{"id":40123198,"url":"https://github.com/scanoss/crypto-finder","last_synced_at":"2026-07-02T14:05:29.825Z","repository":{"id":333460063,"uuid":"1073551545","full_name":"scanoss/crypto-finder","owner":"scanoss","description":null,"archived":false,"fork":false,"pushed_at":"2026-07-02T09:59:13.000Z","size":1692,"stargazers_count":3,"open_issues_count":8,"forks_count":0,"subscribers_count":1,"default_branch":"main","last_synced_at":"2026-07-02T10:27:57.697Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/scanoss.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":"CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":"AGENTS.md","dco":null,"cla":null}},"created_at":"2025-10-10T09:22:01.000Z","updated_at":"2026-07-02T09:58:49.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/scanoss/crypto-finder","commit_stats":null,"previous_names":["scanoss/crypto-finder"],"tags_count":32,"template":false,"template_full_name":null,"purl":"pkg:github/scanoss/crypto-finder","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/scanoss%2Fcrypto-finder","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/scanoss%2Fcrypto-finder/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/scanoss%2Fcrypto-finder/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/scanoss%2Fcrypto-finder/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/scanoss","download_url":"https://codeload.github.com/scanoss/crypto-finder/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/scanoss%2Fcrypto-finder/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":35050094,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-07-02T02:00:06.368Z","response_time":173,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2026-01-19T13:02:48.505Z","updated_at":"2026-07-02T14:05:29.817Z","avatar_url":"https://github.com/scanoss.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Crypto Finder\n\n![GitHub release (latest by date)](https://img.shields.io/github/v/release/scanoss/crypto-finder)\n![License](https://img.shields.io/badge/license-GPL--2.0--only-brightgreen)\n[![Go Version](https://img.shields.io/github/go-mod/go-version/scanoss/crypto-finder)](https://go.dev/)\n\nA powerful CLI tool for detecting cryptographic algorithm usage in source code repositories. Crypto Finder scans codebases using multiple scanning engines (OpenGrep, Semgrep) and outputs results in standardized formats including JSON and CycloneDX CBOM (Cryptography Bill of Materials).\n\n## TL;DR\n\n```bash\n# Configure your API key (one-time setup)\ncrypto-finder configure --api-key YOUR_API_KEY\n\n# Scan a project using remote rulesets\ncrypto-finder scan /path/to/code\n\n# Generate CycloneDX CBOM\ncrypto-finder scan --format cyclonedx --output cbom.json /path/to/code\n```\n\n## Installation\n\n### Prerequisites\n\nBefore you begin, ensure you have the following installed:\n\n- **Go** - version 1.25 or higher (for building from source)\n\n    ```bash\n    # macOS\n    brew install go\n\n    # Linux\n    # Download from https://go.dev/dl/\n    ```\n\n- **OpenGrep** or **Semgrep** - for running scans (included in Docker images)\n\n    ```bash\n    # OpenGrep (recommended)\n    # Download from https://github.com/opengrep/opengrep\n\n    # Semgrep\n    pip install semgrep\n    ```\n\n### Setup\n\n**Option 1: Build from Source**\n\n```bash\ngit clone https://github.com/scanoss/crypto-finder.git\ncd crypto-finder\nmake build\nsudo make install\n```\n\n**Option 2: Go Install**\n\n```bash\ngo install github.com/scanoss/crypto-finder/cmd/crypto-finder@latest\n```\n\n**Option 3: Docker**\n\n```bash\n# Full image with scanners included (recommended)\ndocker pull ghcr.io/scanoss/crypto-finder:latest\n\n# Slim image (bring your own scanner)\ndocker pull ghcr.io/scanoss/crypto-finder:latest-slim\n\n# Deps image (all language toolchains for dependency scanning)\ndocker pull ghcr.io/scanoss/crypto-finder:latest-deps\n```\n\n## Usage\n\n### Basic Scanning\n\n**Scan with remote rulesets (recommended):**\n\n```bash\ncrypto-finder scan /path/to/code\n```\n\n**Scan with local rules:**\n\n```bash\ncrypto-finder scan --no-remote-rules --rules-dir ./rules /path/to/code\n```\n\n**Generate