@quantakrypto/core 0.4.2 → 0.4.4

package/dist/detectors/c.js

@@ -1,11 +1,50 @@
 import { C_EXTENSIONS, eachMatch, findingFromRule, hasExtension } from "../detect-utils.js";
-import { CWE_BROKEN_CRYPTO } from "../cwe.js";
+import { CWE_BROKEN_CRYPTO, CWE_CERT_VALIDATION, CWE_WEAK_STRENGTH } from "../cwe.js";
 const RE_C_RSA = /\bRSA_generate_key(?:_ex)?\s*\(|\bEVP_RSA_gen\s*\(/g;
 const RE_C_EC = /\bEC_KEY_generate_key\s*\(|\bEC_KEY_new_by_curve_name\s*\(/g;
 const RE_C_ECDSA = /\bECDSA_do_sign\s*\(|\bECDSA_sign\s*\(/g;
 const RE_C_ECDH = /\bECDH_compute_key\s*\(/g;
 const RE_C_DSA = /\bDSA_generate_key\s*\(|\bDSA_generate_parameters(?:_ex)?\s*\(/g;
 const RE_C_DH = /\bDH_generate_key\s*\(|\bDH_generate_parameters(?:_ex)?\s*\(/g;
+// Modern OpenSSL 3.x EVP API (the legacy *_generate_key forms above are
+// deprecated) + libsodium — the biggest C false-negative surface (audit F1).
+const RE_C_EVP_KEYGEN = /\bEVP_PKEY_(?:Q_)?keygen\s*\(|\bEVP_PKEY_paramgen\s*\(/g;
+const RE_C_EVP_DERIVE = /\bEVP_PKEY_derive\s*\(/g;
+const RE_C_EVP_CRYPT = /\bEVP_PKEY_(?:encrypt|decrypt)\s*\(/g;
+const RE_C_EVP_SIGN = /\bEVP_DigestSign(?:Init)?\s*\(|\bEVP_DigestVerify(?:Init)?\s*\(/g;
+// X25519: crypto_box / crypto_kx key pairs (incl. the fully-qualified
+// curve25519xsalsa20poly1305 form) plus the low-level crypto_scalarmult
+// primitive — all classical Curve25519 key agreement (audit recall gap).
+const RE_C_SODIUM_BOX = /\bcrypto_box_(?:curve25519xsalsa20poly1305_)?(?:seed_)?keypair\s*\(|\bcrypto_kx_keypair\s*\(|\bcrypto_scalarmult_(?:curve25519|base)\s*\(/g;
+// EdDSA: crypto_sign key pairs, including the explicit _ed25519 forms and the
+// deterministic seed_keypair variants (audit recall gap: _ed25519_keypair).
+const RE_C_SODIUM_SIGN = /\bcrypto_sign_(?:ed25519_)?(?:seed_)?keypair\s*\(/g;
+// Legacy verify / decrypt counterparts to the *_sign / *_encrypt rules above
+// (audit F4-c): the classic OpenSSL RSA/ECDSA verification and RSA raw
+// decryption call forms that the modern EVP + legacy keygen rules don't cover.
+const RE_C_ECDSA_VERIFY = /\bECDSA_verify\s*\(/g;
+const RE_C_RSA_VERIFY = /\bRSA_verify\s*\(/g;
+const RE_C_RSA_CRYPT = /\bRSA_public_encrypt\s*\(|\bRSA_private_decrypt\s*\(/g;
+// C/OpenSSL legacy TLS configuration (mirrors source.ts tlsDetector): forcing a
+// deprecated protocol version or disabling certificate verification.
+const RE_C_TLS_VERSION = /\bTLSv1_method\b|\bSSLv3_method\b/g;
+const RE_C_TLS_VERIFY_NONE = /\bSSL_VERIFY_NONE\b/g;
+// Embedded C crypto libraries (the "embedded" niche): Mbed TLS and wolfSSL /
+// wolfCrypt. Both use highly-distinctive `mbedtls_*` / `wc_*` prefixes, so the
+// false-positive risk is low. These dominate firmware / IoT / RTOS builds where
+// OpenSSL is too heavy — a codebase surface qScan previously missed entirely.
+const RE_C_MBEDTLS_RSA = /\bmbedtls_rsa_gen_key\s*\(/g;
+const RE_C_MBEDTLS_EC = /\bmbedtls_ecp_gen_key(?:pair)?\s*\(/g;
+const RE_C_MBEDTLS_ECDSA = /\bmbedtls_ecdsa_(?:sign|write_signature|read_signature|verify)\w*\s*\(/g;
+const RE_C_MBEDTLS_ECDH = /\bmbedtls_ecdh_(?:compute_shared|calc_secret)\s*\(/g;
+const RE_C_MBEDTLS_DH = /\bmbedtls_dhm_(?:make_public|make_params|calc_secret)\s*\(/g;
+const RE_C_WOLF_RSA = /\bwc_MakeRsaKey\s*\(|\bwc_RsaPublicEncrypt\s*\(|\bwc_RsaPrivateDecrypt\s*\(/g;
+const RE_C_WOLF_ECC = /\bwc_ecc_make_key(?:_ex)?\s*\(/g;
+const RE_C_WOLF_ECDSA = /\bwc_ecc_sign_hash\s*\(|\bwc_ecc_verify_hash\s*\(/g;
+const RE_C_WOLF_ECDH = /\bwc_ecc_shared_secret\s*\(/g;
+const RE_C_WOLF_DH = /\bwc_DhGenerateKeyPair\s*\(|\bwc_DhAgree\s*\(/g;
+const RE_C_WOLF_CURVE25519 = /\bwc_curve25519_(?:make_key|shared_secret)\s*\(/g;
+const RE_C_WOLF_ED25519 = /\bwc_ed25519_(?:make_key|sign_msg|verify_msg)\s*\(/g;
 const RULE_C_RSA = {
     id: "c-rsa-keygen",
     title: "C/OpenSSL RSA key generation",
@@ -81,13 +120,330 @@ const RULE_C_DH = {
     cwe: CWE_BROKEN_CRYPTO,
     message: "Finite-field Diffie-Hellman (C/OpenSSL) is broken by Shor's algorithm (harvest-now-decrypt-later).",
 };
+const RULE_C_EVP_KEYGEN = {
+    id: "c-evp-keygen",
+    title: "C/OpenSSL EVP key generation",
+    description: "OpenSSL 3.x EVP_PKEY_keygen / EVP_PKEY_Q_keygen / paramgen",
+    category: "key-exchange",
+    severity: "high",
+    confidence: "high",
+    algorithm: "unknown",
+    hndl: true,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "Generates an asymmetric key via the OpenSSL 3.x EVP API (the key type — RSA/EC/DH/X25519 — is set on the CTX). Treated conservatively as key-exchange-capable (harvest-now-decrypt-later).",
+    remediation: "For key agreement: hybrid X25519MLKEM768 (ML-KEM-768). For signatures: ML-DSA-65 (FIPS 204).",
+};
+const RULE_C_EVP_DERIVE = {
+    id: "c-evp-derive",
+    title: "C/OpenSSL EVP key agreement",
+    description: "OpenSSL 3.x EVP_PKEY_derive (ECDH / DH shared secret)",
+    category: "key-exchange",
+    severity: "high",
+    confidence: "high",
+    algorithm: "ECDH",
+    hndl: true,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "Derives an (EC)DH shared secret via the OpenSSL EVP API — broken by Shor's algorithm (harvest-now-decrypt-later).",
+};
+const RULE_C_EVP_CRYPT = {
+    id: "c-evp-pkey-crypt",
+    title: "C/OpenSSL EVP public-key encryption",
+    description: "OpenSSL 3.x EVP_PKEY_encrypt / EVP_PKEY_decrypt (RSA)",
+    category: "kem",
+    severity: "high",
+    confidence: "high",
+    algorithm: "RSA",
+    hndl: true,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "RSA public-key encryption/decryption via the OpenSSL EVP API is harvest-now-decrypt-later exposed.",
+};
+const RULE_C_EVP_SIGN = {
+    id: "c-evp-sign",
+    title: "C/OpenSSL EVP signing",
+    description: "OpenSSL 3.x EVP_DigestSign* / EVP_DigestVerify*",
+    category: "signature",
+    severity: "high",
+    confidence: "high",
+    algorithm: "unknown",
+    hndl: false,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "Classical signature via the OpenSSL EVP API (RSA/ECDSA/EdDSA) is forgeable by a quantum attacker.",
+    remediation: "ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205)",
+};
+const RULE_C_SODIUM_BOX = {
+    id: "c-libsodium-box",
+    title: "libsodium X25519 key pair",
+    description: "libsodium crypto_box / crypto_kx keypair + crypto_scalarmult (X25519 key agreement)",
+    category: "key-exchange",
+    severity: "medium",
+    confidence: "high",
+    algorithm: "X25519",
+    hndl: true,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "libsodium crypto_box uses X25519 key agreement — modern but classical, and harvest-now-decrypt-later exposed.",
+};
+const RULE_C_SODIUM_SIGN = {
+    id: "c-libsodium-sign",
+    title: "libsodium Ed25519 key pair",
+    description: "libsodium crypto_sign(_ed25519)(_seed)_keypair (Ed25519 signatures)",
+    category: "signature",
+    severity: "low",
+    confidence: "high",
+    algorithm: "EdDSA",
+    hndl: false,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "libsodium crypto_sign uses Ed25519 signatures — classical and forgeable by a quantum attacker.",
+};
+const RULE_C_ECDSA_VERIFY = {
+    id: "c-ecdsa-verify",
+    title: "C/OpenSSL ECDSA signature verification",
+    description: "OpenSSL ECDSA_verify",
+    category: "signature",
+    severity: "high",
+    confidence: "high",
+    algorithm: "ECDSA",
+    hndl: false,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "Classical ECDSA verification (C/OpenSSL) trusts signatures forgeable by a quantum attacker.",
+    remediation: "ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205)",
+};
+const RULE_C_RSA_VERIFY = {
+    id: "c-rsa-verify",
+    title: "C/OpenSSL RSA signature verification",
