Moderne OnlyThis recipe is proprietary to Moderne and runs on the Moderne platform or CLI — it isn’t part of the open-source catalog. Available with a Moderne subscription.
Audit post-quantum TLS readiness of build files
Recipe ID
io.moderne.cryptography.pqc.PqcReadinessAuditArtifact
io.moderne.recipe:rewrite-cryptographyDefinition
Usage
Run this recipe
This recipe has no required configuration options. Users of Moderne can run it via the Moderne CLI.
You will need to have configured the Moderne CLI on your machine before you can run the following command.
shell
mod run . --recipe PqcReadinessAudit
If the recipe is not available locally, then you can install it using:
RELEASE resolves to the newest release and LATEST to the newest build of any kind, including snapshots. Either one lets mod config recipes upgrade pull in later versions without editing this command; a pinned version stays where you put it.
- RELEASE
- LATEST
- Pinned version
mod config recipes jar install io.moderne.recipe:rewrite-cryptography:RELEASE
mod config recipes jar install io.moderne.recipe:rewrite-cryptography:LATEST
mod config recipes jar install io.moderne.recipe:rewrite-cryptography:0.17.0
Data tables
PQC readiness
io.moderne.cryptography.pqc.table.PqcReadinessTablePer-module post-quantum TLS readiness derived from the resolved Maven and Gradle dependency models and the JavaVersion markers of the module's Java sources. Modules built by tools OpenRewrite does not parse (Bazel, Ant) and BouncyCastle shaded into fat jars are invisible here, so an absent row is not evidence of health.
Export after a run
mod study . --last-recipe-run \
--data-table io.moderne.cryptography.pqc.table.PqcReadinessTable
| Column | Description |
|---|---|
| Module | Module identity: the Maven groupId:artifactId of the pom, or the Gradle project name from the GradleProject marker. |
| JDK version | The module's bytecode/source level, the highest of source and target compatibility across the module's JavaVersion markers, or -1 when there are no Java sources or the level is unparseable (toolchain-only builds). |
| JDK created by | Major version of the JDK that compiled the sources, or -1 when unknown. A secondary signal: JSSE capability depends on the runtime JDK, of which the target level is only a lower bound. |
| JDK classification | One of jdk-native-hybrid-capable (JEP 527 hybrid key exchange in JSSE), jdk-pqc-algos-only (JEP 496/497 ML-KEM and ML-DSA providers, TLS an explicit non-goal), jdk-not-pqc, or jdk-level-unknown. |
| Library name | The org.bouncycastle artifactId, e.g. bctls-jdk18on. Empty when the module has no BouncyCastle. bcutil is deliberately absent: it is an internal support artifact declared with version ranges, and its whole subtree is pruned from the graph walk. Maps to AgileSec crypto.library.name. |
| Library version | The resolved version, so that property-, BOM-, parent- and version-catalog-declared versions all appear concrete. Empty when the module has no BouncyCastle. Maps to AgileSec crypto.library.version. |
| Library language | Always Java: the row inventories a JVM module — its JDK level and the BouncyCastle artifacts it resolves. Maps to AgileSec crypto.library.language. |
| BouncyCastle artifact line | The artifact line parsed from the artifactId: jdk18on, jdk15to18, jdk15on, jdk14, lts8on, fips, or empty. Lines carry their own version schemes: jdk15on ends at 1.70, and fips and lts8on are numbered separately from the mainline. |
| BouncyCastle dependency type | direct when the module declares the artifact itself, transitive when it arrives through another dependency, empty on no-BouncyCastle rows. |
| BouncyCastle classification | The module-level TLS bucket, repeated on every row of the module: bctls-hybrid-capable, bctls-too-old, bctls-line-eol, bctls-absent-but-bcprov-present, no-bc, bc-fips-line-needs-separate-assessment, bc-lts-line-needs-separate-assessment, or build-file-not-resolved when the module's build tool never ran so its dependencies were never resolved — a row that must not be read as no-bc. BouncyCastle managed but not consumed (a dependencyManagement pin the module never depends on) is not on the resolved graph and therefore reads as no-bc, as do vendored jars wired up with Gradle fileTree/flatDir or Maven system scope and BouncyCastle shaded into a fat jar, none of which carry coordinates. |
| Code snippet | The resolved coordinate org.bouncycastle:<artifactId>:<version>. Empty on no-BouncyCastle rows. |
| File location | The path of the module's build file relative to the repository root. |
| Start line | 1-based line of the start of the dependency declaration, or -1 for transitive, version-catalog-indirected and no-BouncyCastle rows. |
| Start column | 0-based column of the start of the dependency declaration, or -1 when unavailable. |
| Start offset | 0-based character offset of the start of the dependency declaration, or -1 when unavailable. |
| End line | 1-based line of the end of the dependency declaration, or -1 when unavailable. |
| End column | 0-based column of the end of the dependency declaration, or -1 when unavailable. |
| End offset | 0-based character offset of the end of the dependency declaration, or -1 when unavailable. |
| Repository name | The repository name from Git provenance, e.g. payment-service. Empty when unknown. |
| Scan source | Where the source was scanned from, derived from Git provenance, e.g. GitHub, GitLab, Local Repository. |
| Branch | The branch from Git provenance, e.g. main. Empty when unknown. |
Cryptography inventory
io.moderne.cryptography.table.CryptographyInventoryTableEvery cryptographic finding this module detects, joined into one sparse table so that a consumer does not have to match the per-detector tables on source location. A row carries the columns of whichever detectors reported at its location and leaves the others empty; the Finding type column names those detectors. The per-detector tables (Cipher inventory, PQC readiness, TLS configuration inventory, TLS named groups inventory) are still emitted unchanged, and carry the same findings unjoined.
