ecdat 0.2.0__py3-none-any.whl

ecdat/cli/commands/scan.py

@@ -0,0 +1,228 @@
+"""``ecdat scan`` — run a scan and render/emit the result.
+
+The command module is deliberately thin at import time: Rich, the scanner
+engine, and the renderers are imported inside :func:`run` so that
+``import ecdat.cli`` stays fast and never pulls in UI frameworks.
+"""
+
+from __future__ import annotations
+
+import argparse
+import json
+import sys
+from pathlib import Path
+from typing import TYPE_CHECKING
+
+if TYPE_CHECKING:  # pragma: no cover - typing only
+    from ecdat.services.viewmodel import ScanVM
+    from ecdat_core.models import ScanResult
+
+NAME = "scan"
+
+_FORMATS = ("pretty", "json", "cbom", "summary")
+
+# Most-severe first.  "quantum-safe" is intentionally absent: a quantum-safe
+# finding must never trip --fail-on.
+_SEVERITY = ("critical", "high", "medium", "low")
+
+
+def register(subparsers: "argparse._SubParsersAction") -> None:
+    """Attach the ``scan`` subcommand to *subparsers*."""
+    parser = subparsers.add_parser(
+        "scan",
+        help="Scan a local directory or git repository",
+        description=(
+            "Scan a directory (or an https:// Git repository) for "
+            "cryptographic artefacts and report their post-quantum risk."
+        ),
+    )
+    parser.add_argument(
+        "target",
+        nargs="?",
+        default=".",
+        help="Directory to scan, or a Git URL with --git-url (default: .)",
+    )
+    parser.add_argument(
+        "--git-url",
+        action="store_true",
+        help="Treat TARGET as an https:// Git repository to clone and scan",
+    )
+    parser.add_argument(
+        "-f",
+        "--format",
+        choices=_FORMATS,
+        default="pretty",
+        help="Output format (default: pretty)",
+    )
+    parser.add_argument(
+        "-o",
+        "--output",
+        metavar="DIR",
+        default=None,
+        help="Also write cbom.json and summary.json into DIR",
+    )
+    parser.add_argument(
+        "--fail-on",
+        choices=_SEVERITY,
+        default=None,
+        metavar="LEVEL",
+        help="Exit 1 when a finding is at or above LEVEL "
+        "(critical|high|medium|low); quantum-safe findings never count",
+    )
+    parser.add_argument(
+        "--no-progress",
+        action="store_true",
+        help="Never show the progress spinner",
+    )
+    parser.add_argument(
+        "-q",
+        "--quiet",
+        action="store_true",
+        help="Suppress banner, progress, and status messages",
+    )
+    parser.add_argument(
+        "--limit",
+        type=int,
+        default=15,
+        metavar="N",
+        help="Maximum findings shown in the pretty table (default: 15)",
+    )
+
+
+def run(args) -> int:
+    """Execute a scan for the parsed *args*; return the process exit code.
+
+    Raises:
+        ScanError: Propagated to :func:`ecdat.cli.main`, which maps it to the
+            exit code carried on the exception.  ``BrokenPipeError`` and
+            ``KeyboardInterrupt`` likewise propagate to ``main``.
+    """
+    from rich.text import Text
+
+    from ecdat.services.scanner import classify_target, perform_scan
+    from ecdat.ui.console import make_console
+
+    no_color = True if getattr(args, "no_color", False) else None
+    out_console = make_console(no_color=no_color)
+    err_console = make_console(stderr=True, no_color=no_color)
+
+    quiet = bool(getattr(args, "quiet", False))
+    target = classify_target(args.target, force_git=args.git_url)
+
+    show_progress = (
+        not quiet
+        and not getattr(args, "no_progress", False)
+        and err_console.is_terminal
+    )
+
+    if show_progress:
+        with err_console.status("Scanning \u2026", spinner="dots"):
+            outcome = perform_scan(target, force_git=args.git_url)
+    else:
+        outcome = perform_scan(target, force_git=args.git_url)
+
+    result = outcome.result
+    vm = outcome.vm
+
+    if args.output:
+        _write_outputs(Path(args.output), result, err_console, quiet)
+
+    output_format = args.format
+    if output_format == "json":
+        _emit_json(result.model_dump(mode="json"))
+    elif output_format == "cbom":
+        from ecdat_core.cbom_export import export_cbom
+
+        _emit_json(export_cbom(result))
+    elif output_format == "summary":
+        from ecdat_core.cbom_export import export_summary
+
+        _emit_json(export_summary(result))
+    else:
+        _render_pretty(out_console, vm, limit=args.limit, quiet=quiet)
+
+    if vm.total == 0 and not quiet:
+        err_console.print(
+            Text(
+                f"Warning: no cryptographic artefacts detected in "
+                f"{vm.files_scanned} files.",
+                style="yellow",
+            ),
+        )
+
+    if args.fail_on is not None and _fails_at_or_above(vm, args.fail_on):
+        return 1
+    return 0
+
+
+# ---------------------------------------------------------------------------
+# Output helpers
+# ---------------------------------------------------------------------------
+
+
+def _emit_json(payload: dict) -> None:
+    """Write *payload* as pretty JSON to stdout — the ONLY thing on stdout."""
+    sys.stdout.write(json.dumps(payload, indent=2) + "\n")
+
+
+def _write_outputs(directory: Path, result, err_console, quiet: bool) -> None:
+    """Write ``cbom.json`` and ``summary.json`` into *directory* (UTF-8)."""
+    from ecdat.services.scanner import ScanError
+    from ecdat_core.cbom_export import export_cbom, export_summary
+
+    try:
+        directory.mkdir(parents=True, exist_ok=True)
+    except OSError as exc:
+        raise ScanError(
+            f"Could not create output directory {directory}: {exc}",
+            exit_code=3,
+        ) from exc
+
+    payloads = (
+        ("cbom.json", export_cbom(result)),
+        ("summary.json", export_summary(result)),
+    )
+    for filename, payload in payloads:
+        path = directory / filename
+        try:
+            path.write_text(
+                json.dumps(payload, indent=2, sort_keys=True) + "\n",
+                encoding="utf-8",
+            )
+        except OSError as exc:
+            raise ScanError(
+                f"Could not write {path}: {exc}",
+                exit_code=3,
+            ) from exc
+        if not quiet:
+            err_console.print(f"Wrote {path}")
+
+
+def _render_pretty(
+    console,
+    vm: "ScanVM",
+    *,
+    limit: int,
+    quiet: bool,
+) -> None:
+    """Render the banner (unless quiet) and the scan report to stdout."""
+    from ecdat import __version__
+    from ecdat.ui.banner import render_banner
+    from ecdat.ui.render import scan_report
+
+    if not quiet:
+        console.print(render_banner(version=__version__))
+    console.print(scan_report(vm, limit=limit))
+
+
+def _fails_at_or_above(vm: "ScanVM", level: str) -> bool:
+    """Return ``True`` when any non-quantum-safe finding is at/above *level*."""
+    try:
+        threshold = _SEVERITY.index(level)
+    except ValueError:
+        return False
+    for finding in vm.findings:
+        rank = _SEVERITY.index(finding.risk_level) if finding.risk_level in _SEVERITY else None
+        if rank is not None and rank <= threshold:
+            return True
+    return False