+    description: "OpenSSL RSA_verify",
+    category: "signature",
+    severity: "high",
+    confidence: "high",
+    algorithm: "RSA",
+    hndl: false,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "Classical RSA signature verification (C/OpenSSL) trusts signatures forgeable by a quantum attacker.",
+    remediation: "ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205)",
+};
+const RULE_C_RSA_CRYPT = {
+    id: "c-rsa-crypt",
+    title: "C/OpenSSL RSA public-key encryption",
+    description: "OpenSSL RSA_public_encrypt / RSA_private_decrypt",
+    category: "kem",
+    severity: "high",
+    confidence: "high",
+    algorithm: "RSA",
+    hndl: true,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "Legacy RSA public-key encryption/decryption (C/OpenSSL) is harvest-now-decrypt-later exposed.",
+};
+const RULE_C_TLS_VERSION = {
+    id: "c-tls-legacy-version",
+    title: "Legacy TLS/SSL version pinned (C/OpenSSL)",
+    description: "OpenSSL TLSv1_method / SSLv3_method",
+    category: "tls",
+    severity: "medium",
+    confidence: "high",
+    hndl: false,
+    cwe: CWE_WEAK_STRENGTH,
+    message: "TLS 1.0 / SSLv3 are deprecated and insecure; require TLS 1.3.",
+    remediation: "Use TLS_method() with a minimum of TLS 1.3 and prefer PQC-hybrid key exchange.",
+};
+const RULE_C_TLS_VERIFY_NONE = {
+    id: "c-tls-verify-none",
+    title: "TLS certificate verification disabled (C/OpenSSL)",
+    description: "OpenSSL SSL_VERIFY_NONE",
+    category: "tls",
+    severity: "high",
+    confidence: "high",
+    hndl: false,
+    cwe: CWE_CERT_VALIDATION,
+    message: "SSL_VERIFY_NONE disables TLS certificate verification (MITM risk).",
+    remediation: "Use SSL_VERIFY_PEER and verify certificates properly.",
+};
+// --- Mbed TLS (embedded) ---
+const RULE_C_MBEDTLS_RSA = {
+    id: "c-mbedtls-rsa-keygen",
+    title: "Mbed TLS RSA key generation",
+    description: "Mbed TLS mbedtls_rsa_gen_key",
+    category: "kem",
+    severity: "high",
+    confidence: "high",
+    algorithm: "RSA",
+    hndl: true,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "Generates a classical RSA key pair (Mbed TLS, embedded), which is not quantum-safe.",
+};
+const RULE_C_MBEDTLS_EC = {
+    id: "c-mbedtls-ec-keygen",
+    title: "Mbed TLS EC key generation",
+    description: "Mbed TLS mbedtls_ecp_gen_key / mbedtls_ecp_gen_keypair",
+    category: "key-exchange",
+    severity: "high",
+    confidence: "high",
+    algorithm: "ECDH",
+    hndl: true,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "Generates a classical EC key pair (Mbed TLS, embedded). EC keys feed BOTH ECDSA signatures and ECDH key agreement; the ECDH path is harvest-now-decrypt-later exposed.",
+    remediation: "For key agreement: hybrid X25519MLKEM768 (ML-KEM-768). For signatures: ML-DSA-65 (FIPS 204).",
+};
+const RULE_C_MBEDTLS_ECDSA = {
+    id: "c-mbedtls-ecdsa",
+    title: "Mbed TLS ECDSA signature",
+    description: "Mbed TLS mbedtls_ecdsa_sign / write_signature / read_signature / verify",
+    category: "signature",
+    severity: "high",
+    confidence: "high",
+    algorithm: "ECDSA",
+    hndl: false,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "Classical ECDSA (Mbed TLS, embedded) is forgeable by a quantum attacker.",
+    remediation: "ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205)",
+};
+const RULE_C_MBEDTLS_ECDH = {
+    id: "c-mbedtls-ecdh",
+    title: "Mbed TLS ECDH key agreement",
+    description: "Mbed TLS mbedtls_ecdh_compute_shared / mbedtls_ecdh_calc_secret",
+    category: "key-exchange",
+    severity: "high",
+    confidence: "high",
+    algorithm: "ECDH",
+    hndl: true,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "Elliptic-curve Diffie-Hellman (Mbed TLS, embedded) is broken by Shor's algorithm (harvest-now-decrypt-later).",
+};
+const RULE_C_MBEDTLS_DH = {
+    id: "c-mbedtls-dh",
+    title: "Mbed TLS Diffie-Hellman key exchange",
+    description: "Mbed TLS mbedtls_dhm_make_public / make_params / calc_secret",
+    category: "key-exchange",
+    severity: "high",
+    confidence: "high",
+    algorithm: "DH",
+    hndl: true,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "Finite-field Diffie-Hellman (Mbed TLS, embedded) is broken by Shor's algorithm (harvest-now-decrypt-later).",
+};
+// --- wolfSSL / wolfCrypt (embedded) ---
+const RULE_C_WOLF_RSA = {
+    id: "c-wolfssl-rsa",
+    title: "wolfSSL RSA key/usage",
+    description: "wolfCrypt wc_MakeRsaKey / wc_RsaPublicEncrypt / wc_RsaPrivateDecrypt",
+    category: "kem",
+    severity: "high",
+    confidence: "high",
+    algorithm: "RSA",
+    hndl: true,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "Classical RSA key generation / encryption (wolfSSL, embedded) is harvest-now-decrypt-later exposed.",
+};
+const RULE_C_WOLF_ECC = {
+    id: "c-wolfssl-ecc-keygen",
+    title: "wolfSSL EC key generation",
+    description: "wolfCrypt wc_ecc_make_key / wc_ecc_make_key_ex",
+    category: "key-exchange",
+    severity: "high",
+    confidence: "high",
+    algorithm: "ECDH",
+    hndl: true,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "Generates a classical EC key pair (wolfSSL, embedded). EC keys feed BOTH ECDSA signatures and ECDH key agreement; the ECDH path is harvest-now-decrypt-later exposed.",
+    remediation: "For key agreement: hybrid X25519MLKEM768 (ML-KEM-768). For signatures: ML-DSA-65 (FIPS 204).",
+};
+const RULE_C_WOLF_ECDSA = {
+    id: "c-wolfssl-ecdsa",
+    title: "wolfSSL ECDSA signature",
+    description: "wolfCrypt wc_ecc_sign_hash / wc_ecc_verify_hash",
+    category: "signature",
+    severity: "high",
+    confidence: "high",
+    algorithm: "ECDSA",
+    hndl: false,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "Classical ECDSA (wolfSSL, embedded) is forgeable by a quantum attacker.",
+    remediation: "ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205)",
+};
+const RULE_C_WOLF_ECDH = {
+    id: "c-wolfssl-ecdh",
+    title: "wolfSSL ECDH key agreement",
+    description: "wolfCrypt wc_ecc_shared_secret",
+    category: "key-exchange",
+    severity: "high",
+    confidence: "high",
+    algorithm: "ECDH",
+    hndl: true,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "Elliptic-curve Diffie-Hellman (wolfSSL, embedded) is broken by Shor's algorithm (harvest-now-decrypt-later).",
+};
+const RULE_C_WOLF_DH = {
+    id: "c-wolfssl-dh",
+    title: "wolfSSL Diffie-Hellman key exchange",
+    description: "wolfCrypt wc_DhGenerateKeyPair / wc_DhAgree",
+    category: "key-exchange",
+    severity: "high",
+    confidence: "high",
+    algorithm: "DH",
+    hndl: true,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "Finite-field Diffie-Hellman (wolfSSL, embedded) is broken by Shor's algorithm (harvest-now-decrypt-later).",
+};
+const RULE_C_WOLF_CURVE25519 = {
+    id: "c-wolfssl-curve25519",
+    title: "wolfSSL X25519 key agreement",
+    description: "wolfCrypt wc_curve25519_make_key / wc_curve25519_shared_secret",
+    category: "key-exchange",
+    severity: "medium",
+    confidence: "high",
+    algorithm: "X25519",
+    hndl: true,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "X25519 key agreement (wolfSSL, embedded) is modern but classical, and harvest-now-decrypt-later exposed.",
+};
+const RULE_C_WOLF_ED25519 = {
+    id: "c-wolfssl-ed25519",
+    title: "wolfSSL Ed25519 signature",
+    description: "wolfCrypt wc_ed25519_make_key / wc_ed25519_sign_msg / wc_ed25519_verify_msg",
+    category: "signature",
+    severity: "low",
+    confidence: "high",
+    algorithm: "EdDSA",
