cbom-tools 0.1.0

package/LICENSE

@@ -0,0 +1,198 @@
+Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work, or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communications that are conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (or agreed to in writing in
+      any event) shall any Contributor be liable to You for damages,
+      including any direct, indirect, special, incidental, or consequential
+      damages of any character arising as a result of this License or
+      out of the use or inability to use the Work (including but not limited
+      to damages for loss of goodwill, work stoppage, computer failure or
+      malfunction, or any and all other commercial damages or losses), even
+      if such Contributor has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and bibliography
+
+      Copyright [yyyy] [name of copyright owner]
+
+      Licensed under the Apache License, Version 2.0 (the "License");
+      you may not use this file except in compliance with the License.
+      You may obtain a copy of the License at
+
+          http://www.apache.org/licenses/LICENSE-2.0
+
+      Unless required by applicable law or agreed to in writing, software
+      distributed under the License is distributed on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+      See the License for the specific language governing permissions and
+      limitations under the License.

package/README.md

@@ -0,0 +1,99 @@
+# cbom-tools
+
+**Cryptographic Bill of Materials — scan, diff, report.**
+
+Scan a directory tree for cryptographic assets, emit a
+[CycloneDX 1.6](https://cyclonedx.org/) CBOM, and diff two CBOMs to
+detect algorithm additions, removals, and metadata changes.
+
+Zero external dependencies. Pure Node.js.
+
+## Install
+
+```
+npm install -g cbom-tools
+```
+
+## Usage
+
+### 1. Scan a project
+
+```
+cbom-scan --dir ./my-project --out cbom.json
+```
+
+Scans:
+- `package.json` dependencies (declarative rule table)
+- Source files (`.js/.cjs/.mjs/.ts/.tsx/.jsx`) via regex patterns
+
+Output: a CycloneDX 1.6 JSON with `cryptoProperties` (asset type,
+primitive, quantum security level) and `evidence.occurrences` (file
+paths + line numbers, capped at 50 per algorithm, deduplicated).
+
+### 2. Diff two CBOMs
+
+```
+cbom-diff cbom-before.json cbom-after.json
+```
+
+Exit codes:
+- `0` — no changes
+- `1` — changes detected
+- `2` — file not found or parse error
+
+## Example (real output)
+
+Scanning a repository before and after a PQC migration:
+
+```
+$ cbom-scan --dir ./repo-before --out before.json
+cbom-scan: wrote 11 algorithms to before.json
+
+$ cbom-scan --dir ./repo-after --out after.json
+cbom-scan: wrote 13 algorithms to after.json
+
+$ cbom-diff before.json after.json
+## CBOM Diff
+
+Removed: none
+Added: Keccak-256, SHA3-512
+
+Exit code: 1
+```
+
+## Detected algorithms
+
+Rule table covers 13 algorithms:
+
+| Primitive | Algorithms |
+|---|---|
+| KEM | ML-KEM-768 (and aliases) |
+| Signature | ML-DSA-65, SLH-DSA, SM2 |
+| Hash | SHA-256, SHA3-256, SHA3-512, Keccak-256, SM3 |
+| Symmetric | SM4 |
+| Other | (extensible via source rules) |
+
+Detection input:
+- Package names (`@noble/post-quantum`, `sm-crypto`, etc.)
+- API call patterns (`crypto.createHash('sha3-256')`, etc.)
+
+## What this tool does NOT do
+
+- ❌ Does NOT implement cryptographic algorithms
+- ❌ Does NOT provide cryptographic operations (no keygen, encrypt, sign)
+- ❌ Does NOT read or verify keys, certificates, or signatures
+- ❌ Does NOT constitute a compliance certificate or audit
+
+All cryptographic information is derived from CycloneDX SBOM
+specification and public algorithm parameters. Static pattern matching
+only — no cryptographic computation is performed.
+
+## Standards
+
+Implements the [CycloneDX 1.6](https://cyclonedx.org/specification/overview/)
+CBOM specification, maintained by [OWASP](https://owasp.org/) under
+Apache-2.0.
