Sonar Cryptography Plugin (CBOMkit-hyperion)

This repository contains a SonarQube Plugin that detects cryptographic assets
in source code and generates CBOM.
It is part of the CBOMKit toolset.

Table of Contents

• Version compatibility
• Supported languages and libraries
• Installation
• Using
• Example Output
• Build
• Help and troubleshooting
• Contribution Guidelines
• License

Version compatibility

Supported languages and libraries

Installation

Copy the plugin (the JAR file from the latest releases)
to $SONARQUBE_HOME/extensions/plugins and restart
SonarQube (more).

Using

The plugin provides new inventory rules (Cbomkit Cryptography Repository) regarding the use of cryptography for
the supported languages.
If you enable these rules, a source code scan creates a cryptographic inventory by creating a
CBOM with all cryptographic assets and writing
a cbom.json to the scan directory.

Add Cryptography Rules to your Quality Profile

This plugin incorporates rules specifically focused on cryptography.

To generate a Cryptography Bill of Materials (CBOM), it is mandatory to activate at
least one of these cryptography-related rules.

As of the current version, the plugin contains one single rule for creating a cryptographic inventory.
Future updates may introduce additional rules to expand functionality.

Scan Source Code

Now you can follow the SonarQube documentation
to start your first scan.

Visualizing your CBOM

Once you have scanned your source code with the plugin, and obtained a cbom.json file, you can use CBOMkit service to know more about it.
It provides you with general insights about the cryptography used in your source code and its compliance with post-quantum safety.
It also allows you to explore precisely each cryptography asset and its detailed specification, and displays where it appears in your code.

Example Output

The plugin generates a cbom.json file in CycloneDX CBOM format. Here's an example showing detected cryptographic assets:

{
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "version": 1,
  "metadata": {
    "timestamp": "2026-01-20T10:58:39Z",
    "tools": {
      "services": [
        {
          "name": "CBOMkit",
          "provider": { "name": "PQCA" }
        }
      ]
    }
  },
  "components": [
    {
      "name": "SHA256",
      "type": "cryptographic-asset",
      "bom-ref": "0f4f522b-ef99-43b7-9f98-6e83b3b233ca",
      "evidence": {
        "occurrences": [
          {
            "line": 51,
            "location": "src/main/java/com/example/EncryptionConfig.java",
            "additionalContext": "java.security.MessageDigest#getInstance"
          }
        ]
      },
      "cryptoProperties": {
        "oid": "2.16.840.1.101.3.4.2.1",
        "assetType": "algorithm",
        "algorithmProperties": {
          "primitive": "hash",
          "cryptoFunctions": ["digest"],
          "parameterSetIdentifier": "256"
        }
      }
    },
    {
      "name": "AES128-GCM",
      "type": "cryptographic-asset",
      "bom-ref": "e006c3f1-912a-4de5-8399-79bf0f350cb9",
      "evidence": {
        "occurrences": [
          {
            "line": 29,
            "location": "src/main/java/com/example/aes/AESGCM.java",
            "additionalContext": "javax.crypto.Cipher#getInstance"
          }
        ]
      },
      "cryptoProperties": {
        "oid": "2.16.840.1.101.3.4.1",
        "assetType": "algorithm",
        "algorithmProperties": {
          "mode": "gcm",
          "primitive": "ae",
          "cryptoFunctions": ["decrypt"],
          "parameterSetIdentifier": "128"
        }
      }
    },
    {
      "name": "RSA-OAEP",
      "type": "cryptographic-asset",
      "bom-ref": "ff238e09-dd3d-44c4-ad49-34350f1d9cc7",
      "cryptoProperties": {
        "oid": "1.2.840.113549.1.1.7",
        "assetType": "algorithm",
        "algorithmProperties": {
          "mode": "ecb",
          "padding": "oaep",
          "primitive": "pke",
          "parameterSetIdentifier": "2048"
        }
      }
    }
  ],
  "dependencies": [
    {
      "ref": "secret-key-ref",
      "dependsOn": ["AES128-ref"]
    }
  ]
}

The CBOM includes:

• Algorithms: Hash functions, ciphers, key exchange mechanisms with their parameters
• Keys and secrets: Private keys, secret keys, and other cryptographic materials
• Evidence: Source file locations where each asset was detected
• Dependencies: Relationships between cryptographic assets (e.g., a secret key depending on an algorithm)

Build

# Build with tests
mvn clean package

# Build without tests (faster)
mvn clean package -DskipTests

# Build specific module
mvn clean package -pl java

# Format code (Google Java Format, AOSP style)
mvn spotless:apply

# Check formatting
mvn spotless:check

//go:build ignore

package main

import (
    "fmt"
    "go/importer"
    "go/token"
    "os"
    "golang.org/x/tools/go/gcexportdata"
)

func main() {
    fset := token.NewFileSet()
    imp := importer.ForCompiler(fset, "gc", nil)
    pkg, err := imp.Import("crypto/hmac")  // <-- target package
    if err != nil {
        fmt.Fprintf(os.Stderr, "Error importing package: %v\n", err)
        os.Exit(1)
    }
    file, err := os.Create("packages/crypto_hmac.o")  // <-- output file
    if err != nil {
        fmt.Fprintf(os.Stderr, "Error creating file: %v\n", err)
        os.Exit(1)
    }
    defer file.Close()
    // CRITICAL: Pass nil for fset, NOT the fset used for import
    if err := gcexportdata.Write(file, nil, pkg); err != nil {
        fmt.Fprintf(os.Stderr, "Error writing export data: %v\n", err)
        os.Exit(1)
    }
    fmt.Printf("Successfully created package export data for %s\n", pkg.Path())
}

"crypto/hmac": "crypto_hmac.o",

Help and troubleshooting

If you encounter difficulties or unexpected results while installing the plugin with SonarQube, or when trying to scan a repository, please check out our guide Testing your configuration and troubleshooting to run our plugin with step-by-step instructions.

Contribution Guidelines

If you'd like to contribute to Sonar Cryptography Plugin, please take a look at our
contribution guidelines. By participating, you are expected to uphold our code of conduct.

We use GitHub issues for tracking requests and bugs. For questions
start a discussion using GitHub Discussions.

License

Apache License 2.0