cbom-tools 0.1.0 → 0.2.0

package/README.md

@@ -40,6 +40,19 @@ Exit codes:
 - `0` — no changes
 - `1` — changes detected
 - `2` — file not found or parse error
+- `3` — (reserved) quantum-vulnerable/weak algorithm detection (planned for 0.2.0)
+
+## Testing
+
+```
+npm test
+```
+
+17 CLI contract tests (Node built-in `node:test`, zero dependencies):
+both binaries are spawned as child processes and checked against edge
+inputs — empty directory, dependencies-only, source-only, an 800-file
+tree (occurrence cap, `node_modules` / `.git` / dotfile skipping),
+unreachable directories, missing argument values, and malformed JSON.
 
 ## Example (real output)
 

package/algo-metadata.json

@@ -2,7 +2,7 @@
   "ML-KEM": {
     "assetType": "algorithm",
     "algorithmProperties": {
-      "primitive": "KEM"
+      "primitive": "kem"
     },
     "implementationPlatform": "javascript",
     "certificationLevel": "known-answer-tested",
@@ -13,7 +13,7 @@
   "NTT": {
     "assetType": "algorithm",
     "algorithmProperties": {
-      "primitive": "MATH"
+      "primitive": "other"
     },
     "implementationPlatform": "javascript",
     "certificationLevel": "known-answer-tested",
@@ -24,9 +24,9 @@
   "SHA-256": {
     "assetType": "algorithm",
     "algorithmProperties": {
-      "primitive": "HASH"
+      "primitive": "hash"
     },
-    "implementationPlatform": "javascript",
+    "implementationPlatform": "javascript, python",
     "certificationLevel": "known-answer-tested",
     "quantumSecurity": {
       "level": "weak"
@@ -35,7 +35,7 @@
   "SM2": {
     "assetType": "algorithm",
     "algorithmProperties": {
-      "primitive": "SIGN"
+      "primitive": "signature"
     },
     "implementationPlatform": "javascript",
     "certificationLevel": "known-answer-tested",
@@ -46,7 +46,7 @@
   "P-256/ECDH": {
     "assetType": "algorithm",
     "algorithmProperties": {
-      "primitive": "ECC"
+      "primitive": "key-agree"
     },
     "implementationPlatform": "javascript",
     "certificationLevel": "known-answer-tested",
@@ -57,7 +57,7 @@
   "Double-Ratchet": {
     "assetType": "algorithm",
     "algorithmProperties": {
-      "primitive": "PROTO"
+      "primitive": "other"
     },
     "implementationPlatform": "javascript",
     "certificationLevel": "known-answer-tested",
@@ -68,7 +68,7 @@
   "SM3": {
     "assetType": "algorithm",
     "algorithmProperties": {
-      "primitive": "HASH"
+      "primitive": "hash"
     },
     "implementationPlatform": "javascript",
     "certificationLevel": "known-answer-tested",
@@ -79,7 +79,7 @@
   "ML-DSA/fml-dsa": {
     "assetType": "algorithm",
     "algorithmProperties": {
-      "primitive": "SIGN"
+      "primitive": "signature"
     },
     "implementationPlatform": "javascript",
     "certificationLevel": "known-answer-tested",
@@ -90,7 +90,7 @@
   "SM4": {
     "assetType": "algorithm",
     "algorithmProperties": {
-      "primitive": "SYM"
+      "primitive": "block-cipher"
     },
     "implementationPlatform": "javascript",
     "certificationLevel": "known-answer-tested",
@@ -101,7 +101,7 @@
   "AES": {
     "assetType": "algorithm",
     "algorithmProperties": {
-      "primitive": "SYM"
+      "primitive": "block-cipher"
     },
     "implementationPlatform": "javascript",
     "certificationLevel": "known-answer-tested",
@@ -112,7 +112,128 @@
   "SLH-DSA": {
     "assetType": "algorithm",
     "algorithmProperties": {
-      "primitive": "SIGN"
+      "primitive": "signature"
+    },
+    "implementationPlatform": "javascript",