+
+## License
+
+Apache-2.0

package/algo-metadata.json

@@ -0,0 +1,134 @@
+{
+  "ML-KEM": {
+    "assetType": "algorithm",
+    "algorithmProperties": {
+      "primitive": "KEM"
+    },
+    "implementationPlatform": "javascript",
+    "certificationLevel": "known-answer-tested",
+    "quantumSecurity": {
+      "level": "safe"
+    }
+  },
+  "NTT": {
+    "assetType": "algorithm",
+    "algorithmProperties": {
+      "primitive": "MATH"
+    },
+    "implementationPlatform": "javascript",
+    "certificationLevel": "known-answer-tested",
+    "quantumSecurity": {
+      "level": "safe"
+    }
+  },
+  "SHA-256": {
+    "assetType": "algorithm",
+    "algorithmProperties": {
+      "primitive": "HASH"
+    },
+    "implementationPlatform": "javascript",
+    "certificationLevel": "known-answer-tested",
+    "quantumSecurity": {
+      "level": "weak"
+    }
+  },
+  "SM2": {
+    "assetType": "algorithm",
+    "algorithmProperties": {
+      "primitive": "SIGN"
+    },
+    "implementationPlatform": "javascript",
+    "certificationLevel": "known-answer-tested",
+    "quantumSecurity": {
+      "level": "vulnerable"
+    }
+  },
+  "P-256/ECDH": {
+    "assetType": "algorithm",
+    "algorithmProperties": {
+      "primitive": "ECC"
+    },
+    "implementationPlatform": "javascript",
+    "certificationLevel": "known-answer-tested",
+    "quantumSecurity": {
+      "level": "vulnerable"
+    }
+  },
+  "Double-Ratchet": {
+    "assetType": "algorithm",
+    "algorithmProperties": {
+      "primitive": "PROTO"
+    },
+    "implementationPlatform": "javascript",
+    "certificationLevel": "known-answer-tested",
+    "quantumSecurity": {
+      "level": "weak"
+    }
+  },
+  "SM3": {
+    "assetType": "algorithm",
+    "algorithmProperties": {
+      "primitive": "HASH"
+    },
+    "implementationPlatform": "javascript",
+    "certificationLevel": "known-answer-tested",
+    "quantumSecurity": {
+      "level": "weak"
+    }
+  },
+  "ML-DSA/fml-dsa": {
+    "assetType": "algorithm",
+    "algorithmProperties": {
+      "primitive": "SIGN"
+    },
+    "implementationPlatform": "javascript",
+    "certificationLevel": "known-answer-tested",
+    "quantumSecurity": {
+      "level": "safe"
+    }
+  },
+  "SM4": {
+    "assetType": "algorithm",
+    "algorithmProperties": {
+      "primitive": "SYM"
+    },
+    "implementationPlatform": "javascript",
+    "certificationLevel": "known-answer-tested",
+    "quantumSecurity": {
+      "level": "weak"
+    }
+  },
+  "AES": {
+    "assetType": "algorithm",
+    "algorithmProperties": {
+      "primitive": "SYM"
+    },
+    "implementationPlatform": "javascript",
+    "certificationLevel": "known-answer-tested",
+    "quantumSecurity": {
+      "level": "safe"
+    }
+  },
+  "SLH-DSA": {
+    "assetType": "algorithm",
+    "algorithmProperties": {
+      "primitive": "SIGN"
+    },
+    "implementationPlatform": "javascript",
+    "certificationLevel": "known-answer-tested",
+    "quantumSecurity": {
+      "level": "safe"
+    }
+  },
+  "TLA+": {
+    "assetType": "algorithm",
+    "algorithmProperties": {
+      "primitive": "PROTO"
+    },
+    "implementationPlatform": "javascript",
+    "certificationLevel": "known-answer-tested",
+    "quantumSecurity": {
+      "level": "safe"
+    }
+  }
+}

package/cbom-diff.js

@@ -0,0 +1,353 @@
+#!/usr/bin/env node
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) 2026 刘天赫
+/**
+ * CBOM Diff — 加密材料清单变更检测器
+ *
+ * 用法:
+ *   node tools/cbom-diff.js                          # diff HEAD~1 vs HEAD
+ *   node tools/cbom-diff.js <old-hash> <new-hash>    # diff 两个 commit