ecdat/cli/commands/version_cmd.py

@@ -0,0 +1,48 @@
+"""``ecdat version`` — version, engine, signature count, Python, and OS.
+
+Also backs the global ``--version`` flag via
+:func:`ecdat.cli.commands.version_cmd.render_version` in
+:mod:`ecdat.cli.parser`.  Everything heavy (the signature knowledge base) is
+imported lazily inside :func:`render_version`.
+"""
+
+from __future__ import annotations
+
+import argparse
+import sys
+
+NAME = "version"
+
+
+def register(subparsers: "argparse._SubParsersAction") -> None:
+    """Attach the ``version`` subcommand to *subparsers*."""
+    subparsers.add_parser(
+        "version",
+        help="Show version, engine, signature count, Python and OS",
+        description=(
+            "Print the ECDAT version line: distribution version, engine "
+            "package, number of loaded signatures, Python version, and OS."
+        ),
+    )
+
+
+def render_version() -> str:
+    """Build the single-line version string (``ecdat <ver> \u00b7 ...``)."""
+    import platform
+
+    from ecdat import __version__
+    from ecdat_core.signature_loader import get_all_signatures
+
+    signature_count = len(get_all_signatures())
+    os_name = platform.system() or "unknown"
+    return (
+        f"ecdat {__version__} \u00b7 engine ecdat_core \u00b7 "
+        f"{signature_count} signatures \u00b7 Python {platform.python_version()} "
+        f"\u00b7 {os_name}"
+    )
+
+
+def run(args) -> int:
+    """Write the version line to stdout; return exit code 0."""
+    sys.stdout.write(render_version() + "\n")
+    return 0