+    hndl: false,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "Ed25519 signatures (wolfSSL, embedded) are classical and forgeable by a quantum attacker.",
+    remediation: "ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205)",
+};
 /** Detects classical asymmetric crypto in C/C++ (OpenSSL). */
 export const cDetector = {
     id: "c-crypto",
-    description: "Classical asymmetric crypto in C/C++ (OpenSSL)",
+    description: "Classical asymmetric crypto in C/C++ (OpenSSL, libsodium, Mbed TLS, wolfSSL)",
     scope: "source",
     language: "c",
-    rules: [RULE_C_RSA, RULE_C_EC, RULE_C_ECDSA, RULE_C_ECDH, RULE_C_DSA, RULE_C_DH],
+    rules: [
+        RULE_C_RSA,
+        RULE_C_EC,
+        RULE_C_ECDSA,
+        RULE_C_ECDH,
+        RULE_C_DSA,
+        RULE_C_DH,
+        RULE_C_EVP_KEYGEN,
+        RULE_C_EVP_DERIVE,
+        RULE_C_EVP_CRYPT,
+        RULE_C_EVP_SIGN,
+        RULE_C_SODIUM_BOX,
+        RULE_C_SODIUM_SIGN,
+        RULE_C_ECDSA_VERIFY,
+        RULE_C_RSA_VERIFY,
+        RULE_C_RSA_CRYPT,
+        RULE_C_TLS_VERSION,
+        RULE_C_TLS_VERIFY_NONE,
+        RULE_C_MBEDTLS_RSA,
+        RULE_C_MBEDTLS_EC,
+        RULE_C_MBEDTLS_ECDSA,
+        RULE_C_MBEDTLS_ECDH,
+        RULE_C_MBEDTLS_DH,
+        RULE_C_WOLF_RSA,
+        RULE_C_WOLF_ECC,
+        RULE_C_WOLF_ECDSA,
+        RULE_C_WOLF_ECDH,
+        RULE_C_WOLF_DH,
+        RULE_C_WOLF_CURVE25519,
+        RULE_C_WOLF_ED25519,
+    ],
     appliesTo: (f) => hasExtension(f, C_EXTENSIONS),
     detect({ file, content }) {
         const findings = [];
@@ -98,6 +454,29 @@ export const cDetector = {
         add(RE_C_ECDH, RULE_C_ECDH);
         add(RE_C_DSA, RULE_C_DSA);
         add(RE_C_DH, RULE_C_DH);
+        add(RE_C_EVP_KEYGEN, RULE_C_EVP_KEYGEN);
+        add(RE_C_EVP_DERIVE, RULE_C_EVP_DERIVE);
+        add(RE_C_EVP_CRYPT, RULE_C_EVP_CRYPT);
+        add(RE_C_EVP_SIGN, RULE_C_EVP_SIGN);
+        add(RE_C_SODIUM_BOX, RULE_C_SODIUM_BOX);
+        add(RE_C_SODIUM_SIGN, RULE_C_SODIUM_SIGN);
+        add(RE_C_ECDSA_VERIFY, RULE_C_ECDSA_VERIFY);
+        add(RE_C_RSA_VERIFY, RULE_C_RSA_VERIFY);
+        add(RE_C_RSA_CRYPT, RULE_C_RSA_CRYPT);
+        add(RE_C_TLS_VERSION, RULE_C_TLS_VERSION);
+        add(RE_C_TLS_VERIFY_NONE, RULE_C_TLS_VERIFY_NONE);
+        add(RE_C_MBEDTLS_RSA, RULE_C_MBEDTLS_RSA);
+        add(RE_C_MBEDTLS_EC, RULE_C_MBEDTLS_EC);
+        add(RE_C_MBEDTLS_ECDSA, RULE_C_MBEDTLS_ECDSA);
+        add(RE_C_MBEDTLS_ECDH, RULE_C_MBEDTLS_ECDH);
+        add(RE_C_MBEDTLS_DH, RULE_C_MBEDTLS_DH);
+        add(RE_C_WOLF_RSA, RULE_C_WOLF_RSA);
+        add(RE_C_WOLF_ECC, RULE_C_WOLF_ECC);
+        add(RE_C_WOLF_ECDSA, RULE_C_WOLF_ECDSA);
+        add(RE_C_WOLF_ECDH, RULE_C_WOLF_ECDH);
+        add(RE_C_WOLF_DH, RULE_C_WOLF_DH);
+        add(RE_C_WOLF_CURVE25519, RULE_C_WOLF_CURVE25519);
+        add(RE_C_WOLF_ED25519, RULE_C_WOLF_ED25519);
         return findings;
     },
 };

package/dist/detectors/c.js.map

@@ -1 +1 @@
-{"version":3,"file":"c.js","sourceRoot":"","sources":["../../src/detectors/c.ts"],"names":[],"mappings":"AAiBA,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAC5F,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAE9C,MAAM,QAAQ,GAAG,qDAAqD,CAAC;AACvE,MAAM,OAAO,GAAG,6DAA6D,CAAC;AAC9E,MAAM,UAAU,GAAG,yCAAyC,CAAC;AAC7D,MAAM,SAAS,GAAG,0BAA0B,CAAC;AAC7C,MAAM,QAAQ,GAAG,iEAAiE,CAAC;AACnF,MAAM,OAAO,GAAG,+DAA+D,CAAC;AAEhF,MAAM,UAAU,GAAa;IAC3B,EAAE,EAAE,cAAc;IAClB,KAAK,EAAE,8BAA8B;IACrC,WAAW,EAAE,6CAA6C;IAC1D,QAAQ,EAAE,KAAK;IACf,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,KAAK;IAChB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,4EAA4E;CACtF,CAAC;AACF,MAAM,SAAS,GAAa;IAC1B,EAAE,EAAE,aAAa;IACjB,KAAK,EAAE,6BAA6B;IACpC,WAAW,EAAE,wDAAwD;IACrE,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,MAAM;IACjB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,+JAA+J;IACjK,WAAW,EACT,8FAA8F;CACjG,CAAC;AACF,MAAM,YAAY,GAAa;IAC7B,EAAE,EAAE,SAAS;IACb,KAAK,EAAE,2BAA2B;IAClC,WAAW,EAAE,oCAAoC;IACjD,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,OAAO;IAClB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,yEAAyE;IAClF,WAAW,EAAE,4CAA4C;CAC1D,CAAC;AACF,MAAM,WAAW,GAAa;IAC5B,EAAE,EAAE,QAAQ;IACZ,KAAK,EAAE,8BAA8B;IACrC,WAAW,EAAE,0BAA0B;IACvC,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,MAAM;IACjB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,sGAAsG;CACzG,CAAC;AACF,MAAM,UAAU,GAAa;IAC3B,EAAE,EAAE,OAAO;IACX,KAAK,EAAE,yBAAyB;IAChC,WAAW,EAAE,oDAAoD;IACjE,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,KAAK;IAChB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,8EAA8E;IACvF,WAAW,EAAE,qDAAqD;CACnE,CAAC;AACF,MAAM,SAAS,GAAa;IAC1B,EAAE,EAAE,MAAM;IACV,KAAK,EAAE,uCAAuC;IAC9C,WAAW,EAAE,kDAAkD;IAC/D,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,IAAI;IACf,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,oGAAoG;CACvG,CAAC;AAEF,8DAA8D;AAC9D,MAAM,CAAC,MAAM,SAAS,GAAa;IACjC,EAAE,EAAE,UAAU;IACd,WAAW,EAAE,gDAAgD;IAC7D,KAAK,EAAE,QAAQ;IACf,QAAQ,EAAE,GAAG;IACb,KAAK,EAAE,CAAC,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,SAAS,CAAC;IAChF,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,YAAY,CAAC;IAC/C,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE;QACtB,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,CAAC,EAAU,EAAE,IAAc,EAAE,EAAE,CACzC,SAAS,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAC3B,QAAQ,CAAC,IAAI,CACX,eAAe,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CACnF,CACF,CAAC;QACJ,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC1B,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QACxB,GAAG,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;QAC9B,GAAG,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QAC5B,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC1B,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QACxB,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC"}
+{"version":3,"file":"c.js","sourceRoot":"","sources":["../../src/detectors/c.ts"],"names":[],"mappings":"AAmBA,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAC5F,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAEtF,MAAM,QAAQ,GAAG,qDAAqD,CAAC;AACvE,MAAM,OAAO,GAAG,6DAA6D,CAAC;AAC9E,MAAM,UAAU,GAAG,yCAAyC,CAAC;AAC7D,MAAM,SAAS,GAAG,0BAA0B,CAAC;AAC7C,MAAM,QAAQ,GAAG,iEAAiE,CAAC;AACnF,MAAM,OAAO,GAAG,+DAA+D,CAAC;AAChF,wEAAwE;AACxE,6EAA6E;AAC7E,MAAM,eAAe,GAAG,yDAAyD,CAAC;AAClF,MAAM,eAAe,GAAG,yBAAyB,CAAC;AAClD,MAAM,cAAc,GAAG,sCAAsC,CAAC;AAC9D,MAAM,aAAa,GAAG,kEAAkE,CAAC;AACzF,sEAAsE;AACtE,wEAAwE;AACxE,yEAAyE;AACzE,MAAM,eAAe,GACnB,4IAA4I,CAAC;AAC/I,8EAA8E;AAC9E,4EAA4E;AAC5E,MAAM,gBAAgB,GAAG,oDAAoD,CAAC;AAC9E,6EAA6E;AAC7E,uEAAuE;AACvE,+EAA+E;AAC/E,MAAM,iBAAiB,GAAG,sBAAsB,CAAC;AACjD,MAAM,eAAe,GAAG,oBAAoB,CAAC;AAC7C,MAAM,cAAc,GAAG,uDAAuD,CAAC;AAC/E,gFAAgF;AAChF,qEAAqE;AACrE,MAAM,gBAAgB,GAAG,oCAAoC,CAAC;AAC9D,MAAM,oBAAoB,GAAG,sBAAsB,CAAC;AACpD,6EAA6E;AAC7E,+EAA+E;AAC/E,gFAAgF;AAChF,8EAA8E;AAC9E,MAAM,gBAAgB,GAAG,6BAA6B,CAAC;AACvD,MAAM,eAAe,GAAG,sCAAsC,CAAC;AAC/D,MAAM,kBAAkB,GACtB,yEAAyE,CAAC;AAC5E,MAAM,iBAAiB,GAAG,qDAAqD,CAAC;AAChF,MAAM,eAAe,GAAG,6DAA6D,CAAC;AACtF,MAAM,aAAa,GACjB,8EAA8E,CAAC;AACjF,MAAM,aAAa,GAAG,iCAAiC,CAAC;AACxD,MAAM,eAAe,GAAG,oDAAoD,CAAC;AAC7E,MAAM,cAAc,GAAG,8BAA8B,CAAC;AACtD,MAAM,YAAY,GAAG,gDAAgD,CAAC;AACtE,MAAM,oBAAoB,GAAG,kDAAkD,CAAC;AAChF,MAAM,iBAAiB,GAAG,qDAAqD,CAAC;AAEhF,MAAM,UAAU,GAAa;IAC3B,EAAE,EAAE,cAAc;IAClB,KAAK,EAAE,8BAA8B;IACrC,WAAW,EAAE,6CAA6C;IAC1D,QAAQ,EAAE,KAAK;IACf,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,KAAK;IAChB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,4EAA4E;CACtF,CAAC;AACF,MAAM,SAAS,GAAa;IAC1B,EAAE,EAAE,aAAa;IACjB,KAAK,EAAE,6BAA6B;IACpC,WAAW,EAAE,wDAAwD;IACrE,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,MAAM;IACjB