+ *   node tools/cbom-diff.js --json                   # 输出 JSON（CI 友好）
+ *   node tools/cbom-diff.js --markdown               # 输出 Markdown（人类可读，默认）
+ *
+ * CI 集成:
+ *   每次 push 后运行，检测算法新增/删减/属性变更
+ *
+ * 退出码:
+ *   0 — 无变更
+ *   1 — 有信息性变更（算法属性升级等）
+ *   2 — 有警告性变更（算法删除、新经典算法引用等）
+ *   3 — 有严重变更（量子脆弱算法被引入）
+ */
+
+const { execSync } = require('child_process');
+const fs = require('fs');
+const path = require('path');
+
+// ════════════════════════════
+// 命令行解析
+// ════════════════════════════
+const args = process.argv.slice(2);
+let oldHash = null, newHash = null;
+let format = 'markdown'; // 'markdown' | 'json'
+let gitMode = false;
+
+for (let i = 0; i < args.length; i++) {
+  const a = args[i];
+  if (a === '--json') { format = 'json'; }
+  else if (a === '--markdown') { format = 'markdown'; }
+  else if (a === '--git') { gitMode = true; }
+  else if (!oldHash) { oldHash = a; }
+  else { newHash = a; }
+}
+
+if (!oldHash) oldHash = 'HEAD~1';
+if (!newHash) newHash = 'HEAD';
+
+// ════════════════════════════
+// CBOM 加载
+// ════════════════════════════
+function loadCBOM(hash) {
+  // 1. File path mode: .json extension → read file directly
+  if (hash && hash.toLowerCase().endsWith('.json')) {
+    const filePath = path.resolve(hash);
+    if (!fs.existsSync(filePath)) {
+      console.error(`✕ cbom-diff: file not found: ${filePath}`);
+      process.exit(2);
+    }
+    return JSON.parse(fs.readFileSync(filePath, 'utf-8'));
+  }
+  // 2. Git mode
+  if (gitMode) {
+    try {
+      const raw = execSync(`git show ${hash}:tools/cbom-cyclonedx.json`, {
+        encoding: 'utf-8',
+        maxBuffer: 10 * 1024 * 1024,
+        stdio: ['pipe', 'pipe', 'pipe'],
+      });
+      return JSON.parse(raw);
+    } catch (e) {
+      console.error(`✕ Cannot load CBOM from git ${hash}: ${e.message}`);
+      process.exit(4);
+    }
+  }
+  // 3. Default: load from local file
+  try {
+    const local = path.join(__dirname, 'cbom-cyclonedx.json');
+    return JSON.parse(fs.readFileSync(local, 'utf-8'));
+  } catch (e) {
+    console.error(`✕ Cannot load CBOM from local file: ${e.message}`);
+    process.exit(4);
+  }
+}
+
+const oldCBOM = loadCBOM(oldHash);
+const newCBOM = loadCBOM(newHash);
+
+// ════════════════════════════
+// 比较逻辑
+// ════════════════════════════
+const OLD = oldCBOM ? oldCBOM.version || 0 : 0;
+const NEW = newCBOM ? newCBOM.version || 0 : 0;
+
+const diff = {
+  meta: {
+    oldHash: oldHash,
+    newHash: newHash,
+    oldVersion: OLD,
+    newVersion: NEW,
+    date: new Date().toISOString(),
+  },
+  version: NEW > OLD ? 'bumped' : (NEW < OLD ? 'downgraded' : 'same'),
+  components: { added: [], removed: [], changed: [], unchanged: 0 },
+  dependencies: { added: [], removed: [] },
+  severity: 'none', // 'none' | 'info' | 'warning' | 'critical'
+  exitCode: 0,
+};
+
+// --- 组件比较 ---
+if (oldCBOM && newCBOM) {
+  const oldMap = new Map();
+  oldCBOM.components.forEach(c => oldMap.set(c['bom-ref'] || c.name, c));
+  const newMap = new Map();
+  newCBOM.components.forEach(c => newMap.set(c['bom-ref'] || c.name, c));
+
+  // Added
+  newMap.forEach((c, ref) => {
+    if (!oldMap.has(ref)) {
+      const crypto = c.cryptoProperties || {};
+      const assetType = crypto.assetType || c.type;
+      diff.components.added.push({
+        ref,
+        name: c.name,
+        type: assetType,
+        risk: classifyRisk(assetType),
+      });
+    }
+  });
+
+  // Removed
+  oldMap.forEach((c, ref) => {
+    if (!newMap.has(ref)) {
+      diff.components.removed.push({
+        ref,
+        name: c.name,
+        type: (c.cryptoProperties || {}).assetType || c.type,
