Skip to main content

cryptarium

Cryptographic discovery and CBOM generation for the post-quantum transition. A Go-based CLI that scans a local path or public HTTPS git URL, inventoring cryptography across four evidence sources and emitting a CycloneDX CBOM, SARIF, and a prioritized migration report.

Source

Rule-pack detection over parsed source (tree-sitter).

Dependencies

Go go.mod against a known-library catalog (v0.2).

Certificates

X.509 / PKCS#12 metadata — algorithm, size, curve, validity.

Configuration

nginx TLS suites, SSH algorithms, JWT alg.
Unlike single-source scanners, it correlates all four evidence sources so a finding is a linked picture, not four disconnected lists.

At a glance

Install

go install, GitHub Releases, or build from source.

Quickstart

Scan a repo and read your first migration report.

CI & workflows

Gate CI/GitOps pipelines and feed agents with SARIF, CBOM, and JSON.
Status: v0.3.0: deep C/C++ rule packs (OpenSSL, libsodium, mbedTLS, Crypto++, Botan); embedded defaults + public HTTPS remote scan. Core detectors, correlation, scoring, CBOM/SARIF, and the GitHub Action ship on tagged releases. Interfaces may still evolve before 1.0.