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,+JAA+J;IACjK,WAAW,EACT,8FAA8F;CACjG,CAAC;AACF,MAAM,YAAY,GAAa;IAC7B,EAAE,EAAE,SAAS;IACb,KAAK,EAAE,2BAA2B;IAClC,WAAW,EAAE,oCAAoC;IACjD,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,OAAO;IAClB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,yEAAyE;IAClF,WAAW,EAAE,4CAA4C;CAC1D,CAAC;AACF,MAAM,WAAW,GAAa;IAC5B,EAAE,EAAE,QAAQ;IACZ,KAAK,EAAE,8BAA8B;IACrC,WAAW,EAAE,0BAA0B;IACvC,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,MAAM;IACjB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,sGAAsG;CACzG,CAAC;AACF,MAAM,UAAU,GAAa;IAC3B,EAAE,EAAE,OAAO;IACX,KAAK,EAAE,yBAAyB;IAChC,WAAW,EAAE,oDAAoD;IACjE,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,KAAK;IAChB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,8EAA8E;IACvF,WAAW,EAAE,qDAAqD;CACnE,CAAC;AACF,MAAM,SAAS,GAAa;IAC1B,EAAE,EAAE,MAAM;IACV,KAAK,EAAE,uCAAuC;IAC9C,WAAW,EAAE,kDAAkD;IAC/D,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,IAAI;IACf,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,oGAAoG;CACvG,CAAC;AACF,MAAM,iBAAiB,GAAa;IAClC,EAAE,EAAE,cAAc;IAClB,KAAK,EAAE,8BAA8B;IACrC,WAAW,EAAE,4DAA4D;IACzE,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,SAAS;IACpB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,4LAA4L;IAC9L,WAAW,EACT,8FAA8F;CACjG,CAAC;AACF,MAAM,iBAAiB,GAAa;IAClC,EAAE,EAAE,cAAc;IAClB,KAAK,EAAE,6BAA6B;IACpC,WAAW,EAAE,uDAAuD;IACpE,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,MAAM;IACjB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,mHAAmH;CACtH,CAAC;AACF,MAAM,gBAAgB,GAAa;IACjC,EAAE,EAAE,kBAAkB;IACtB,KAAK,EAAE,qCAAqC;IAC5C,WAAW,EAAE,uDAAuD;IACpE,QAAQ,EAAE,KAAK;IACf,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,KAAK;IAChB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,oGAAoG;CACvG,CAAC;AACF,MAAM,eAAe,GAAa;IAChC,EAAE,EAAE,YAAY;IAChB,KAAK,EAAE,uBAAuB;IAC9B,WAAW,EAAE,iDAAiD;IAC9D,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,SAAS;IACpB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,mGAAmG;IACrG,WAAW,EAAE,4CAA4C;CAC1D,CAAC;AACF,MAAM,iBAAiB,GAAa;IAClC,EAAE,EAAE,iBAAiB;IACrB,KAAK,EAAE,2BAA2B;IAClC,WAAW,EACT,qFAAqF;IACvF,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,QAAQ;IAClB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,QAAQ;IACnB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,+GAA+G;CAClH,CAAC;AACF,MAAM,kBAAkB,GAAa;IACnC,EAAE,EAAE,kBAAkB;IACtB,KAAK,EAAE,4BAA4B;IACnC,WAAW,EAAE,qEAAqE;IAClF,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,KAAK;IACf,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,OAAO;IAClB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,gGAAgG;CACnG,CAAC;AACF,MAAM,mBAAmB,GAAa;IACpC,EAAE,EAAE,gBAAgB;IACpB,KAAK,EAAE,wCAAwC;IAC/C,WAAW,EAAE,sBAAsB;IACnC,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,OAAO;IAClB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,6FAA6F;IAC/F,WAAW,EAAE,4CAA4C;CAC1D,CAAC;AACF,MAAM,iBAAiB,GAAa;IAClC,EAAE,EAAE,cAAc;IAClB,KAAK,EAAE,sCAAsC;IAC7C,WAAW,EAAE,oBAAoB;IACjC,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,KAAK;IAChB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,qGAAqG;IACvG,WAAW,EAAE,4CAA4C;CAC1D,CAAC;AACF,MAAM,gBAAgB,GAAa;IACjC,EAAE,EAAE,aAAa;IACjB,KAAK,EAAE,qCAAqC;IAC5C,WAAW,EAAE,kDAAkD;IAC/D,QAAQ,EAAE,KAAK;IACf,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,KAAK;IAChB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,+FAA+F;CAClG,CAAC;AACF,MAAM,kBAAkB,GAAa;IACnC,EAAE,EAAE,sBAAsB;IAC1B,KAAK,EAAE,2CAA2C;IAClD,WAAW,EAAE,qCAAqC;IAClD,QAAQ,EAAE,KAAK;IACf,QAAQ,EAAE,QAAQ;IAClB,UAAU,EAAE,MAAM;IAClB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,+DAA+D;IACxE,WAAW,EAAE,gFAAgF;CAC9F,CAAC;AACF,MAAM,sBAAsB,GAAa;IACvC,EAAE,EAAE,mBAAmB;IACvB,KAAK,EAAE,mDAAmD;IAC1D,WAAW,EAAE,yBAAyB;IACtC,QAAQ,EAAE,KAAK;IACf,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,mBAAmB;IACxB,OAAO,EAAE,oEAAoE;IAC7E,WAAW,EAAE,uDAAuD;CACrE,CAAC;AACF,8BAA8B;AAC9B,MAAM,kBAAkB,GAAa;IACnC,EAAE,EAAE,sBAAsB;IAC1B,KAAK,EAAE,6BAA6B;IACpC,WAAW,EAAE,8BAA8B;IAC3C,QAAQ,EAAE,KAAK;IACf,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,KAAK;IAChB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,qFAAqF;CAC/F,CAAC;AACF,MAAM,iBAAiB,GAAa;IAClC,EAAE,EAAE,qBAAqB;IACzB,KAAK,EAAE,4BAA4B;IACnC,WAAW,EAAE,wDAAwD;IACrE,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,MAAM;IACjB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,wKAAwK;IAC1K,WAAW,EACT,8FAA8F;CACjG,CAAC;AACF,MAAM,oBAAoB,GAAa;IACrC,EAAE,EAAE,iBAAiB;IACrB,KAAK,EAAE,0BAA0B;IACjC,WAAW,EAAE,yEAAyE;IACtF,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,OAAO;IAClB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,0EAA0E;IACnF,WAAW,EAAE,4CAA4C;CAC1D,CAAC;AACF,MAAM,mBAAmB,GAAa;IACpC,EAAE,EAAE,gBAAgB;IACpB,KAAK,EAAE,6BAA6B;IACpC,WAAW,EAAE,iEAAiE;IAC9E,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,MAAM;IACjB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,+GAA+G;CAClH,CAAC;AACF,MAAM,iBAAiB,GAAa;IAClC,EAAE,EAAE,cAAc;IAClB,KAAK,EAAE,sCAAsC;IAC7C,WAAW,EAAE,8DAA8D;IAC3E,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,IAAI;IACf,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,6GAA6G;CAChH,CAAC;AACF,yCAAyC;AACzC,MAAM,eAAe,GAAa;IAChC,EAAE,EAAE,eAAe;IACnB,KAAK,EAAE,uBAAuB;IAC9B,WAAW,EAAE,sEAAsE;IACnF,QAAQ,EAAE,KAAK;IACf,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,KAAK;IAChB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,qGAAqG;CACxG,CAAC;AACF,MAAM,eAAe,GAAa;IAChC,EAAE,EAAE,sBAAsB;IAC1B,KAAK,EAAE,2BAA2B;IAClC,WAAW,EAAE,gDAAgD;IAC7D,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,MAAM;IACjB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,uKAAuK;IACzK,WAAW,EACT,8FAA8F;CACjG,CAAC;AACF,MAAM,iBAAiB,GAAa;IAClC,EAAE,EAAE,iBAAiB;IACrB,KAAK,EAAE,yBAAyB;IAChC,WAAW,EAAE,iDAAiD;IAC9D,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,OAAO;IAClB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,yEAAyE;IAClF,WAAW,EAAE,4CAA4C;CAC1D,CAAC;AACF,MAAM,gBAAgB,GAAa;IACjC,EAAE,EAAE,gBAAgB;IACpB,KAAK,EAAE,4BAA4B;IACnC,WAAW,EAAE,gCAAgC;IAC7C,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,MAAM;IACjB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,8GAA8G;CACjH,CAAC;AACF,MAAM,cAAc,GAAa;IAC/B,EAAE,EAAE,cAAc;IAClB,KAAK,EAAE,qCAAqC;IAC5C,WAAW,EAAE,6CAA6C;IAC1D,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,IAAI;IACf,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,4GAA4G;CAC/G,CAAC;AACF,MAAM,sBAAsB,GAAa;IACvC,EAAE,EAAE,sBAAsB;IAC1B,KAAK,EAAE,8BAA8B;IACrC,WAAW,EAAE,gEAAgE;IAC7E,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,QAAQ;IAClB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,QAAQ;IACnB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,0GAA0G;CAC7G,CAAC;AACF,MAAM,mBAAmB,GAAa;IACpC,EAAE,EAAE,mBAAmB;IACvB,KAAK,EAAE,2BAA2B;IAClC,WAAW,EAAE,6EAA6E;IAC1F,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,KAAK;IACf,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,OAAO;IAClB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,2FAA2F;IAC7F,WAAW,EAAE,4CAA4C;CAC1D,CAAC;AAEF,8DAA8D;AAC9D,MAAM,CAAC,MAAM,SAAS,GAAa;IACjC,EAAE,EAAE,UAAU;IACd,WAAW,EAAE,8EAA8E;IAC3F,KAAK,EAAE,QAAQ;IACf,QAAQ,EAAE,GAAG;IACb,KAAK,EAAE;QACL,UAAU;QACV,SAAS;QACT,YAAY;QACZ,WAAW;QACX,UAAU;QACV,SAAS;QACT,iBAAiB;QACjB,iBAAiB;QACjB,gBAAgB;QAChB,eAAe;QACf,iBAAiB;QACjB,kBAAkB;QAClB,mBAAmB;QACnB,iBAAiB;QACjB,gBAAgB;QAChB,kBAAkB;QAClB,sBAAsB;QACtB,kBAAkB;QAClB,iBAAiB;QACjB,oBAAoB;QACpB,mBAAmB;QACnB,iBAAiB;QACjB,eAAe;QACf,eAAe;QACf,iBAAiB;QACjB,gBAAgB;QAChB,cAAc;QACd,sBAAsB;QACtB,mBAAmB;KACpB;IACD,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,YAAY,CAAC;IAC/C,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE;QACtB,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,CAAC,