Skip to content

Commit 496a4da

Browse files
thebenignhackerthebenignhacker
committed
Add examples, contributing guide, and test data
Examples: - GitHub Actions workflow examples - GitLab CI configuration - Sample manifest files for each ecosystem Contributing guide: - Development setup instructions - Code style guidelines - Database contribution process - Pull request requirements Test data: - Sample manifest files for testing - Expected output fixtures
1 parent c2d422d commit 496a4da

6 files changed

Lines changed: 241 additions & 0 deletions

File tree

‎CONTRIBUTING.md‎

Lines changed: 131 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,131 @@
1+
# Contributing to CryptoDeps
2+
3+
Thank you for your interest in contributing to CryptoDeps. This document provides guidelines for contributing to the project.
4+
5+
## Getting Started
6+
7+
### Prerequisites
8+
9+
- Go 1.21 or later
10+
- Git
11+
12+
### Setup
13+
14+
```bash
15+
git clone https://github.com/csnp/qramm-cryptodeps.git
16+
cd qramm-cryptodeps
17+
make deps
18+
make build
19+
make test
20+
```
21+
22+
## Development Workflow
23+
24+
### Running Tests
25+
26+
```bash
27+
# Run all tests
28+
make test
29+
30+
# Run tests without race detector (faster)
31+
make test-short
32+
33+
# View coverage report
34+
make coverage
35+
```
36+
37+
### Code Style
38+
39+
```bash
40+
# Format code
41+
make fmt
42+
43+
# Run linter
44+
make lint
45+
```
46+
47+
## Contributing Code
48+
49+
1. Fork the repository
50+
2. Create a feature branch: `git checkout -b feature/my-feature`
51+
3. Make your changes
52+
4. Run tests: `make test`
53+
5. Run linter: `make lint`
54+
6. Commit with a descriptive message
55+
7. Push and open a Pull Request
56+
57+
### Commit Messages
58+
59+
Use conventional commits:
60+
61+
```
62+
feat: add support for Cargo.toml
63+
fix: correct SHA-384 classification
64+
docs: update installation instructions
65+
test: add tests for npm parser
66+
```
67+
68+
## Contributing Package Data
69+
70+
Help expand the crypto knowledge database by contributing analysis for packages not yet in the database.
71+
72+
### Finding Unknown Packages
73+
74+
```bash
75+
# Scan a project and identify unknown packages
76+
cryptodeps analyze /path/to/project --deep
77+
78+
# Look for "not in database" warnings
79+
```
80+
81+
### Submitting Package Data
82+
83+
1. Analyze the package source code to identify crypto usage
84+
2. Create a YAML entry following the schema in `data/packages/`
85+
3. Submit a Pull Request with the new package data
86+
87+
### Package Entry Format
88+
89+
```yaml
90+
name: "package-name"
91+
ecosystem: "go" # go, npm, pypi, maven
92+
crypto:
93+
- algorithm: "RSA"
94+
type: "asymmetric"
95+
quantumRisk: "vulnerable"
96+
usage: "Key exchange"
97+
file: "crypto.go"
98+
evidence: "Uses crypto/rsa package"
99+
```
100+
101+
## Reporting Issues
102+
103+
### Bug Reports
104+
105+
Include:
106+
- CryptoDeps version (`cryptodeps version`)
107+
- Operating system and architecture
108+
- Steps to reproduce
109+
- Expected vs actual behavior
110+
- Relevant manifest file (sanitized)
111+
112+
### Feature Requests
113+
114+
Describe:
115+
- The problem you're trying to solve
116+
- Your proposed solution
117+
- Alternatives you've considered
118+
119+
## Code of Conduct
120+
121+
Be respectful and constructive. We're all here to improve quantum security.
122+
123+
## License
124+
125+
By contributing, you agree that your contributions will be licensed under the Apache License 2.0.
126+
127+
## Questions
128+
129+
- Open an issue for questions
130+
- Visit [QRAMM.org](https://qramm.org) for quantum readiness resources
131+
- Contact [CSNP](https://csnp.org) for organizational inquiries