+      });
+    }
+  });
+
+  // Changed
+  newMap.forEach((nc, ref) => {
+    const oc = oldMap.get(ref);
+    if (!oc) return;
+    const changes = compareProperties(oc, nc);
+    if (changes.length > 0) {
+      diff.components.changed.push({ ref, name: nc.name, changes });
+    } else {
+      diff.components.unchanged++;
+    }
+  });
+} else if (!oldCBOM && newCBOM) {
+  diff.components.added = newCBOM.components.map(c => ({
+    ref: c['bom-ref'],
+    name: c.name,
+    type: (c.cryptoProperties || {}).assetType || c.type,
+    risk: 'info',
+  }));
+}
+
+// --- 依赖关系比较 ---
+if (oldCBOM && newCBOM) {
+  const oldDepMap = new Map();
+  ;(oldCBOM.dependencies || []).forEach(d => oldDepMap.set(d.ref, (d.dependsOn || []).sort().join(',')));
+
+  const newDepMap = new Map();
+  ;(newCBOM.dependencies || []).forEach(d => newDepMap.set(d.ref, (d.dependsOn || []).sort().join(',')));
+
+  // Added deps
+  newDepMap.forEach((deps, ref) => {
+    if (!oldDepMap.has(ref)) {
+      diff.dependencies.added.push({ ref, dependsOn: deps });
+    } else if (oldDepMap.get(ref) !== deps) {
+      diff.dependencies.added.push({ ref, dependsOn: deps, previous: oldDepMap.get(ref) });
+    }
+  });
+
+  // Removed deps
+  oldDepMap.forEach((deps, ref) => {
+    if (!newDepMap.has(ref)) {
+      diff.dependencies.removed.push({ ref, dependsOn: deps });
+    }
+  });
+}
+
+// --- 严重性判定 ---
+const hasCriticalAdd = diff.components.added.some(c => c.risk === 'critical');
+const hasWarningAdd = diff.components.added.some(c => c.risk === 'warning');
+const hasRemoval = diff.components.removed.length > 0;
+const hasChanges = diff.components.changed.length > 0;
+const hasAdded = diff.components.added.length > 0;
+
+if (hasCriticalAdd) {
+  diff.severity = 'critical';
+  diff.exitCode = 3;
+} else if (hasRemoval || hasWarningAdd) {
+  diff.severity = 'warning';
+  diff.exitCode = 2;
+} else if (hasAdded || hasChanges) {
+  diff.severity = 'info';
+  diff.exitCode = 1;
+} else {
+  diff.severity = 'none';
+  diff.exitCode = 0;
+}
+
+// ════════════════════════════
+// 算法风险分类
+// ════════════════════════════
+function classifyRisk(assetType) {
+  const type = (assetType || '').toLowerCase();
+  // PQC algorithms: safe additions
+  if (/kem|sign|signature|post.quantum|pqc|mlkem|mldsa|slh/i.test(type)) return 'info';
+  // Primitive/verification: neutral
+  if (/ntt|sha|hash|primitive|verification|protocol/i.test(type)) return 'info';
+  // Classic ECC: warning
+  if (/ecc|ecdh|p-256|sm2|curve/i.test(type)) return 'warning';
+  // Classic symmetric: info (still safe with large keys)
+  if (/sym|sm4|aes|gcm/i.test(type)) return 'info';
+  // Unknown: treat as warning
+  return 'warning';
+}
+
+// ════════════════════════════
+// 组件属性对比
+// ════════════════════════════
+function compareProperties(oldC, newC) {
+  const changes = [];
+  const oldCp = oldC.cryptoProperties || {};
+  const newCp = newC.cryptoProperties || {};
+
+  // Check assetType change
+  if (oldCp.assetType !== newCp.assetType) {
+    changes.push({ field: 'assetType', old: oldCp.assetType, new: newCp.assetType });
+  }
+
+  // Check algorithm level
+  const oldAlg = (oldCp.algorithmProperties || {});
+  const newAlg = (newCp.algorithmProperties || {});
+  if (oldAlg.classicalSecurityLevel !== newAlg.classicalSecurityLevel) {
+    changes.push({ field: 'classicalSecurityLevel', old: oldAlg.classicalSecurityLevel, new: newAlg.classicalSecurityLevel });
+  }
+  if (oldAlg.nistQuantumSecurityLevel !== newAlg.nistQuantumSecurityLevel) {
+    changes.push({ field: 'nistQuantumSecurityLevel', old: oldAlg.nistQuantumSecurityLevel, new: newAlg.nistQuantumSecurityLevel });