EAAU,EAAE,IAAc,EAAE,EAAE,CACzC,SAAS,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAC3B,QAAQ,CAAC,IAAI,CACX,eAAe,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CACnF,CACF,CAAC;QACJ,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC1B,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QACxB,GAAG,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;QAC9B,GAAG,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QAC5B,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC1B,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QACxB,GAAG,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAC;QACxC,GAAG,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAC;QACxC,GAAG,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC;QACtC,GAAG,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;QACpC,GAAG,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAC;QACxC,GAAG,CAAC,gBAAgB,EAAE,kBAAkB,CAAC,CAAC;QAC1C,GAAG,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,CAAC;QAC5C,GAAG,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAC;QACxC,GAAG,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC;QACtC,GAAG,CAAC,gBAAgB,EAAE,kBAAkB,CAAC,CAAC;QAC1C,GAAG,CAAC,oBAAoB,EAAE,sBAAsB,CAAC,CAAC;QAClD,GAAG,CAAC,gBAAgB,EAAE,kBAAkB,CAAC,CAAC;QAC1C,GAAG,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAC;QACxC,GAAG,CAAC,kBAAkB,EAAE,oBAAoB,CAAC,CAAC;QAC9C,GAAG,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,CAAC;QAC5C,GAAG,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAC;QACxC,GAAG,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;QACpC,GAAG,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;QACpC,GAAG,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAC;QACxC,GAAG,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC;QACtC,GAAG,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;QAClC,GAAG,CAAC,oBAAoB,EAAE,sBAAsB,CAAC,CAAC;QAClD,GAAG,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,CAAC;QAC5C,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC","sourcesContent":["/**\n * Source-code detector for classical asymmetric cryptography in C / C++ using\n * OpenSSL (the dominant crypto library for the ecosystem), libsodium, and — for\n * the embedded / firmware / IoT niche — Mbed TLS (`mbedtls_*`) and wolfSSL /\n * wolfCrypt (`wc_*`). Lexical, same strategy as the other packs; every library's\n * function names are distinctive enough to keep the false-positive risk low.\n *\n * NOTE: scanning OpenSSL's OWN source/headers will naturally light up (the\n * library declares these symbols) — that is inherent to lexical scanning of a\n * crypto library, not a false positive in application code. Matches the classic\n * `*_generate_key` / `ECDSA_sign` / `ECDH_compute_key` call forms plus the\n * `EVP_RSA_gen` helper.\n *\n * HNDL: RSA encryption and (EC)DH key agreement are harvest-now-decrypt-later\n * exposed (hndl:true); ECDSA / DSA signatures are hndl:false but forgeable.\n * `EC_KEY_generate_key` is ambiguous (feeds ECDSA + ECDH), classified\n * conservatively as key-exchange-capable (hndl:true).\n */\nimport type { Detector, Finding, RuleMeta } from \"../types.js\";\nimport { C_EXTENSIONS, eachMatch, findingFromRule, hasExtension } from \"../detect-utils.js\";\nimport { CWE_BROKEN_CRYPTO, CWE_CERT_VALIDATION, CWE_WEAK_STRENGTH } from \"../cwe.js\";\n\nconst RE_C_RSA = /\\bRSA_generate_key(?:_ex)?\\s*\\(|\\bEVP_RSA_gen\\s*\\(/g;\nconst RE_C_EC = /\\bEC_KEY_generate_key\\s*\\(|\\bEC_KEY_new_by_curve_name\\s*\\(/g;\nconst RE_C_ECDSA = /\\bECDSA_do_sign\\s*\\(|\\bECDSA_sign\\s*\\(/g;\nconst RE_C_ECDH = /\\bECDH_compute_key\\s*\\(/g;\nconst RE_C_DSA = /\\bDSA_generate_key\\s*\\(|\\bDSA_generate_parameters(?:_ex)?\\s*\\(/g;\nconst RE_C_DH = /\\bDH_generate_key\\s*\\(|\\bDH_generate_parameters(?:_ex)?\\s*\\(/g;\n// Modern OpenSSL 3.x EVP API (the legacy *_generate_key forms above are\n// deprecated) + libsodium — the biggest C false-negative surface (audit F1).\nconst RE_C_EVP_KEYGEN = /\\bEVP_PKEY_(?:Q_)?keygen\\s*\\(|\\bEVP_PKEY_paramgen\\s*\\(/g;\nconst RE_C_EVP_DERIVE = /\\bEVP_PKEY_derive\\s*\\(/g;\nconst RE_C_EVP_CRYPT = /\\bEVP_PKEY_(?:encrypt|decrypt)\\s*\\(/g;\nconst RE_C_EVP_SIGN = /\\bEVP_DigestSign(?:Init)?\\s*\\(|\\bEVP_DigestVerify(?:Init)?\\s*\\(/g;\n// X25519: crypto_box / crypto_kx key pairs (incl. the fully-qualified\n// curve25519xsalsa20poly1305 form) plus the low-level crypto_scalarmult\n// primitive — all classical Curve25519 key agreement (audit recall gap).\nconst RE_C_SODIUM_BOX =\n  /\\bcrypto_box_(?:curve25519xsalsa20poly1305_)?(?:seed_)?keypair\\s*\\(|\\bcrypto_kx_keypair\\s*\\(|\\bcrypto_scalarmult_(?:curve25519|base)\\s*\\(/g;\n// EdDSA: crypto_sign key pairs, including the explicit _ed25519 forms and the\n// deterministic seed_keypair variants (audit recall gap: _ed25519_keypair).\nconst RE_C_SODIUM_SIGN = /\\bcrypto_sign_(?:ed25519_)?(?:seed_)?keypair\\s*\\(/g;\n// Legacy verify / decrypt counterparts to the *_sign / *_encrypt rules above\n// (audit F4-c): the classic OpenSSL RSA/ECDSA verification and RSA raw\n// decryption call forms that the modern EVP + legacy keygen rules don't cover.\nconst RE_C_ECDSA_VERIFY = /\\bECDSA_verify\\s*\\(/g;\nconst RE_C_RSA_VERIFY = /\\bRSA_verify\\s*\\(/g;\nconst RE_C_RSA_CRYPT = /\\bRSA_public_encrypt\\s*\\(|\\bRSA_private_decrypt\\s*\\(/g;\n// C/OpenSSL legacy TLS configuration (mirrors source.ts tlsDetector): forcing a\n// deprecated protocol version or disabling certificate verification.\nconst RE_C_TLS_VERSION = /\\bTLSv1_method\\b|\\bSSLv3_method\\b/g;\nconst RE_C_TLS_VERIFY_NONE = /\\bSSL_VERIFY_NONE\\b/g;\n// Embedded C crypto libraries (the \"embedded\" niche): Mbed TLS and wolfSSL /\n// wolfCrypt. Both use highly-distinctive `mbedtls_*` / `wc_*` prefixes, so the\n// false-positive risk is low. These dominate firmware / IoT / RTOS builds where\n// OpenSSL is too heavy — a codebase surface qScan previously missed entirely.\nconst RE_C_MBEDTLS_RSA = /\\bmbedtls_rsa_gen_key\\s*\\(/g;\nconst RE_C_MBEDTLS_EC = /\\bmbedtls_ecp_gen_key(?:pair)?\\s*\\(/g;\nconst RE_C_MBEDTLS_ECDSA =\n  /\\bmbedtls_ecdsa_(?:sign|write_signature|read_signature|verify)\\w*\\s*\\(/g;\nconst RE_C_MBEDTLS_ECDH = /\\bmbedtls_ecdh_(?:compute_shared|calc_secret)\\s*\\(/g;\nconst RE_C_MBEDTLS_DH = /\\bmbedtls_dhm_(?:make_public|make_params|calc_secret)\\s*\\(/g;\nconst RE_C_WOLF_RSA =\n  /\\bwc_MakeRsaKey\\s*\\(|\\bwc_RsaPublicEncrypt\\s*\\(|\\bwc_RsaPrivateDecrypt\\s*\\(/g;\nconst RE_C_WOLF_ECC = /\\bwc_ecc_make_key(?:_ex)?\\s*\\(/g;\nconst RE_C_WOLF_ECDSA = /\\bwc_ecc_sign_hash\\s*\\(|\\bwc_ecc_verify_hash\\s*\\(/g;\nconst RE_C_WOLF_ECDH = /\\bwc_ecc_shared_secret\\s*\\(/g;\nconst RE_C_WOLF_DH = /\\bwc_DhGenerateKeyPair\\s*\\(|\\bwc_DhAgree\\s*\\(/g;\nconst RE_C_WOLF_CURVE25519 = /\\bwc_curve25519_(?:make_key|shared_secret)\\s*\\(/g;\nconst RE_C_WOLF_ED25519 = /\\bwc_ed25519_(?:make_key|sign_msg|verify_msg)\\s*\\(/g;\n\nconst RULE_C_RSA: RuleMeta = {\n  id: \"c-rsa-keygen\",\n  title: \"C/OpenSSL RSA key generation\",\n  description: \"OpenSSL RSA_generate_key(_ex) / EVP_RSA_gen\",\n  category: \"kem\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"RSA\",\n  hndl: true,\n  cwe: CWE_BROKEN_CRYPTO,\n  message: \"Generates a classical RSA key pair (C/OpenSSL), which is not quantum-safe.\",\n};\nconst RULE_C_EC: RuleMeta = {\n  id: \"c-ec-keygen\",\n  title: \"C/OpenSSL EC key generation\",\n  description: \"OpenSSL EC_KEY_generate_key / EC_KEY_new_by_curve_name\",\n  category: \"key-exchange\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"ECDH\",\n  hndl: true,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"Generates a classical EC key pair (C/OpenSSL). EC keys feed BOTH ECDSA signatures and ECDH key agreement; the ECDH path is harvest-now-decrypt-later exposed.