Skip to content

pqblocks-cbom

CycloneDX 1.5 CBOM metadata enrichment engine injecting quantum-safe classifications and CNSA 2.0 compliance properties.

Install from GitHub Area Status Python Licence Source

At a glance
Area Migration & readiness
Import import pqblocks_cbom
Command line pqblocks-cbom
Version 0.1.0 (Alpha)
Python >=3.11
Native dependency liboqs
Repository PQBlocks/cbom-enricher
Licence Apache-2.0

What is pqblocks-cbom?

High-throughput CycloneDX 1.5 CBOM metadata enrichment engine injecting quantum-safe classifications and CNSA 2.0 compliance properties.

Install

pip install git+https://github.com/PQBlocks/cbom-enricher

uv add git+https://github.com/PQBlocks/cbom-enricher

PyPI release staged

pqblocks-cbom installs from its GitHub repository while the PyPI release is staged. The import name and API are identical either way.

Native dependency: liboqs

The post-quantum primitives come from liboqs (Open Quantum Safe). The package README explains how the library is located: install notes.

Quickstart

Executed, not just written

This is the quickstart from the package README. It was run against the package source when this page was generated.

quickstart.py
from pqblocks_cbom import CBOMEnricher, CBOMProfile

# Initialize enricher with NSA CNSA 2.0 profile
enricher = CBOMEnricher(CBOMProfile.CNSA20)

sbom = {
    "bomFormat": "CycloneDX",
    "specVersion": "1.5",
    "version": 1,
    "components": [
        {"type": "library", "name": "liboqs", "version": "3.5.7"}
    ]
}

cbom = enricher.enrich_sbom(sbom)
print("Enriched components:", len(cbom["components"]))
print("Injected properties:", [p["name"] for p in cbom["components"][0]["properties"]])

Examples

Runnable scripts in the repository:

Documentation and evidence

Every PQBlocks package ships the same evidence set, so each claim can be checked against tests, sources and measurements.

  • Overview

    What it does, install, usage and API.

  • For AI agents

    Correct imports, pitfalls and rules for coding assistants.

  • Security notes

    What it protects, hostile input, constant-time and audit status.

  • Testing

    Test suites, coverage, vectors and what is not covered.

  • Benchmarks

    Measured performance, including where it loses.

  • Evidence

    Primary sources and the method-to-code map.

  • Verification report

    Self-verification results, defects found and limits.

  • Use cases

    Worked scenarios and when to pick something else.

  • Changelog

    Every release and what changed.

  • pqblocks-agility: Cryptographic Agility Readiness Scoring (CARS) and CI/CD regression firewall for CycloneDX 1.6 CBOM inventories.
  • pqblocks-cnsa-evidence: CNSA 2.0 evidence pack generator for quantum-safe compliance, CBOM generation, and migration scheduling.
  • pqblocks-jwe-audit: High-throughput JSON Web Encryption (JWE) cryptographic policy auditor enforcing CNSA 2.0 and NIST FIPS 203 PQC…
  • pqblocks-lint: Static analysis for Python source that finds classical and post-quantum cryptographic primitives with a source-to-sink…
  • pqblocks-policy: Policy-as-code engine for post-quantum cryptography compliance and CBOM verification.
  • pqblocks-scan: Cryptography inventory scanner: finds classical and post-quantum algorithms in source code or a TLS endpoint and…