Export after a run
mod study . --last-recipe-run \
--data-table io.moderne.cryptography.table.CryptographyInventoryTable
| Column | Description |
|---|---|
| Finding type | Which detectors reported at this location, comma-joined in a fixed order when a row joins several: cipher-usage (an insecure algorithm API usage), tls-protocol-config (a TLS protocol version or cipher suite configuration site), tls-named-groups (a TLS key-exchange group configuration site) and module-readiness (a Maven or Gradle module's JDK level and BouncyCastle artifacts). A row's empty columns are those its finding types do not own, not evidence of an absent value. |
| Algorithm name | The canonical algorithm name, e.g. DES, 3DES, RC2, RC4, Blowfish, MD5, SHA1, HMAC-SHA1. Filled on cipher-usage rows. Maps to AgileSec crypto.algorithm.name. |
| Algorithm function | What the algorithm is used for, e.g. Encryption/Decryption, Hashing, MAC/Signing. Filled on cipher-usage rows. |
| Algorithm parameter | Additional parameters captured from the API such as mode of operation, padding, key length or digest length. Empty when not expressed at the call site. |
| Insecure | true or false on cipher-usage rows, according to whether the algorithm is considered cryptographically weak or broken. Empty on every other finding type, which does not assess algorithm strength — an empty value is not false. |
| Protocol name | The protocol family the configuration applies to: TLS, or DTLS for a datagram context. Maps to AgileSec crypto.protocol.name. |
| Protocol versions | Comma-joined protocol version tokens exactly as written at the site, e.g. TLSv1,TLSv1.1,TLSv1.2. Empty when nothing is declared or the value is not statically resolvable. Maps to AgileSec crypto.protocol.version. |
| Protocol cipher suites | Comma-joined cipher suite names exactly as written at the site, e.g. TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256. Filled on cipher-suite configuration sites only. Maps to AgileSec crypto.protocol.ciphers. |
| Protocol kex algorithms | The TLS named groups named at the site, comma-joined in the order they are offered, e.g. x25519,secp256r1. Maps to AgileSec crypto.protocol.kex_algorithms. |
| Library name | The library the finding belongs to: JCA/JCE, BouncyCastle, OpenSSL, .NET Crypto, JSSE, JDK, Spring Boot, or a resolved org.bouncycastle artifactId on module-readiness rows. Maps to AgileSec crypto.library.name. |
| Library version | The resolved library version. Filled on module-readiness rows, where the dependency model makes it concrete; empty on source-level findings, which do not carry one. Maps to AgileSec crypto.library.version. |
| Library language | The language of the source the row was found in: Java, C#, C/C++, Properties or YAML. Maps to AgileSec crypto.library.language. |
| Configuration surface | The protocol or cipher-suite API or configuration key that produced the row, e.g. SSLContext.getInstance, SSLSocket.setEnabledProtocols, SSLParameters.setCipherSuites, jdk.tls.client.protocols, server.ssl.enabled-protocols. Filled on tls-protocol-config rows. |
| Named groups configuration surface | The key-exchange API or configuration key that produced the row, e.g. SSLParameters.setNamedGroups, jdk.tls.namedGroups, AbstractTlsClient.getSupportedGroups, or none (provider default) where a TLS endpoint configures no groups at all. Kept apart from Configuration surface so that a joined row records both what it pins and what it leaves to the provider. |
| TLS configuration classification | How the protocol or cipher-suite configuration is bucketed: allows-legacy, ceiling-below-tls13, ceiling-tls13, modern-floor-tls12, modern-floor-tls13, ambiguous-default, no-explicit-floor, unresolved-value, dtls, ciphers-allow-tls13 or ciphers-block-tls13. See the TLS configuration inventory table for what each bucket means. |
| TLS named groups classification | How the key-exchange group configuration is bucketed: A (no explicit configuration, so the runtime decides), B (explicit groups with no ML-KEM hybrid), C (an ML-KEM hybrid group is configured), B-indeterminate, never-PQC or modifier. See the TLS named groups inventory table for what each bucket means. |
| PQC readiness | Whether hybrid key exchange can negotiate under the protocol configuration at this site: blocked, capable or unknown. Assesses the protocol floor only, so it is filled from tls-protocol-config and stays empty on rows without one; a capable row whose TLS named groups classification is B is still pinned to classical key exchange. |
| Module | Module identity: the Maven groupId:artifactId of the pom, or the Gradle project name from the GradleProject marker. Filled on module-readiness rows. |
| JDK version | The module's bytecode/source level, or -1 when there are no Java sources, the level is unparseable, or the row is not a module-readiness row. |
| JDK created by | Major version of the JDK that compiled the sources, or -1 when unknown or not a module-readiness row. |
| JDK classification | One of jdk-native-hybrid-capable, jdk-pqc-algos-only, jdk-not-pqc or jdk-level-unknown. See the PQC readiness table for what each bucket means. |