‎examples/gitlab-ci.yml‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
# GitLab CI/CD Template for CryptoDeps
2+
# Copy this to your .gitlab-ci.yml or include it as a template
3+
#
4+
# Usage:
5+
# include:
6+
# - remote: 'https://raw.githubusercontent.com/csnp/qramm-cryptodeps/main/examples/gitlab-ci.yml'
7+
#
8+
# Or copy the job directly into your .gitlab-ci.yml
9+
10+
stages:
11+
- security
12+
13+
# Quantum vulnerability scan for dependencies
14+
cryptodeps:
15+
stage: security
16+
image: golang:1.22-alpine
17+
variables:
18+
# Fail threshold: vulnerable, partial, any, none
19+
CRYPTODEPS_FAIL_ON: "vulnerable"
20+
# Output format: table, json, sarif, cbom, markdown
21+
CRYPTODEPS_FORMAT: "table"
22+
before_script:
23+
- go install github.com/csnp/qramm-cryptodeps/cmd/cryptodeps@latest
24+
script:
25+
- cryptodeps analyze . --format $CRYPTODEPS_FORMAT --fail-on $CRYPTODEPS_FAIL_ON
26+
rules:
27+
- if: $CI_PIPELINE_SOURCE == "merge_request_event"
28+
- if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
29+
allow_failure: false
30+
artifacts:
31+
when: always
32+
paths:
33+
- cryptodeps-report.json
34+
reports:
35+
# GitLab doesn't natively support SARIF, but JSON can be parsed
36+
codequality: cryptodeps-report.json
37+
38+
# Optional: Generate SARIF report for external tools
39+
cryptodeps:sarif:
40+
stage: security
41+
image: golang:1.22-alpine
42+
before_script:
43+
- go install github.com/csnp/qramm-cryptodeps/cmd/cryptodeps@latest
44+
script:
45+
- cryptodeps analyze . --format sarif --fail-on none > cryptodeps.sarif
46+
artifacts:
47+
paths:
48+
- cryptodeps.sarif
49+
rules:
50+
- if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
51+
52+
# Optional: Strict mode for production branches
53+
cryptodeps:strict:
54+
stage: security
55+
image: golang:1.22-alpine
56+
before_script:
57+
- go install github.com/csnp/qramm-cryptodeps/cmd/cryptodeps@latest
58+
script:
59+
- cryptodeps analyze . --format table --fail-on partial
60+
rules:
61+
- if: $CI_COMMIT_BRANCH =~ /^release/
62+
- if: $CI_COMMIT_TAG
63+
allow_failure: false

‎testdata/fixtures/go-project/go.mod‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
module github.com/example/crypto-app
2+
3+
go 1.21
4+
5+
require (
6+
github.com/golang-jwt/jwt/v5 v5.2.0
7+
golang.org/x/crypto v0.17.0
8+
github.com/spf13/cobra v1.8.0
9+
)

‎testdata/fixtures/maven-project/pom.xml‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<project xmlns="http://maven.apache.org/POM/4.0.0">
3+
<modelVersion>4.0.0</modelVersion>
4+
<groupId>com.example</groupId>
5+
<artifactId>crypto-app</artifactId>
6+
<version>1.0.0</version>
7+
<dependencies>
8+
<dependency>
9+
<groupId>org.bouncycastle</groupId>
10+
<artifactId>bcprov-jdk18on</artifactId>
11+
<version>1.77</version>
12+
</dependency>
13+
<dependency>
14+
<groupId>io.jsonwebtoken</groupId>
15+
<artifactId>jjwt-api</artifactId>
16+
<version>0.12.3</version>
17+
</dependency>
18+
<dependency>
19+
<groupId>org.springframework</groupId>
20+
<artifactId>spring-core</artifactId>
21+
<version>6.1.0</version>
22+
</dependency>
23+
</dependencies>
24+
</project>

‎testdata/fixtures/npm-project/package.json‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
{
2+
"name": "crypto-app",
3+
"version": "1.0.0",
4+
"dependencies": {
5+
"jsonwebtoken": "^9.0.0",
6+
"bcrypt": "^5.1.0",
7+
"crypto-js": "^4.2.0",
8+
"express": "^4.18.0"
9+
}
10+
}

‎testdata/fixtures/python-project/requirements.txt‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
cryptography==41.0.0
2+
PyJWT==2.8.0
3+
bcrypt==4.1.0
4+
requests==2.31.0

0 commit comments

Comments
 (0)