ecdat/cli/parser.py

@@ -0,0 +1,87 @@
+"""Argument parser construction for the ``ecdat`` CLI.
+
+:func:`build_parser` assembles the global options and delegates subcommand
+registration to each module in :mod:`ecdat.cli.commands`.  Importing this
+module must stay cheap: command modules defer heavy imports (Rich, the
+scanner engine) to their ``run()`` functions.
+"""
+
+from __future__ import annotations
+
+import argparse
+import sys
+
+from ecdat.cli.commands import about as about_command
+from ecdat.cli.commands import demo as demo_command
+from ecdat.cli.commands import doctor as doctor_command
+from ecdat.cli.commands import help_cmd as help_command
+from ecdat.cli.commands import scan as scan_command
+from ecdat.cli.commands import version_cmd as version_command
+
+# Command name -> command module.  Every module exposes ``register`` and
+# ``run(args) -> int``; ``run`` is looked up at call time so tests can patch it.
+COMMANDS: dict[str, object] = {
+    scan_command.NAME: scan_command,
+    demo_command.NAME: demo_command,
+    help_command.NAME: help_command,
+    doctor_command.NAME: doctor_command,
+    about_command.NAME: about_command,
+    version_command.NAME: version_command,
+}
+
+
+class _VersionAction(argparse.Action):
+    """Print the full version line to stdout and exit ``0``.
+
+    Deliberately writes to stdout (argparse's built-in version action uses
+    stderr) so ``ecdat --version`` and ``ecdat version`` emit identical,
+    pipe-friendly payloads.  The version renderer is imported lazily so
+    importing this module never pulls in the signature knowledge base.
+    """
+
+    def __init__(self, option_strings, dest, **kwargs):
+        super().__init__(option_strings, dest, nargs=0, **kwargs)
+
+    def __call__(self, parser, namespace, values, option_string=None):
+        from ecdat.cli.commands.version_cmd import render_version
+
+        sys.stdout.write(render_version() + "\n")
+        parser.exit(0)
+
+
+def build_parser() -> argparse.ArgumentParser:
+    """Build the top-level ``ecdat`` argument parser.
+
+    Returns:
+        An :class:`argparse.ArgumentParser` with the global flags
+        (``--version``, ``--no-color``, ``--debug``) and every registered
+        subcommand attached.  The subcommand is optional — a bare ``ecdat``
+        invocation prints the banner and example commands.
+    """
+    parser = argparse.ArgumentParser(
+        prog="ecdat",
+        description="Cryptographic Discovery & Analysis Tool",
+    )
+
+    parser.add_argument(
+        "--version",
+        action=_VersionAction,
+        help="Show version info (engine, signatures, Python, OS) and exit",
+    )
+    parser.add_argument(
+        "--no-color",
+        action="store_true",
+        help="Disable coloured output",
+    )
+    parser.add_argument(
+        "--debug",
+        action="store_true",
+        help="Print tracebacks for unexpected errors",
+    )
+    parser.set_defaults(version=False, no_color=False, debug=False)
+
+    subparsers = parser.add_subparsers(dest="command", metavar="COMMAND")
+    for module in COMMANDS.values():
+        module.register(subparsers)
+
+    return parser

ecdat/demo_project/auth/login.py

@@ -0,0 +1,75 @@
+"""Authentication service for the enterprise SSO gateway.
+
+Handles user login, session token generation, and RSA-based request
+signing for the internal API mesh. This module sits on the critical path
+for every authenticated request — a compromise here cascades to the entire
+platform.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import time
+from typing import Optional
+
+from Crypto.PublicKey import RSA
+from Crypto.Signature import pkcs1_15
+from Crypto.Hash import SHA256
+
+
+# ── RSA key management ──────────────────────────────────────────────
+
+# Legacy deployment: 1024-bit RSA key for internal signing.
+# TODO: migrate to ML-DSA before Q4 security audit.
+_SIGNING_KEY = RSA.generate(1024, b"legacy-seed-do-not-use-in-prod")
+
+
+def load_signing_key() -> object:
+    """Load the RSA private key used for session token signing."""
+    return _SIGNING_KEY
+
+
+def sign_request(payload: bytes) -> bytes:
+    """Sign an API request payload using RSA-PKCS#1 v1.5."""
+    key = load_signing_key()
+    h = SHA256.new(payload)
+    return pkcs1_15.new(key).sign(h)
+
+
+def verify_request(payload: bytes, signature: bytes, pub_key: object) -> bool:
+    """Verify an API request signature against the sender's RSA public key."""
+    h = SHA256.new(payload)
+    try:
+        pkcs1_15.new(pub_key).verify(h, signature)
+        return True
+    except (ValueError, TypeError):
+        return False
+
+
+# ── Session tokens ──────────────────────────────────────────────────
+
+_TOKEN_EXPIRY_SECONDS = 3600
+
+
+def create_session_token(user_id: str, roles: list[str]) -> dict:
+    """Create a signed session token with the given user context."""
+    now = int(time.time())
+    payload = {
+        "sub": user_id,
+        "roles": roles,
+        "iat": now,
+        "exp": now + _TOKEN_EXPIRY_SECONDS,
+    }
+    # Encode and sign
+    payload_bytes = str(payload).encode("utf-8")
+    signature = sign_request(payload_bytes)
+    return {"payload": payload_bytes.hex(), "sig": signature.hex()}
+
+
+def _legacy_hash_password(password: str) -> str:
+    """MD5-based password hashing — kept for legacy credential migration.
+
+    DEPRECATED: This exists only so we can migrate old MD5-stored
+    credentials to bcrypt. Do NOT use for new accounts.
+    """
+    return hashlib.md5(password.encode("utf-8")).hexdigest()