\",\n  remediation:\n    \"For key agreement: hybrid X25519MLKEM768 (ML-KEM-768). For signatures: ML-DSA-65 (FIPS 204).\",\n};\nconst RULE_C_ECDSA: RuleMeta = {\n  id: \"c-ecdsa\",\n  title: \"C/OpenSSL ECDSA signature\",\n  description: \"OpenSSL ECDSA_sign / ECDSA_do_sign\",\n  category: \"signature\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"ECDSA\",\n  hndl: false,\n  cwe: CWE_BROKEN_CRYPTO,\n  message: \"Classical ECDSA signing (C/OpenSSL) is forgeable by a quantum attacker.\",\n  remediation: \"ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205)\",\n};\nconst RULE_C_ECDH: RuleMeta = {\n  id: \"c-ecdh\",\n  title: \"C/OpenSSL ECDH key agreement\",\n  description: \"OpenSSL ECDH_compute_key\",\n  category: \"key-exchange\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"ECDH\",\n  hndl: true,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"Elliptic-curve Diffie-Hellman (C/OpenSSL) is broken by Shor's algorithm (harvest-now-decrypt-later).\",\n};\nconst RULE_C_DSA: RuleMeta = {\n  id: \"c-dsa\",\n  title: \"C/OpenSSL DSA key/usage\",\n  description: \"OpenSSL DSA_generate_key / DSA_generate_parameters\",\n  category: \"signature\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"DSA\",\n  hndl: false,\n  cwe: CWE_BROKEN_CRYPTO,\n  message: \"Classical DSA (C/OpenSSL) is deprecated and forgeable by a quantum attacker.\",\n  remediation: \"Rotate off DSA and migrate to ML-DSA-65 (FIPS 204).\",\n};\nconst RULE_C_DH: RuleMeta = {\n  id: \"c-dh\",\n  title: \"C/OpenSSL Diffie-Hellman key exchange\",\n  description: \"OpenSSL DH_generate_key / DH_generate_parameters\",\n  category: \"key-exchange\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"DH\",\n  hndl: true,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"Finite-field Diffie-Hellman (C/OpenSSL) is broken by Shor's algorithm (harvest-now-decrypt-later).\",\n};\nconst RULE_C_EVP_KEYGEN: RuleMeta = {\n  id: \"c-evp-keygen\",\n  title: \"C/OpenSSL EVP key generation\",\n  description: \"OpenSSL 3.x EVP_PKEY_keygen / EVP_PKEY_Q_keygen / paramgen\",\n  category: \"key-exchange\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"unknown\",\n  hndl: true,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"Generates an asymmetric key via the OpenSSL 3.x EVP API (the key type — RSA/EC/DH/X25519 — is set on the CTX). Treated conservatively as key-exchange-capable (harvest-now-decrypt-later).\",\n  remediation:\n    \"For key agreement: hybrid X25519MLKEM768 (ML-KEM-768). For signatures: ML-DSA-65 (FIPS 204).\",\n};\nconst RULE_C_EVP_DERIVE: RuleMeta = {\n  id: \"c-evp-derive\",\n  title: \"C/OpenSSL EVP key agreement\",\n  description: \"OpenSSL 3.x EVP_PKEY_derive (ECDH / DH shared secret)\",\n  category: \"key-exchange\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"ECDH\",\n  hndl: true,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"Derives an (EC)DH shared secret via the OpenSSL EVP API — broken by Shor's algorithm (harvest-now-decrypt-later).\",\n};\nconst RULE_C_EVP_CRYPT: RuleMeta = {\n  id: \"c-evp-pkey-crypt\",\n  title: \"C/OpenSSL EVP public-key encryption\",\n  description: \"OpenSSL 3.x EVP_PKEY_encrypt / EVP_PKEY_decrypt (RSA)\",\n  category: \"kem\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"RSA\",\n  hndl: true,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"RSA public-key encryption/decryption via the OpenSSL EVP API is harvest-now-decrypt-later exposed.\",\n};\nconst RULE_C_EVP_SIGN: RuleMeta = {\n  id: \"c-evp-sign\",\n  title: \"C/OpenSSL EVP signing\",\n  description: \"OpenSSL 3.x EVP_DigestSign* / EVP_DigestVerify*\",\n  category: \"signature\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"unknown\",\n  hndl: false,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"Classical signature via the OpenSSL EVP API (RSA/ECDSA/EdDSA) is forgeable by a quantum attacker.\",\n  remediation: \"ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205)\",\n};\nconst RULE_C_SODIUM_BOX: RuleMeta = {\n  id: \"c-libsodium-box\",\n  title: \"libsodium X25519 key pair\",\n  description:\n    \"libsodium crypto_box / crypto_kx keypair + crypto_scalarmult (X25519 key agreement)\",\n  category: \"key-exchange\",\n  severity: \"medium\",\n  confidence: \"high\",\n  algorithm: \"X25519\",\n  hndl: true,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"libsodium crypto_box uses X25519 key agreement — modern but classical, and harvest-now-decrypt-later exposed.\",\n};\nconst RULE_C_SODIUM_SIGN: RuleMeta = {\n  id: \"c-libsodium-sign\",\n  title: \"libsodium Ed25519 key pair\",\n  description: \"libsodium crypto_sign(_ed25519)(_seed)_keypair (Ed25519 signatures)\",\n  category: \"signature\",\n  severity: \"low\",\n  confidence: \"high\",\n  algorithm: \"EdDSA\",\n  hndl: false,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"libsodium crypto_sign uses Ed25519 signatures — classical and forgeable by a quantum attacker.\",\n};\nconst RULE_C_ECDSA_VERIFY: RuleMeta = {\n  id: \"c-ecdsa-verify\",\n  title: \"C/OpenSSL ECDSA signature verification\",\n  description: \"OpenSSL ECDSA_verify\",\n  category: \"signature\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"ECDSA\",\n  hndl: false,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"Classical ECDSA verification (C/OpenSSL) trusts signatures forgeable by a quantum attacker.\",\n  remediation: \"ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205)\",\n};\nconst RULE_C_RSA_VERIFY: RuleMeta = {\n  id: \"c-rsa-verify\",\n  title: \"C/OpenSSL RSA signature verification\",\n  description: \"OpenSSL RSA_verify\",\n  category: \"signature\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"RSA\",\n  hndl: false,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"Classical RSA signature verification (C/OpenSSL) trusts signatures forgeable by a quantum attacker.\",\n  remediation: \"ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205)\",\n};\nconst RULE_C_RSA_CRYPT: RuleMeta = {\n  id: \"c-rsa-crypt\",\n  title: \"C/OpenSSL RSA public-key encryption\",\n  description: \"OpenSSL RSA_public_encrypt / RSA_private_decrypt\",\n  category: \"kem\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"RSA\",\n  hndl: true,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"Legacy RSA public-key encryption/decryption (C/OpenSSL) is harvest-now-decrypt-later exposed.\",\n};\nconst RULE_C_TLS_VERSION: RuleMeta = {\n  id: \"c-tls-legacy-version\",\n  title: \"Legacy TLS/SSL version pinned (C/OpenSSL)\",\n  description: \"OpenSSL TLSv1_method / SSLv3_method\",\n  category: \"tls\",\n  severity: \"medium\",\n  confidence: \"high\",\n  hndl: false,\n  cwe: CWE_WEAK_STRENGTH,\n  message: \"TLS 1.0 / SSLv3 are deprecated and insecure; require TLS 1.3.\",\n  remediation: \"Use TLS_method() with a minimum of TLS 1.3 and prefer PQC-hybrid key exchange.\",\n};\nconst RULE_C_TLS_VERIFY_NONE: RuleMeta = {\n  id: \"c-tls-verify-none\",\n  title: \"TLS certificate verification disabled (C/OpenSSL)\",\n  description: \"OpenSSL SSL_VERIFY_NONE\",\n  category: \"tls\",\n  severity: \"high\",\n  confidence: \"high\",\n  hndl: false,\n  cwe: CWE_CERT_VALIDATION,\n  message: \"SSL_VERIFY_NONE disables TLS certificate verification (MITM risk).\",\n  remediation: \"Use SSL_VERIFY_PEER and verify certificates properly.\",\n};\n// --- Mbed TLS (embedded) ---\nconst RULE_C_MBEDTLS_RSA: RuleMeta = {\n  id: \"c-mbedtls-rsa-keygen\",\n  title: \"Mbed TLS RSA key generation\",\n  description: \"Mbed TLS mbedtls_rsa_gen_key\",\n  category: \"kem\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"RSA\",\n  hndl: true,\n  cwe: CWE_BROKEN_CRYPTO,\n  message: \"Generates a classical RSA key pair (Mbed TLS, embedded), which is not quantum-safe.