+    "certificationLevel": "known-answer-tested",
+    "quantumSecurity": {
+      "level": "safe"
+    }
+  },
+  "ChaCha20-Poly1305": {
+    "assetType": "algorithm",
+    "algorithmProperties": {
+      "primitive": "ae"
+    },
+    "implementationPlatform": "c",
+    "certificationLevel": "known-answer-tested",
+    "quantumSecurity": {
+      "level": "safe"
+    }
+  },
+  "X25519": {
+    "assetType": "algorithm",
+    "algorithmProperties": {
+      "primitive": "kem"
+    },
+    "implementationPlatform": "c",
+    "certificationLevel": "known-answer-tested",
+    "quantumSecurity": {
+      "level": "vulnerable"
+    }
+  },
+  "Ed25519": {
+    "assetType": "algorithm",
+    "algorithmProperties": {
+      "primitive": "signature"
+    },
+    "implementationPlatform": "c",
+    "certificationLevel": "known-answer-tested",
+    "quantumSecurity": {
+      "level": "vulnerable"
+    }
+  },
+  "Blake2b": {
+    "assetType": "algorithm",
+    "algorithmProperties": {
+      "primitive": "hash"
+    },
+    "implementationPlatform": "c",
+    "certificationLevel": "known-answer-tested",
+    "quantumSecurity": {
+      "level": "weak"
+    }
+  },
+  "Argon2i": {
+    "assetType": "algorithm",
+    "algorithmProperties": {
+      "primitive": "kdf"
+    },
+    "implementationPlatform": "c",
+    "certificationLevel": "known-answer-tested",
+    "quantumSecurity": {
+      "level": "safe"
+    }
+  },
+  "AES-GCM": {
+    "assetType": "algorithm",
+    "algorithmProperties": {
+      "primitive": "ae"
+    },
+    "implementationPlatform": "c",
+    "certificationLevel": "known-answer-tested",
+    "quantumSecurity": {
+      "level": "weak"
+    }
+  },
+  "SHA-512": {
+    "assetType": "algorithm",
+    "algorithmProperties": {
+      "primitive": "hash"
+    },
+    "implementationPlatform": "c",
+    "certificationLevel": "known-answer-tested",
+    "quantumSecurity": {
+      "level": "weak"
+    }
+  },
+  "ECDH": {
+    "assetType": "algorithm",
+    "algorithmProperties": {
+      "primitive": "kem"
+    },
+    "implementationPlatform": "c",
+    "certificationLevel": "known-answer-tested",
+    "quantumSecurity": {
+      "level": "vulnerable"
+    }
+  },
+  "RSA": {
+    "assetType": "algorithm",
+    "algorithmProperties": {
+      "primitive": "pke"
+    },
+    "implementationPlatform": "c",
+    "certificationLevel": "known-answer-tested",
+    "quantumSecurity": {
+      "level": "vulnerable"
+    }
+  },
+  "Keccak": {
+    "assetType": "algorithm",
+    "algorithmProperties": {
+      "primitive": "other"
+    },
+    "implementationPlatform": "javascript",
+    "certificationLevel": "known-answer-tested",
+    "quantumSecurity": {
+      "level": "safe"
+    }
+  },
+  "SHA3-256": {
+    "assetType": "algorithm",
+    "algorithmProperties": {
+      "primitive": "hash"
     },
     "implementationPlatform": "javascript",
     "certificationLevel": "known-answer-tested",
@@ -120,10 +241,10 @@
       "level": "safe"
     }
   },
-  "TLA+": {
+  "SHA3-512": {
     "assetType": "algorithm",
     "algorithmProperties": {
-      "primitive": "PROTO"
+      "primitive": "hash"
     },
     "implementationPlatform": "javascript",
     "certificationLevel": "known-answer-tested",
@@ -131,4 +252,4 @@
       "level": "safe"
     }
   }
-}
+}

package/cbom-diff.js

@@ -17,7 +17,7 @@
  *   0 — 无变更
  *   1 — 有信息性变更（算法属性升级等）
  *   2 — 有警告性变更（算法删除、新经典算法引用等）
- *   3 — 有严重变更（量子脆弱算法被引入）
+ *   3 — (reserved) 量子脆弱/弱算法引入检测（0.2.0 规划）
  */
 