ecdat/demo_project/certs/cert_verify.go

@@ -0,0 +1,81 @@
+// Package certs implements X.509 certificate chain verification and
+// signing for the internal certificate authority.
+//
+// WARNING: This module uses SHA-1 for certificate fingerprinting, which
+// is deprecated due to demonstrated collision attacks. Migrate to SHA-256.
+package certs
+
+import (
+	"crypto/sha1"
+	"crypto/sha256"
+	"crypto/x509"
+	"encoding/hex"
+	"fmt"
+	"io"
+	"os"
+)
+
+// FingerprintSHA1 returns the SHA-1 fingerprint of a DER-encoded
+// certificate. Used by legacy monitoring dashboards.
+//
+// Deprecated: Use FingerprintSHA256 for all new fingerprinting.
+func FingerprintSHA1(derBytes []byte) string {
+	h := sha1.Sum(derBytes)
+	return hex.EncodeToString(h[:])
+}
+
+// FingerprintSHA256 returns the SHA-256 fingerprint of a DER-encoded
+// certificate. This is the recommended replacement for FingerprintSHA1.
+func FingerprintSHA256(derBytes []byte) string {
+	h := sha256.Sum256(derBytes)
+	return hex.EncodeToString(h[:])
+}
+
+// VerifyCertChain verifies that the leaf certificate is signed by one
+// of the trusted roots in the system trust store.
+func VerifyCertChain(leaf *x509.Certificate) error {
+	pool, err := x509.SystemCertPool()
+	if err != nil {
+		return fmt.Errorf("failed to load system cert pool: %w", err)
+	}
+	opts := x509.VerifyOptions{
+		Roots: pool,
+	}
+	_, err = leaf.Verify(opts)
+	return err
+}
+
+// CertFileSHA1Fingerprint reads a PEM/DER certificate file and returns
+// its SHA-1 fingerprint. Kept for backward compat with legacy dashboards.
+//
+// Deprecated: Use CertFileSHA256Fingerprint instead.
+func CertFileSHA1Fingerprint(path string) (string, error) {
+	data, err := os.ReadFile(path)
+	if err != nil {
+		return "", fmt.Errorf("read cert file: %w", err)
+	}
+	h := sha1.Sum(data)
+	return hex.EncodeToString(h[:]), nil
+}
+
+// CertFileSHA256Fingerprint reads a certificate file and returns
+// its SHA-256 fingerprint.
+func CertFileSHA256Fingerprint(path string) (string, error) {
+	data, err := os.ReadFile(path)
+	if err != nil {
+		return "", fmt.Errorf("read cert file: %w", err)
+	}
+	h := sha256.Sum256(data)
+	return hex.EncodeToString(h[:]), nil
+}
+
+// LegacyCAFingerprint returns the SHA-1 fingerprint of a certificate
+// read from a reader. Used by the CA migration tool.
+func LegacyCAFingerprint(r io.Reader) (string, error) {
+	data, err := io.ReadAll(r)
+	if err != nil {
+		return "", err
+	}
+	h := sha1.Sum(data)
+	return hex.EncodeToString(h[:]), nil
+}