\",\n};\nconst RULE_C_MBEDTLS_EC: RuleMeta = {\n  id: \"c-mbedtls-ec-keygen\",\n  title: \"Mbed TLS EC key generation\",\n  description: \"Mbed TLS mbedtls_ecp_gen_key / mbedtls_ecp_gen_keypair\",\n  category: \"key-exchange\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"ECDH\",\n  hndl: true,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"Generates a classical EC key pair (Mbed TLS, embedded). EC keys feed BOTH ECDSA signatures and ECDH key agreement; the ECDH path is harvest-now-decrypt-later exposed.\",\n  remediation:\n    \"For key agreement: hybrid X25519MLKEM768 (ML-KEM-768). For signatures: ML-DSA-65 (FIPS 204).\",\n};\nconst RULE_C_MBEDTLS_ECDSA: RuleMeta = {\n  id: \"c-mbedtls-ecdsa\",\n  title: \"Mbed TLS ECDSA signature\",\n  description: \"Mbed TLS mbedtls_ecdsa_sign / write_signature / read_signature / verify\",\n  category: \"signature\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"ECDSA\",\n  hndl: false,\n  cwe: CWE_BROKEN_CRYPTO,\n  message: \"Classical ECDSA (Mbed TLS, embedded) is forgeable by a quantum attacker.\",\n  remediation: \"ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205)\",\n};\nconst RULE_C_MBEDTLS_ECDH: RuleMeta = {\n  id: \"c-mbedtls-ecdh\",\n  title: \"Mbed TLS ECDH key agreement\",\n  description: \"Mbed TLS mbedtls_ecdh_compute_shared / mbedtls_ecdh_calc_secret\",\n  category: \"key-exchange\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"ECDH\",\n  hndl: true,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"Elliptic-curve Diffie-Hellman (Mbed TLS, embedded) is broken by Shor's algorithm (harvest-now-decrypt-later).\",\n};\nconst RULE_C_MBEDTLS_DH: RuleMeta = {\n  id: \"c-mbedtls-dh\",\n  title: \"Mbed TLS Diffie-Hellman key exchange\",\n  description: \"Mbed TLS mbedtls_dhm_make_public / make_params / calc_secret\",\n  category: \"key-exchange\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"DH\",\n  hndl: true,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"Finite-field Diffie-Hellman (Mbed TLS, embedded) is broken by Shor's algorithm (harvest-now-decrypt-later).\",\n};\n// --- wolfSSL / wolfCrypt (embedded) ---\nconst RULE_C_WOLF_RSA: RuleMeta = {\n  id: \"c-wolfssl-rsa\",\n  title: \"wolfSSL RSA key/usage\",\n  description: \"wolfCrypt wc_MakeRsaKey / wc_RsaPublicEncrypt / wc_RsaPrivateDecrypt\",\n  category: \"kem\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"RSA\",\n  hndl: true,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"Classical RSA key generation / encryption (wolfSSL, embedded) is harvest-now-decrypt-later exposed.\",\n};\nconst RULE_C_WOLF_ECC: RuleMeta = {\n  id: \"c-wolfssl-ecc-keygen\",\n  title: \"wolfSSL EC key generation\",\n  description: \"wolfCrypt wc_ecc_make_key / wc_ecc_make_key_ex\",\n  category: \"key-exchange\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"ECDH\",\n  hndl: true,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"Generates a classical EC key pair (wolfSSL, embedded). EC keys feed BOTH ECDSA signatures and ECDH key agreement; the ECDH path is harvest-now-decrypt-later exposed.\",\n  remediation:\n    \"For key agreement: hybrid X25519MLKEM768 (ML-KEM-768). For signatures: ML-DSA-65 (FIPS 204).\",\n};\nconst RULE_C_WOLF_ECDSA: RuleMeta = {\n  id: \"c-wolfssl-ecdsa\",\n  title: \"wolfSSL ECDSA signature\",\n  description: \"wolfCrypt wc_ecc_sign_hash / wc_ecc_verify_hash\",\n  category: \"signature\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"ECDSA\",\n  hndl: false,\n  cwe: CWE_BROKEN_CRYPTO,\n  message: \"Classical ECDSA (wolfSSL, embedded) is forgeable by a quantum attacker.\",\n  remediation: \"ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205)\",\n};\nconst RULE_C_WOLF_ECDH: RuleMeta = {\n  id: \"c-wolfssl-ecdh\",\n  title: \"wolfSSL ECDH key agreement\",\n  description: \"wolfCrypt wc_ecc_shared_secret\",\n  category: \"key-exchange\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"ECDH\",\n  hndl: true,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"Elliptic-curve Diffie-Hellman (wolfSSL, embedded) is broken by Shor's algorithm (harvest-now-decrypt-later).\",\n};\nconst RULE_C_WOLF_DH: RuleMeta = {\n  id: \"c-wolfssl-dh\",\n  title: \"wolfSSL Diffie-Hellman key exchange\",\n  description: \"wolfCrypt wc_DhGenerateKeyPair / wc_DhAgree\",\n  category: \"key-exchange\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"DH\",\n  hndl: true,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"Finite-field Diffie-Hellman (wolfSSL, embedded) is broken by Shor's algorithm (harvest-now-decrypt-later).\",\n};\nconst RULE_C_WOLF_CURVE25519: RuleMeta = {\n  id: \"c-wolfssl-curve25519\",\n  title: \"wolfSSL X25519 key agreement\",\n  description: \"wolfCrypt wc_curve25519_make_key / wc_curve25519_shared_secret\",\n  category: \"key-exchange\",\n  severity: \"medium\",\n  confidence: \"high\",\n  algorithm: \"X25519\",\n  hndl: true,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"X25519 key agreement (wolfSSL, embedded) is modern but classical, and harvest-now-decrypt-later exposed.\",\n};\nconst RULE_C_WOLF_ED25519: RuleMeta = {\n  id: \"c-wolfssl-ed25519\",\n  title: \"wolfSSL Ed25519 signature\",\n  description: \"wolfCrypt wc_ed25519_make_key / wc_ed25519_sign_msg / wc_ed25519_verify_msg\",\n  category: \"signature\",\n  severity: \"low\",\n  confidence: \"high\",\n  algorithm: \"EdDSA\",\n  hndl: false,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"Ed25519 signatures (wolfSSL, embedded) are classical and forgeable by a quantum attacker.\",\n  remediation: \"ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205)\",\n};\n\n/** Detects classical asymmetric crypto in C/C++ (OpenSSL). */\nexport const cDetector: Detector = {\n  id: \"c-crypto\",\n  description: \"Classical asymmetric crypto in C/C++ (OpenSSL, libsodium, Mbed TLS, wolfSSL)\",\n  scope: \"source\",\n  language: \"c\",\n  rules: [\n    RULE_C_RSA,\n    RULE_C_EC,\n    RULE_C_ECDSA,\n    RULE_C_ECDH,\n    RULE_C_DSA,\n    RULE_C_DH,\n    RULE_C_EVP_KEYGEN,\n    RULE_C_EVP_DERIVE,\n    RULE_C_EVP_CRYPT,\n    RULE_C_EVP_SIGN,\n    RULE_C_SODIUM_BOX,\n    RULE_C_SODIUM_SIGN,\n    RULE_C_ECDSA_VERIFY,\n    RULE_C_RSA_VERIFY,\n    RULE_C_RSA_CRYPT,\n    RULE_C_TLS_VERSION,\n    RULE_C_TLS_VERIFY_NONE,\n    RULE_C_MBEDTLS_RSA,\n    RULE_C_MBEDTLS_EC,\n    RULE_C_MBEDTLS_ECDSA,\n    RULE_C_MBEDTLS_ECDH,\n    RULE_C_MBEDTLS_DH,\n    RULE_C_WOLF_RSA,\n    RULE_C_WOLF_ECC,\n    RULE_C_WOLF_ECDSA,\n    RULE_C_WOLF_ECDH,\n    RULE_C_WOLF_DH,\n    RULE_C_WOLF_CURVE25519,\n    RULE_C_WOLF_ED25519,\n  ],\n  appliesTo: (f) => hasExtension(f, C_EXTENSIONS),\n  detect({ file, content }): Finding[] {\n    const findings: Finding[] = [];\n    const add = (re: RegExp, rule: RuleMeta) =>\n      eachMatch(re, content, (m) =>\n        findings.push(\n          findingFromRule(rule, { file, content, index: m.index, matchLength: m[0].length }),\n        ),\n      );\n    add(RE_C_RSA, RULE_C_RSA);\n    add(RE_C_EC, RULE_C_EC);\n    add(RE_C_ECDSA, RULE_C_ECDSA);\n    add(RE_C_ECDH, RULE_C_ECDH);\n    add(RE_C_DSA, RULE_C_DSA);\n    add(RE_C_DH, RULE_C_DH);\n    add(RE_C_EVP_KEYGEN, RULE_C_EVP_KEYGEN);\n    add(RE_C_EVP_DERIVE, RULE_C_EVP_DERIVE);\n    add(RE_C_EVP_CRYPT, RULE_C_EVP_CRYPT);\n    add(RE_C_EVP_SIGN, RULE_C_EVP_SIGN);\n    add(RE_C_SODIUM_BOX, RULE_C_SODIUM_BOX);\n    add(RE_C_SODIUM_SIGN, RULE_C_SODIUM_SIGN);\n    add(RE_C_ECDSA_VERIFY, RULE_C_ECDSA_VERIFY);\n    add(RE_C_RSA_VERIFY, RULE_C_RSA_VERIFY);\n    add(RE_C_RSA_CRYPT, RULE_C_RSA_CRYPT);\n    add(RE_C_TLS_VERSION, RULE_C_TLS_VERSION);\n    add(RE_C_TLS_VERIFY_NONE, RULE_C_TLS_VERIFY_NONE);\n    add(RE_C_MBEDTLS_RSA, RULE_C_MBEDTLS_RSA);\n    add(RE_C_MBEDTLS_EC, RULE_C_MBEDTLS_EC);\n    add(RE_C_MBEDTLS_ECDSA, RULE_C_MBEDTLS_ECDSA);\n    add(RE_C_MBEDTLS_ECDH, RULE_C_MBEDTLS_ECDH);\n    add(RE_C_MBEDTLS_DH, RULE_C_MBEDTLS_DH);\n    add(RE_C_WOLF_RSA, RULE_C_WOLF_RSA);\n    add(RE_C_WOLF_ECC, RULE_C_WOLF_ECC);\n    add(RE_C_WOLF_ECDSA, RULE_C_WOLF_ECDSA);\n    add(RE_C_WOLF_ECDH, RULE_C_WOLF_ECDH);\n    add(RE_C_WOLF_DH, RULE_C_WOLF_DH);\n    add(RE_C_WOLF_CURVE25519, RULE_C_WOLF_CURVE25519);\n    add(RE_C_WOLF_ED25519, RULE_C_WOLF_ED25519);\n    return findings;\n  },\n};\n"]}