+  }
+
+  // Check evidence
+  const oldEvidence = oldC.evidence || {};
+  const newEvidence = newC.evidence || {};
+  if (oldEvidence.count !== newEvidence.count) {
+    changes.push({ field: 'evidence.count', old: oldEvidence.count, new: newEvidence.count });
+  }
+
+  // version bump
+  if (oldC.version !== newC.version && oldC.version != null && newC.version != null) {
+    changes.push({ field: 'version', old: oldC.version, new: newC.version });
+  }
+
+  return changes;
+}
+
+// ════════════════════════════
+// 输出
+// ════════════════════════════
+if (format === 'json') {
+  console.log(JSON.stringify(diff, null, 2));
+} else {
+  // Markdown
+  const lines = [];
+  lines.push(`## CBOM Diff \`${oldHash.substring(0,8)} → ${newHash.substring(0,8)}\``);
+  lines.push('');
+  lines.push(`| 属性 | 值 |`);
+  lines.push(`|------|-----|`);
+  lines.push(`| 旧版本 | ${OLD} |`);
+  lines.push(`| 新版本 | ${NEW} |`);
+  lines.push(`| 版本 | ${diff.version} |`);
+  lines.push(`| 严重性 | **${diff.severity}** (exit=${diff.exitCode}) |`);
+  lines.push('');
+
+  // Added components
+  if (diff.components.added.length > 0) {
+    lines.push('### ➕ 新增算法');
+    lines.push('');
+    lines.push('| 名称 | 类型 | 风险 |');
+    lines.push('|------|------|------|');
+    diff.components.added.forEach(c => {
+      const riskEmoji = c.risk === 'critical' ? '🔴' : c.risk === 'warning' ? '🟡' : '🟢';
+      lines.push(`| ${c.name} | ${c.type} | ${riskEmoji} ${c.risk} |`);
+    });
+    lines.push('');
+  }
+
+  // Removed
+  if (diff.components.removed.length > 0) {
+    lines.push('### ➖ 删除算法');
+    lines.push('');
+    lines.push('| 名称 | 类型 |');
+    lines.push('|------|------|');
+    diff.components.removed.forEach(c => {
+      lines.push(`| ${c.name} | ${c.type} |`);
+    });
+    lines.push('');
+  }
+
+  // Changed
+  if (diff.components.changed.length > 0) {
+    lines.push(`### 🔄 属性变更 (${diff.components.changed.length} 项)`);
+    lines.push('');
+    diff.components.changed.forEach(c => {
+      lines.push(`**${c.name}**`);
+      c.changes.forEach(ch => {
+        lines.push(`- \`${ch.field}\`: \`${ch.old}\` → \`${ch.new}\``);
+      });
+      lines.push('');
+    });
+  }
+
+  // Dependencies
+  if (diff.dependencies.added.length > 0 || diff.dependencies.removed.length > 0) {
+    lines.push('### 🔗 依赖关系变更');
+    lines.push('');
+    if (diff.dependencies.added.length > 0) {
+      diff.dependencies.added.forEach(d => {
+        lines.push(`- ➕ \`${d.ref}\` → ${d.dependsOn || '(none)'}`);
+        if (d.previous) lines.push(`  (先前: ${d.previous})`);
+      });
+    }
+    if (diff.dependencies.removed.length > 0) {
+      diff.dependencies.removed.forEach(d => {
+        lines.push(`- ➖ \`${d.ref}\` ← ${d.dependsOn || '(none)'}`);
+      });
+    }
+    lines.push('');
+  }
+
+  // Summary
+  if (diff.severity === 'none') {
+    lines.push('### ✅ 无变更');
+    lines.push(`> 前后 CBOM 完全一致，${diff.components.unchanged} 算法无变化。`);
+  } else if (diff.severity === 'info') {
+    lines.push(`### ℹ️ 信息性变更`);
+    lines.push(`> ${diff.components.unchanged} 算法保持原样。（${diff.meta.date}）`);
+  } else if (diff.severity === 'warning') {
+    lines.push('### ⚠️ 警告');
+    lines.push('> 检测到值得关注的变更，请确认是否符合预期。');
+  } else {
+    lines.push('### 🔴 严重');
+    lines.push('> 检测到量子脆弱算法被引入，**请立即审查**。');
+  }
+
+  console.log(lines.join('\n'));
+}
+
+process.exit(diff.exitCode);

package/cbom-scan.cjs

@@ -0,0 +1,172 @@
+#!/usr/bin/env node
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) 2026 刘天赫
+//
+// cbom-scan.cjs — scan a directory tree for cryptographic assets,
+// emit CycloneDX 1.6 CBOM.