ecdat/demo_project/keyexchange/channel.go

@@ -0,0 +1,48 @@
+// Package keyexchange implements Diffie-Hellman key agreement for the
+// secure inter-service communication channel.
+//
+// WARNING: Classic DH with 2048-bit prime is quantum-vulnerable.
+// This module is scheduled for ML-KEM migration before production launch.
+package keyexchange
+
+import (
+	"crypto/dh"
+	"fmt"
+	"math/big"
+)
+
+// Group14 is the 2048-bit MODP group from RFC 3526 (Group 14).
+var Group14 *dh.Group
+
+// DHParams holds the parameters for a Diffie-Hellman key exchange.
+type DHParams struct {
+	Prime     *big.Int
+	Generator int64
+}
+
+// GenerateKeyPair creates a new DH key pair using Group 14.
+// Returns (privateKey, publicKey) as byte slices.
+func GenerateKeyPair() ([]byte, []byte, error) {
+	privKey, err := dh.GenerateKey(Group14)
+	if err != nil {
+		return nil, nil, fmt.Errorf("DH key generation failed: %w", err)
+	}
+	pubKey := Group14.PublicKey(privKey)
+	return privKey, pubKey.Bytes(), nil
+}
+
+// ComputeSharedSecret derives the shared secret from a private key
+// and the peer's public key.
+func ComputeSharedSecret(privKey *dh.PrivateKey, peerPubKey *dh.PublicKey) []byte {
+	return privKey.PublicKey().SharedKey(peerPubKey)
+}
+
+// GenerateDHKey is a convenience wrapper that generates and returns
+// just the private key bytes (useful for single-key contexts).
+func GenerateDHKey() ([]byte, error) {
+	privKey, err := dh.GenerateKey(Group14)
+	if err != nil {
+		return nil, err
+	}
+	return privKey.PublicKey().Bytes(), nil
+}

ecdat/demo_project/legacy/LegacyCrypto.java

@@ -0,0 +1,78 @@
+package com.showcase.legacy;
+
+import javax.crypto.Cipher;
+import javax.crypto.KeyGenerator;
+import javax.crypto.SecretKey;
+import javax.crypto.spec.DESedeKeySpec;
+import java.security.Key;
+import java.security.MessageDigest;
+import java.util.Base64;
+
+/**
+ * Legacy cryptographic utilities — retained for backward compatibility
+ * with old client SDKs that still use 3DES and MD5-based checksums.
+ *
+ * Both algorithms are broken or deprecated and must be replaced:
+ * - 3DES: 112-bit effective key, slow, NIST retired in 2023.
+ * - MD5:  collision attacks demonstrated, unsuitable for security use.
+ */
+public final class LegacyCrypto {
+
+    private static final String DES_EDE_CIPHER = "DESede/ECB/PKCS5Padding";
+
+    private LegacyCrypto() {}
+
+    /**
+     * Encrypt data with Triple DES (3DES).
+     *
+     * @param plaintext data to encrypt
+     * @param keyBytes  24-byte (192-bit) 3DES key
+     * @return Base64-encoded ciphertext
+     */
+    public static String encrypt3DES(String plaintext, byte[] keyBytes)
+            throws Exception {
+        DESedeKeySpec spec = new DESedeKeySpec(keyBytes);
+        Key key = javax.crypto.SecretKeyFactory.getInstance("DESede")
+                .generateSecret(spec);
+
+        Cipher cipher = Cipher.getInstance(DES_EDE_CIPHER);
+        cipher.init(Cipher.ENCRYPT_MODE, key);
+        byte[] ct = cipher.doFinal(plaintext.getBytes("UTF-8"));
+        return Base64.getEncoder().encodeToString(ct);
+    }
+
+    /**
+     * Generate a random 3DES key.
+     */
+    public static SecretKey generate3DESKey() throws Exception {
+        KeyGenerator kg = KeyGenerator.getInstance("DESede");
+        kg.init(168); // 168-bit key, 112-bit effective security
+        return kg.generateKey();
+    }
+
+    /**
+     * Compute an MD5 digest of the input bytes.
+     *
+     * @deprecated Use SHA-256 instead. MD5 has broken collision resistance.
+     */
+    @Deprecated
+    public static String md5Checksum(byte[] data) throws Exception {
+        MessageDigest md = MessageDigest.getInstance("MD5");
+        byte[] digest = md.digest(data);
+        StringBuilder sb = new StringBuilder();
+        for (byte b : digest) {
+            sb.append(String.format("%02x", b));
+        }
+        return sb.toString();
+    }
+
+    /**
+     * Compute an MD5 hash of a string (used by legacy credential store).
+     */
+    @Deprecated
+    public static String legacyCredentialHash(String credential) throws Exception {
+        MessageDigest md = MessageDigest.getInstance("MD5");
+        byte[] raw = md.digest(credential.getBytes("UTF-8"));
+        return Base64.getEncoder().encodeToString(raw);
+    }
+}