package/dist/detectors/cicd.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Config detector: classical signing of build artifacts and code in CI/CD
+ * pipelines (GitHub Actions, GitLab CI, Jenkins, Azure Pipelines, CircleCI).
+ *
+ * Artifact and code signatures are the signature-side analogue of "harvest now,
+ * decrypt later": a release signed today with a classical key is *forgeable* once
+ * a CRQC exists, and long-lived artifacts (container images, released binaries,
+ * SBOM attestations) keep verifying against that classical public key for years.
+ * So these are flagged `hndl:false` (a signature is not confidentiality — nothing
+ * to harvest) but remain real quantum-migration debt.
+ *
+ * Covered command invocations (distinctive enough inside a CI file that the
+ * false-positive risk is low):
+ *  - `cosign sign|attest|generate-key-pair`  → sigstore/cosign uses ECDSA P-256
+ *    (both key-based and keyless/Fulcio).
+ *  - `gpg --detach-sign|--clearsign|--sign`   → GnuPG, classically RSA.
+ *  - `jarsigner`                              → Java JAR signing (RSA/DSA/EC).
+ *  - `codesign --sign|-s`                     → Apple code signing (RSA).
+ *  - `minisign`                               → Ed25519 signatures.
+ *
+ * Gated to CI/CD pipeline files so `gpg`/`cosign` mentioned in a shell script or
+ * doc does not fire; the surface here is specifically the release pipeline.
+ */
+import type { Detector } from "../types.js";
+/** Detects classical artifact / code signing in CI/CD pipeline definitions. */
+export declare const cicdDetector: Detector;
+//# sourceMappingURL=cicd.d.ts.map

package/dist/detectors/cicd.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cicd.d.ts","sourceRoot":"","sources":["../../src/detectors/cicd.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAqB,MAAM,aAAa,CAAC;AAmH/D,+EAA+E;AAC/E,eAAO,MAAM,YAAY,EAAE,QAkB1B,CAAC"}

package/dist/detectors/cicd.js

@@ -0,0 +1,116 @@
+import { eachMatch, findingFromRule } from "../detect-utils.js";
+import { CWE_BROKEN_CRYPTO } from "../cwe.js";
+/** True for the CI/CD pipeline definition files this detector inspects. */
+function isCiPipelineFile(filePath) {
+    const lower = filePath.toLowerCase();
+    const base = lower.split("/").pop() ?? lower;
+    return ((lower.includes(".github/workflows/") && (lower.endsWith(".yml") || lower.endsWith(".yaml"))) ||
+        base === ".gitlab-ci.yml" ||
+        lower.endsWith(".gitlab-ci.yml") ||
+        base === "jenkinsfile" ||
+        lower.endsWith(".jenkinsfile") ||
+        base === "azure-pipelines.yml" ||
+        base === "azure-pipelines.yaml" ||
+        (lower.includes(".circleci/") && (lower.endsWith(".yml") || lower.endsWith(".yaml"))));
+}
+const CI_RULES = [
+    {
+        re: /\bcosign\s+(?:sign|attest|sign-blob|generate-key-pair)\b/g,
+        meta: {
+            id: "ci-cosign-ecdsa",
+            title: "cosign artifact signing (ECDSA)",
+            description: "sigstore/cosign signing in a CI pipeline",
+            category: "signature",
+            severity: "medium",
+            confidence: "high",
+            algorithm: "ECDSA",
+            hndl: false,
+            cwe: CWE_BROKEN_CRYPTO,
+            message: "CI pipeline signs artifacts with cosign (ECDSA P-256, key-based or keyless/Fulcio); classical signatures are forgeable once a CRQC exists.",
+            remediation: "Track sigstore's post-quantum signing roadmap (ML-DSA); plan hybrid signing for long-lived release artifacts.",
+        },
+    },
+    {
+        re: /\bgpg\b[^\n]*?\s--(?:detach-sign|clearsign|sign)\b/g,
+        meta: {
+            id: "ci-gpg-sign",
+            title: "GPG signing (RSA)",
+            description: "GnuPG detached/clear signing in a CI pipeline",
+            category: "signature",
+            severity: "medium",
+            confidence: "high",
+            algorithm: "RSA",
+            hndl: false,
+            cwe: CWE_BROKEN_CRYPTO,
+            message: "CI pipeline signs with GPG, classically an RSA signing key; forgeable once a CRQC exists.",
+            remediation: "Plan migration to ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205) signatures.",
+        },
+    },
+    {
+        re: /\bjarsigner\b/g,
+        meta: {
+            id: "ci-jarsigner",
+            title: "Java jarsigner (classical)",
+            description: "JDK jarsigner code signing in a CI pipeline",
+            category: "signature",
+            severity: "medium",
+            confidence: "high",
+            algorithm: "RSA",
+            hndl: false,
+            cwe: CWE_BROKEN_CRYPTO,
+            message: "CI pipeline signs JARs with jarsigner (classical RSA/DSA/EC signing key); forgeable once a CRQC exists.",
+            remediation: "Plan migration to a PQC signature scheme (ML-DSA-65 / SLH-DSA) as the JDK adds support.",
+        },
+    },
+    {
+        re: /\bcodesign\s+(?:-s\b|--sign\b)/g,
+        meta: {
+            id: "ci-codesign",
+            title: "Apple codesign (RSA)",
+            description: "Apple codesign in a CI pipeline",
+            category: "signature",
+            severity: "medium",
+            confidence: "high",
+            algorithm: "RSA",
+            hndl: false,
+            cwe: CWE_BROKEN_CRYPTO,
+            message: "CI pipeline signs with Apple codesign (classical RSA signing identity); forgeable once a CRQC exists.",
+            remediation: "Classical only today; track Apple's PQC signing support and plan migration.",
+        },
+    },
+    {
+        re: /\bminisign\b/g,
+        meta: {
+            id: "ci-minisign",
+            title: "minisign (Ed25519)",
+            description: "minisign signing in a CI pipeline",
+            category: "signature",
+            severity: "low",
+            confidence: "high",
+            algorithm: "EdDSA",
+            hndl: false,
+            cwe: CWE_BROKEN_CRYPTO,
+            message: "CI pipeline signs with minisign (Ed25519); modern but classical and forgeable once a CRQC exists.",
+            remediation: "Plan migration to ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205).",
+        },
+    },
+];
+/** Detects classical artifact / code signing in CI/CD pipeline definitions. */
+export const cicdDetector = {
+    id: "cicd-signing",
+    description: "Classical artifact / code signing in CI/CD pipelines",
+    scope: "config",
+    language: "any",
+    rules: CI_RULES.map((r) => r.meta),
+    appliesTo: isCiPipelineFile,
+    detect({ file, content }) {
+        const findings = [];
+        for (const rule of CI_RULES) {
+            eachMatch(rule.re, content, (m) => {
+                findings.push(findingFromRule(rule.meta, { file, content, index: m.index, matchLength: m[0].length }));
+            });
+        }
+        return findings;
+    },
+};
+//# sourceMappingURL=cicd.js.map