+
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+
+const ALGO_META = JSON.parse(fs.readFileSync(path.join(__dirname, 'algo-metadata.json'), 'utf-8'));
+
+const NAME_ALIASES = {
+ 'ML-KEM-768': 'ML-KEM',
+ 'ML-KEM-512': 'ML-KEM',
+ 'ML-KEM-1024': 'ML-KEM',
+ 'ML-DSA': 'ML-DSA/fml-dsa',
+ 'ML-DSA-44': 'ML-DSA/fml-dsa',
+ 'ML-DSA-65': 'ML-DSA/fml-dsa',
+ 'ML-DSA-87': 'ML-DSA/fml-dsa',
+};
+
+function lookupMeta(name) {
+ if (ALGO_META[name]) return ALGO_META[name];
+ const alias = NAME_ALIASES[name];
+ if (alias && ALGO_META[alias]) return ALGO_META[alias];
+ return null;
+}
+
+const DEFAULT_RULES = {
+ packages: {
+ '@noble/post-quantum': ['ML-KEM-768', 'ML-DSA-65', 'SLH-DSA'],
+ '@noble/hashes': ['SHA3-256', 'SHA3-512', 'Keccak-256'],
+ 'sm-crypto': ['SM2', 'SM3', 'SM4'],
+ 'sm2-crypto': ['SM2'],
+ jsbn: ['RSA'],
+ '@fibemate/sm2-crypto': ['SM2'],
+ '@fibemate/keccak': ['Keccak-256', 'SHA3-256'],
+ },
+ sourcePatterns: [
+ { re: /require\(['"]sm-crypto['"]\)/g, algs: ['SM2', 'SM3', 'SM4'] },
+ { re: /crypto\.createHash\(['"]sha3-(\d+)['"]\)/g, algs: ['SHA3-$1'] },
+ { re: /crypto\.createHash\(['"]sha-?256['"]\)/g, algs: ['SHA-256'] },
+ { re: /crypto\.createHash\(['"]sha-?512['"]\)/g, algs: ['SHA-512'] },
+ { re: /noble.*post-?quantum/gi, algs: ['ML-KEM', 'ML-DSA'] },
+ { re: /\bml[-_]?kem\b/gi, algs: ['ML-KEM'] },
+ { re: /\bml[-_]?dsa\b/gi, algs: ['ML-DSA'] },
+ { re: /\bslh[-_]?dsa\b/gi, algs: ['SLH-DSA'] },
+ { re: /\bkeccak\b/gi, algs: ['Keccak'] },
+ { re: /\bsm2\b/gi, algs: ['SM2'] },
+ { re: /\bsm3\b/gi, algs: ['SM3'] },
+ { re: /\bsm4\b/gi, algs: ['SM4'] },
+ ],
+};
+
+const SKIP_DIRS = new Set(['node_modules', 'dist', 'build', 'coverage', '.git', '.cache']);
+const SCAN_EXT = /\.(cjs|mjs|js|ts|tsx|jsx)$/;
+const MAX_OCC_PER_ALGO = 50;
+
+function loadPackageDeps(dir) {
+ const pkgPath = path.join(dir, 'package.json');
+ if (!fs.existsSync(pkgPath)) return {};
+ try {
+ const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf-8'));
+ return { ...(pkg.dependencies || {}), ...(pkg.devDependencies || {}) };
+ } catch {
+ return {};
+ }
+}
+
+function matchDeps(deps, rules) {
+ const found = new Set();
+ for (const name of Object.keys(deps)) {
+ if (rules.packages[name]) rules.packages[name].forEach(a => found.add(a));
+ }
+ return found;
+}
+
+function scanSource(root, rules) {
+ const found = new Map();
+
+ function addOcc(name, file, line) {
+ let arr = found.get(name);
+ if (!arr) { arr = []; found.set(name, arr); }
+ if (arr.length >= MAX_OCC_PER_ALGO) return;
+ const loc = path.relative(root, file).replace(/\\/g, '/');
+ if (arr.some(o => o.location === loc && o.line === line)) return;
+ arr.push({ location: loc, line });
+ }
+
+ function walk(d) {