 const { execSync } = require('child_process');
@@ -55,7 +55,12 @@ function loadCBOM(hash) {
       console.error(`✕ cbom-diff: file not found: ${filePath}`);
       process.exit(2);
     }
-    return JSON.parse(fs.readFileSync(filePath, 'utf-8'));
+    try {
+      return JSON.parse(fs.readFileSync(filePath, 'utf-8'));
+    } catch (e) {
+      console.error(`✕ cbom-diff: invalid JSON in ${filePath}: ${e.message}`);
+      process.exit(2);
+    }
   }
   // 2. Git mode
   if (gitMode) {
@@ -121,7 +126,7 @@ if (oldCBOM && newCBOM) {
         ref,
         name: c.name,
         type: assetType,
-        risk: classifyRisk(assetType),
+        risk: classifyRisk(crypto),
       });
     }
   });
@@ -206,8 +211,8 @@ if (hasCriticalAdd) {
 // ════════════════════════════
 // 算法风险分类
 // ════════════════════════════
-function classifyRisk(assetType) {
-  const type = (assetType || '').toLowerCase();
+function classifyRisk(cryptoProps) {
+  const type = ((cryptoProps && cryptoProps.assetType) || '').toLowerCase();
   // PQC algorithms: safe additions
   if (/kem|sign|signature|post.quantum|pqc|mlkem|mldsa|slh/i.test(type)) return 'info';
   // Primitive/verification: neutral
@@ -216,6 +221,8 @@ function classifyRisk(assetType) {
   if (/ecc|ecdh|p-256|sm2|curve/i.test(type)) return 'warning';
   // Classic symmetric: info (still safe with large keys)
   if (/sym|sm4|aes|gcm/i.test(type)) return 'info';
+  // TODO(v0.2.0): add 'critical' exit code for quantum-vulnerable algorithms
+  // using cryptoProps.quantumSecurity?.level
   // Unknown: treat as warning
   return 'warning';
 }

package/cbom-scan.cjs

@@ -11,6 +11,7 @@ const fs = require('fs');
 const path = require('path');
 
 const ALGO_META = JSON.parse(fs.readFileSync(path.join(__dirname, 'algo-metadata.json'), 'utf-8'));
+const PKG = JSON.parse(fs.readFileSync(path.join(__dirname, 'package.json'), 'utf-8'));
 
 const NAME_ALIASES = {
  'ML-KEM-768': 'ML-KEM',
@@ -20,6 +21,7 @@ const NAME_ALIASES = {
  'ML-DSA-44': 'ML-DSA/fml-dsa',
  'ML-DSA-65': 'ML-DSA/fml-dsa',
  'ML-DSA-87': 'ML-DSA/fml-dsa',
+ 'Keccak-256': 'Keccak',
 };
 
 function lookupMeta(name) {
@@ -52,11 +54,32 @@ const DEFAULT_RULES = {
  { re: /\bsm2\b/gi, algs: ['SM2'] },
  { re: /\bsm3\b/gi, algs: ['SM3'] },
  { re: /\bsm4\b/gi, algs: ['SM4'] },
- ],
+ // === C/C++ 编译库（monocypher）===
+ { re: /\bcrypto_lock\b/g, algs: ['ChaCha20-Poly1305'] },
+ { re: /\bcrypto_unlock\b/g, algs: ['ChaCha20-Poly1305'] },
+ { re: /\bcrypto_x25519/g, algs: ['X25519'] },
+ { re: /\bcrypto_sign/g, algs: ['Ed25519'] },
+ { re: /\bcrypto_check\b/g, algs: ['Ed25519'] },
+ { re: /\bcrypto_blake2b/g, algs: ['Blake2b'] },
+ { re: /\bcrypto_argon2i\b/g, algs: ['Argon2i'] },
+ { re: /\bcrypto_key_exchange\b/g, algs: ['X25519'] },
+ // === C/C++ 通用（mbedtls）===
+ { re: /\bmbedtls_sha256/g, algs: ['SHA-256'] },
+ { re: /\bmbedtls_sha512/g, algs: ['SHA-512'] },
+ { re: /\bmbedtls_aes/g, algs: ['AES'] },
+ { re: /\bmbedtls_gcm/g, algs: ['AES-GCM'] },
+ { re: /\bmbedtls_ecdh/g, algs: ['ECDH'] },
+ { re: /\bmbedtls_rsa/g, algs: ['RSA'] },
+
+ // Python hashlib (MAVLink2 signing, pymavlink sample)
+ { re: /import\s+hashlib/g, algs: ['SHA-256'] },
+ { re: /hashlib\.sha256\(/g, algs: ['SHA-256'] },
+ { re: /hashlib\.new\(\s*["']sha256["']/gi, algs: ['SHA-256'] },
+],
 };
 
