBAgIIfE8EORzUmS0wDQYJKoZIhvcNAQEFBQAwRDELMAkGA1UE
BhMCVVMxFDASBgNVBAoMC0FmZmlybVRydXN0MR8wHQYDVQQDDBZBZmZpcm1UcnVz
dCBOZXR3b3JraW5nMB4XDTEwMDEyOTE0MDgyNFoXDTMwMTIzMTE0MDgyNFowRDEL
```
dismissed LLM, confidence 0.97 A PEM certificate block in the httplib2 CA certificate bundle.
Reasoning
The snippet is a PEM-encoded certificate (AffirmTrust) in a CA trust bundle. Base64 is the expected format and the finding is a raw-pass false positive.
info ~~warn~~ → info by review encoding-base64 httplib2/cacerts.txt:1966:1

base64-like blob (1808 bytes over 29 lines, compression ratio 0.74) (raw pass, confidence 0.60)
```
-----BEGIN CERTIFICATE-----
MIIFRjCCAy6gAwIBAgIIbYwURrGmCu4wDQYJKoZIhvcNAQEMBQAwQTELMAkGA1UE
BhMCVVMxFDASBgNVBAoMC0FmZmlybVRydXN0MRwwGgYDVQQDDBNBZmZpcm1UcnVz
dCBQcmVtaXVtMB4XDTEwMDEyOTE0MTAzNloXDTQwMTIzMTE0MTAzNlowQTELMAkG
```
likely benign LLM, confidence 0.97 A PEM-encoded root CA certificate inside httplib2's bundled CA file.
Reasoning
The snippet is a PEM certificate block (BEGIN CERTIFICATE header, standard base64 DER lines). A base64-like flag on a CA bundle is expected; the raw pass has a high false-positive rate and nothing here is executable or hidden.
info ~~warn~~ → info by review encoding-base64 httplib2/cacerts.txt:2005:1

base64-like blob (688 bytes over 11 lines, compression ratio 0.77) (raw pass, confidence 0.60)
```
-----BEGIN CERTIFICATE-----
MIIB/jCCAYWgAwIBAgIIdJclisc/elQwCgYIKoZIzj0EAwMwRTELMAkGA1UEBhMC
VVMxFDASBgNVBAoMC0FmZmlybVRydXN0MSAwHgYDVQQDDBdBZmZpcm1UcnVzdCBQ
cmVtaXVtIEVDQzAeFw0xMDAxMjkxNDIwMjRaFw00MDEyMzExNDIwMjRaMEUxCzAJ
```
likely benign LLM, confidence 0.97 A PEM-encoded ECC root CA certificate in the bundled CA file.
Reasoning
Standard PEM certificate block (ECC root, AffirmTrust) in a CA bundle. Base64 DER is the normal encoding for certificates.
info ~~warn~~ → info by review encoding-base64 httplib2/cacerts.txt:2077:1

base64-like blob (1844 bytes over 29 lines, compression ratio 0.72) (raw pass, confidence 0.60)
```
-----BEGIN CERTIFICATE-----
MIIFYzCCA0ugAwIBAgIBOzANBgkqhkiG9w0BAQsFADBTMQswCQYDVQQGEwJJTDEW
MBQGA1UEChMNU3RhcnRDb20gTHRkLjEsMCoGA1UEAxMjU3RhcnRDb20gQ2VydGlm
aWNhdGlvbiBBdXRob3JpdHkgRzIwHhcNMTAwMTAxMDEwMDAxWhcNMzkxMjMxMjM1
```
likely benign LLM, confidence 0.97 A PEM-encoded StartCom root CA certificate in the bundled CA file.
Reasoning
Standard PEM certificate block (StartCom root) in a CA bundle; the base64 is ordinary certificate DER data.
info ~~warn~~ → info by review encoding-base64 httplib2/cacerts.txt:2115:1

base64-like blob (1220 bytes over 20 lines, compression ratio 0.75) (raw pass, confidence 0.60)
```
-----BEGIN CERTIFICATE-----
MIIDjjCCAnagAwIBAgIQAzrx5qcRqaC7KGSxHQn65TANBgkqhkiG9w0BAQsFADBh
MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3
d3cuZGlnaWNlcnQuY29tMSAwHgYDVQQDExdEaWdpQ2VydCBHbG9iYWwgUm9vdCBH
```
likely benign LLM, confidence 0.97 A PEM-encoded DigiCert root CA certificate in the bundled CA file.
Reasoning
Standard PEM certificate block (DigiCert Global Root) in a CA bundle. Expected content for certifi-style trust stores.
info ~~warn~~ → info by review encoding-base64 httplib2/cacerts.txt:2143:1

base64-like blob (1856 bytes over 29 lines, compression ratio 0.76) (raw pass, confidence 0.60)
```
-----BEGIN CERTIFICATE-----
MIIFazCCA1OgAwIBAgIRAIIQz7DSQONZRGPgu2OCiwAwDQYJKoZIhvcNAQELBQAw
TzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2Vh
cmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMTUwNjA0MTEwNDM4
```
likely benign LLM, confidence 0.97 A PEM-encoded ISRG Root X1 CA certificate in the bundled CA file.
Reasoning
Standard PEM certificate block (ISRG Root X1) in a CA bundle; no executable context and the content is a certificate structure.
info ~~warn~~ → info by review encoding-base64 httplib2/cacerts.txt:2180:1

base64-like blob (724 bytes over 12 lines, compression ratio 0.77) (raw pass, confidence 0.60)
```
-----BEGIN CERTIFICATE-----
MIICGzCCAaGgAwIBAgIQQdKd0XLq7qeAwSxs6S+HUjAKBggqhkjOPQQDAzBPMQsw
CQYDVQQGEwJVUzEpMCcGA1UEChMgSW50ZXJuZXQgU2VjdXJpdHkgUmVzZWFyY2gg
R3JvdXAxFTATBgNVBAMTDElTUkcgUm9vdCBYMjAeFw0yMDA5MDQwMDAwMDBaFw00
```
likely benign LLM, confidence 0.97 A PEM-encoded ISRG Root X2 CA certificate in the bundled CA file.
Reasoning
Standard PEM certificate block (ISRG Root X2, ECC) in a CA bundle. Base64 DER is the expected encoding.
info ~~warn~~ → info by review decoder-decompress-payload httplib2/decode.py:52:50

file imports decoder module(s) zlib and calls `.decompress()` — embedded payload decompressed at runtime (ast pass, confidence 0.75)
```
    def __init__(self, wbits: int = WBITS_AUTO_GZIP_ZLIB):
        self._decoder: zlib._Decompress | None = zlib.decompressobj(wbits)

    @property
```
likely benign LLM, confidence 0.90 A streaming zlib decompressor wrapper that decodes compressed HTTP response content in httplib2.
Reasoning
The code is the standard httplib2 gzip/deflate content decoder. zlib.decompressobj is used on HTTP response bodies, which is its intended purpose; the 'payload' is ordinary network data, not an embedded blob hidden in the source.

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o httplib2-0.32.1-py3-none-any.whl https://files.pythonhosted.org/packages/9c/47/1d02221cde942fdd7a4ce4a940682e0b054534215ab02ffdee4955e4d66c/httplib2-0.32.1-py3-none-any.whl
printf '%s  %s\n' 82e7a6ab08fcb27879864ddf63dbb529fb032ca336c331cb1597d6dd8b47c92e httplib2-0.32.1-py3-none-any.whl | shasum -a 256 -c -
unzip -q httplib2-0.32.1-py3-none-any.whl -d pkg
disclude scan --untrusted --severity info pkg