+ let entries;
+ try { entries = fs.readdirSync(d, { withFileTypes: true }); }
+ catch { return; }
+ for (const entry of entries) {
+ if (entry.name.startsWith('.') || SKIP_DIRS.has(entry.name)) continue;
+ const full = path.join(d, entry.name);
+ if (entry.isDirectory()) walk(full);
+ else if (SCAN_EXT.test(entry.name)) {
+ let content;
+ try { content = fs.readFileSync(full, 'utf-8'); }
+ catch { continue; }
+ for (const { re, algs } of rules.sourcePatterns) {
+ re.lastIndex = 0;
+ let m;
+ while ((m = re.exec(content)) !== null) {
+ const line = content.slice(0, m.index).split('\n').length;
+ for (const a of algs) {
+ const name = a.replace(/\$(\d+)/g, (_, i) => m[i]);
+ addOcc(name, full, line);
+ }
+ }
+ }
+ }
+ }
+ }
+ walk(root);
+ return found;
+}
+
+function toCycloneDX(algorithms) {
+ return {
+ bomFormat: 'CycloneDX',
+ specVersion: '1.6',
+ version: 1,
+ metadata: {
+ timestamp: new Date().toISOString(),
+ tools: [{ name: 'cbom-scan', version: '0.1.0', vendor: 'FIBEMATE' }],
+ },
+ components: [...algorithms.keys()].sort().map(name => {
+ const meta = lookupMeta(name);
+ const comp = {
+ type: 'cryptographic-asset',
+ name,
+ 'bom-ref': `crypto:${name}`,
+ };
+ if (meta) comp.cryptoProperties = meta;
+ const occ = algorithms.get(name);
+ if (occ && occ.length) comp.evidence = { occurrences: occ };
+ return comp;
+ }),
+ };
+}
+
+function main() {
+ const args = process.argv.slice(2);
+ const dir = args.includes('--dir') ? args[args.indexOf('--dir') + 1] : process.cwd();
+ const outPath = args.includes('--out') ? args[args.indexOf('--out') + 1] : null;
+
+ const deps = loadPackageDeps(dir);
+ const fromDeps = matchDeps(deps, DEFAULT_RULES);
+ const fromSource = scanSource(dir, DEFAULT_RULES);
+
+ // Merge: union of both. Source occurrences override empty array from deps.
+ const merged = new Map();
+ for (const name of fromDeps) merged.set(name, []);
+ for (const [name, occ] of fromSource) merged.set(name, occ);
+
+ const cbom = toCycloneDX(merged);
+ const output = JSON.stringify(cbom, null, 2);
+ if (outPath) {
+ fs.writeFileSync(outPath, output, 'utf-8');
+ console.error(`cbom-scan: wrote ${merged.size} algorithms to ${outPath}`);
+ } else {
+ console.log(output);
+ }
+ process.exit(0);
+}
+
+main();

package/package.json

@@ -0,0 +1,18 @@
+{
+  "name": "cbom-tools",
+  "version": "0.1.0",
+  "description": "Crypto Bill of Materials — scan, diff, report (CycloneDX 1.6 CBOM)",
+  "license": "Apache-2.0",
+  "author": "刘天赫 <research@fibemate.net>",
+  "bin": {
+    "cbom-scan": "./cbom-scan.cjs",
+    "cbom-diff": "./cbom-diff.js"
+  },
+  "files": [
+    "cbom-scan.cjs",
+    "cbom-diff.js",
+    "algo-metadata.json",
+    "README.md",
+    "LICENSE"
+  ]
+}