| BouncyCastle artifact line | The artifact line parsed from the artifactId: jdk18on, jdk15to18, jdk15on, jdk14, lts8on, fips, or empty. |
| BouncyCastle dependency type | direct when the module declares the artifact itself, transitive when it arrives through another dependency, empty otherwise. |
| BouncyCastle classification | The module-level TLS bucket: bctls-hybrid-capable, bctls-too-old, bctls-line-eol, bctls-absent-but-bcprov-present, no-bc, bc-fips-line-needs-separate-assessment, bc-lts-line-needs-separate-assessment or build-file-not-resolved. See the PQC readiness table for what each bucket means. |
| Code snippet | The source of the detected usage, e.g. Cipher.getInstance("DES"), or the resolved coordinate on a module-readiness row. |
| File location | The path of the source file relative to the repository root. |
| Start line | 1-based line of the start of the finding, or -1 when unavailable. |
| Start column | 0-based column of the start of the finding, or -1 when unavailable. |
| Start offset | 0-based character offset of the start of the finding, or -1 when unavailable. |
| End line | 1-based line of the end of the finding, or -1 when unavailable. |
| End column | 0-based column of the end of the finding, or -1 when unavailable. |
| End offset | 0-based character offset of the end of the finding, or -1 when unavailable. |
| Repository origin | The git remote URL the source was scanned from, e.g. https://github.com/apache/zookeeper.git. Empty when there is no remote. Part of the key rows are joined on: repository names are bare, so this is what tells two same-named repositories in different organizations apart in a cross-repository run. |
| Repository name | The repository name from Git provenance, e.g. payment-service. Empty when unknown. |
| Scan source | Where the source was scanned from, derived from Git provenance, e.g. GitHub, GitLab, Local Repository. |
| Branch | The branch from Git provenance, e.g. main. Empty when unknown. |
Source files that had results
org.openrewrite.table.SourcesFileResultsSource files that were modified by the recipe run.
Export after a run
mod study . --last-recipe-run \
--data-table org.openrewrite.table.SourcesFileResults
| Column | Description |
|---|---|
| Source path before the run | The source path of the file before the run. null when a source file was created during the run. |
| Source path after the run | A recipe may modify the source path. This is the path after the run. null when a source file was deleted during the run. |
| Parent of the recipe that made changes | In a hierarchical recipe, the parent of the recipe that made a change. Empty if this is the root of a hierarchy or if the recipe is not hierarchical at all. |
| Recipe that made changes | The specific recipe that made a change. |
| Estimated time saving | An estimated effort that a developer to fix manually instead of using this recipe, in unit of seconds. |
| Cycle | The recipe cycle in which the change was made. |
Source files that had search results
org.openrewrite.table.SearchResultsSearch results that were found during the recipe run.
Export after a run
mod study . --last-recipe-run \
--data-table org.openrewrite.table.SearchResults
| Column | Description |
|---|---|
| Source path of search result before the run | The source path of the file with the search result markers present. |
| Source path of search result after run the run | A recipe may modify the source path. This is the path after the run. null when a source file was deleted during the run. |
| Result | The trimmed printed tree of the LST element that the marker is attached to. |
| Description | The content of the description of the marker. |
| Recipe that added the search marker | The specific recipe that added the Search marker. |
Source files that errored on a recipe
org.openrewrite.table.SourcesFileErrorsThe details of all errors produced by a recipe run.
Export after a run
mod study . --last-recipe-run \
--data-table org.openrewrite.table.SourcesFileErrors
| Column | Description |
|---|---|
| Source path | The file that failed to parse. |
| Recipe that made changes | The specific recipe that made a change. |
| Stack trace | The stack trace of the failure. |
Recipe performance
org.openrewrite.table.RecipeRunStatsStatistics used in analyzing the performance of recipes.
Export after a run
mod study . --last-recipe-run \
--data-table org.openrewrite.table.RecipeRunStats
| Column | Description |
|---|---|
| The recipe | The recipe whose stats are being measured both individually and cumulatively. |
| Source file count | The number of source files the recipe ran over. |
| Source file changed count | The number of source files which were changed in the recipe run. Includes files created, deleted, and edited. |
| Cumulative scanning time (ns) | The total time spent across the scanning phase of this recipe. |
| Max scanning time (ns) | The max time scanning any one source file. |
| Cumulative edit time (ns) | The total time spent across the editing phase of this recipe. |
| Max edit time (ns) | The max time editing any one source file. |