cbom-tools 0.2.2 → 0.2.4
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +10 -0
- package/algorithm-hierarchy.cjs +28 -0
- package/package.json +2 -1
package/README.md
CHANGED
|
@@ -8,6 +8,16 @@ detect algorithm additions, removals, and metadata changes.
|
|
|
8
8
|
|
|
9
9
|
Zero external dependencies. Pure Node.js.
|
|
10
10
|
|
|
11
|
+
## What this tool does not do
|
|
12
|
+
|
|
13
|
+
Three things that are easy to misread:
|
|
14
|
+
|
|
15
|
+
- **It does not find vulnerabilities.** No CVE lookup, no taint analysis, no judgement about whether an algorithm choice is sound. It reports *where cryptographic APIs are called*, and says nothing about whether they are called well.
|
|
16
|
+
- **It does not guarantee a complete inventory.** Detection is pattern-based per language and library. A clean scan means "no match against the patterns this version knows" — not "there is no cryptography here". Dynamic loading, generated code, native bindings and vendored binaries can all be missed. The CBOM is evidence of what was found, not a certificate of what exists.
|
|
17
|
+
- **It does not execute the code it scans.** Files are read and parsed. Nothing in the scanned tree is run.
|
|
18
|
+
|
|
19
|
+
A CBOM is an inventory to review. It is not a compliance conclusion, and it cannot replace an audit.
|
|
20
|
+
|
|
11
21
|
## Try it without installing
|
|
12
22
|
|
|
13
23
|
```
|
|
@@ -0,0 +1,28 @@
|
|
|
1
|
+
// SPDX-License-Identifier: Apache-2.0
|
|
2
|
+
// Copyright (c) 2026 刘天赫
|
|
3
|
+
//
|
|
4
|
+
// algorithm-hierarchy.cjs — algorithm family / parameter-set lookup.
|
|
5
|
+
// Used by cbom-scan.cjs for provenance dedup and confidence scoring.
|
|
6
|
+
|
|
7
|
+
const HIERARCHY = {
|
|
8
|
+
'ML-DSA-44': { family: 'ML-DSA', params: '44' },
|
|
9
|
+
'ML-DSA-65': { family: 'ML-DSA', params: '65' },
|
|
10
|
+
'ML-DSA-87': { family: 'ML-DSA', params: '87' },
|
|
11
|
+
'ML-DSA': { family: 'ML-DSA', params: null },
|
|
12
|
+
'ML-KEM-512': { family: 'ML-KEM', params: '512' },
|
|
13
|
+
'ML-KEM-768': { family: 'ML-KEM', params: '768' },
|
|
14
|
+
'ML-KEM-1024': { family: 'ML-KEM', params: '1024' },
|
|
15
|
+
'ML-KEM': { family: 'ML-KEM', params: null },
|
|
16
|
+
'Keccak-224': { family: 'Keccak', params: '224' },
|
|
17
|
+
'Keccak-256': { family: 'Keccak', params: '256' },
|
|
18
|
+
'Keccak-384': { family: 'Keccak', params: '384' },
|
|
19
|
+
'Keccak-512': { family: 'Keccak', params: '512' },
|
|
20
|
+
'Keccak': { family: 'Keccak', params: null },
|
|
21
|
+
'SLH-DSA': { family: 'SLH-DSA', params: null },
|
|
22
|
+
};
|
|
23
|
+
|
|
24
|
+
function lookup(name) {
|
|
25
|
+
return HIERARCHY[name] || null;
|
|
26
|
+
}
|
|
27
|
+
|
|
28
|
+
module.exports = { HIERARCHY, lookup };
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "cbom-tools",
|
|
3
|
-
"version": "0.2.
|
|
3
|
+
"version": "0.2.4",
|
|
4
4
|
"description": "Crypto Bill of Materials — scan, diff, report (CycloneDX 1.6 CBOM)",
|
|
5
5
|
"license": "Apache-2.0",
|
|
6
6
|
"author": "刘天赫 <research@fibemate.net>",
|
|
@@ -31,6 +31,7 @@
|
|
|
31
31
|
},
|
|
32
32
|
"files": [
|
|
33
33
|
"cli.cjs",
|
|
34
|
+
"algorithm-hierarchy.cjs",
|
|
34
35
|
"cbom-scan.cjs",
|
|
35
36
|
"cbom-diff.js",
|
|
36
37
|
"algo-metadata.json",
|