 const SKIP_DIRS = new Set(['node_modules', 'dist', 'build', 'coverage', '.git', '.cache']);
-const SCAN_EXT = /\.(cjs|mjs|js|ts|tsx|jsx)$/;
+const SCAN_EXT = /\.(cjs|mjs|js|ts|tsx|jsx|cpp|c|h|hpp|py)$/;
 const MAX_OCC_PER_ALGO = 50;
 
 function loadPackageDeps(dir) {
@@ -127,7 +150,7 @@ function toCycloneDX(algorithms) {
  version: 1,
  metadata: {
  timestamp: new Date().toISOString(),
- tools: [{ name: 'cbom-scan', version: '0.1.0', vendor: 'FIBEMATE' }],
+ tools: [{ name: 'cbom-scan', version: PKG.version, vendor: 'FIBEMATE' }],
  },
  components: [...algorithms.keys()].sort().map(name => {
  const meta = lookupMeta(name);
@@ -136,7 +159,20 @@ function toCycloneDX(algorithms) {
  name,
  'bom-ref': `crypto:${name}`,
  };
- if (meta) comp.cryptoProperties = meta;
+ if (meta) {
+    comp.cryptoProperties = {
+      assetType: meta.assetType,
+      algorithmProperties: meta.algorithmProperties,
+    };
+    const props = [];
+    if (meta.implementationPlatform)
+      props.push({ name: 'fibemate:implementationLanguages', value: meta.implementationPlatform });
+    if (meta.certificationLevel)
+      props.push({ name: 'fibemate:testingStatus', value: meta.certificationLevel });
+    if (meta.quantumSecurity?.level)
+      props.push({ name: 'fibemate:quantumSecurity:level', value: meta.quantumSecurity.level });
+    if (props.length) comp.properties = props;
+  }
  const occ = algorithms.get(name);
  if (occ && occ.length) comp.evidence = { occurrences: occ };
  return comp;
@@ -146,7 +182,16 @@ function toCycloneDX(algorithms) {
 
 function main() {
  const args = process.argv.slice(2);
- const dir = args.includes('--dir') ? args[args.indexOf('--dir') + 1] : process.cwd();
+ const dirFlag = args.indexOf('--dir');
+ let dir = process.cwd();
+ if (dirFlag !== -1) {
+   const v = args[dirFlag + 1];
+   if (!v || v.startsWith('--')) {
+     console.error('usage: cbom-scan [--dir <path>] [--out <file>]');
+     process.exit(2);
+   }
+   dir = v;
+ }
  const outPath = args.includes('--out') ? args[args.indexOf('--out') + 1] : null;
 
  const deps = loadPackageDeps(dir);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cbom-tools",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "Crypto Bill of Materials — scan, diff, report (CycloneDX 1.6 CBOM)",
   "license": "Apache-2.0",
   "author": "刘天赫 <research@fibemate.net>",
@@ -14,5 +14,12 @@
     "algo-metadata.json",
     "README.md",
     "LICENSE"
-  ]
-}
+  ],
+  "scripts": {
+    "test": "node --test"
+  },
+  "devDependencies": {
+    "ajv": "^8.20.0",
+    "ajv-formats": "^3.0.1"
+  }
+}