CycloneDX CBOM:**\n\n```bash\ncrypto-finder scan --format cyclonedx --output cbom.json /path/to/code\n```\n\n### Common Use Cases\n\n**CI/CD Integration:**\n\n```bash\n# Fail build if cryptographic assets are detected\ncrypto-finder scan --fail-on-findings /path/to/code\n```\n\n**Custom Rule Combination:**\n\n```bash\n# Combine remote rules with local custom rules\ncrypto-finder scan --rules-dir ./custom-rules /path/to/code\n```\n\n**Force Fresh Rules:**\n\n```bash\n# Bypass cache and force fresh download\ncrypto-finder scan --no-cache /path/to/code\n```\n\n**Format Conversion:**\n\n```bash\n# Convert existing results to CycloneDX\ncrypto-finder convert results.json --output cbom.json\n\n# Or pipe from scan\ncrypto-finder scan /path/to/code | crypto-finder convert --output cbom.json\n```\n\n### Configuration\n\nThe application can be configured via command-line flags, environment variables, or configuration files.\n\n```bash\n# Set API key\ncrypto-finder configure --api-key YOUR_API_KEY\n\n# Set custom API URL\ncrypto-finder configure --api-url https://custom.scanoss.com\n```\n\n**Environment Variables:**\n\n```bash\nexport SCANOSS_API_KEY=your-key\nexport SCANOSS_API_URL=https://custom.scanoss.com\n```\n\n**Project-level configuration** via `scanoss.json`:\n\n```json\n{\n  \"settings\": {\n    \"skip\": {\n      \"patterns\": {\n        \"scanning\": [\"node_modules/\", \"target/\", \"venv/\"]\n      }\n    }\n  }\n}\n```\n\nFor detailed configuration options, see [Configuration Documentation](docs/CONFIGURATION.md).\n\n### Command Line Arguments\n\n```bash\ncrypto-finder scan [flags] \u003ctarget\u003e\n```\n\n**Common options:**\n\n- `--rules \u003cfile\u003e` - Custom rule file (repeatable)\n- `--rules-dir \u003cdir\u003e` - Rule directory (repeatable)\n- `--no-remote-rules` - Disable remote ruleset fetching\n- `--no-cache` - Force fresh download, bypass cache\n- `--scanner \u003cname\u003e` - Scanner to use: `opengrep` (default), `semgrep`\n- `--format \u003cformat\u003e` - Output format: `json` (default), `cyclonedx`\n- `--output \u003cfile\u003e` - Output file path (default: stdout)\n- `--languages \u003clangs\u003e` - Override language detection (comma-separated)\n- `--fail-on-findings` - Exit with error if findings detected\n- `--timeout \u003cduration\u003e` - Scan timeout (default: 10m)\n- `--scan-dependencies` - Scan third-party dependencies for cryptographic usage (requires deps image or local toolchains)\n- `--export-callgraph` - Export call graph to JSON for debugging\n- `--java-jdk-major \u003cmajor\u003e` - Java JDK major for Java dependency resolution/type enrichment: `auto`, `8`, `11`, `17`, `21`\n- `--java-jdk-home \u003cmajor=path\u003e` - Java JDK home mapping for explicit Java runtime selection (repeatable)\n- `--interfile` - Enable cross-file analysis (Semgrep Pro only)\n- `--verbose`, `-v` - Enable verbose logging\n- `--help` - Display help information\n\nFor a complete list of commands and options, run `crypto-finder --help`.\n\n## Advanced Topics\n\n### Features\n\n- **Multi-Scanner Support** - OpenGrep (default) and Semgrep with advanced taint analysis\n- **Remote Rulesets** - Automatically fetch curated rules from SCANOSS API with local caching\n- **Flexible Configuration** - Combine remote and local rules, configure via CLI, env vars, or config files\n- **Multiple Output Formats** - Interim JSON and CycloneDX 1.6 CBOM formats\n- **CI/CD Ready** - Docker images for GitHub Actions, GitLab CI, Jenkins, and more\n- **Dependency Scanning** - Detect cryptographic usage in third-party dependencies with call chain tracing (Go, Java via Maven/Gradle, Python, Rust)\n- **Smart Caching** - TTL-based cache with automatic stale cache fallback (opt-out with `--strict`)\n\n### Documentation\n\n- **[Remote Rulesets](docs/REMOTE_RULESETS.md)** - API configuration, caching strategies, and troubleshooting\n- **[Output Formats](docs/OUTPUT_FORMATS.md)** - Interim JSON and CycloneDX CBOM format specifications\n- **[Docker Usage](docs/DOCKER_USAGE.md)** - Container usage and CI/CD integration examples\n- **[Dependency Scanning](docs/DEPENDENCY_SCANNING.md)** - Scanning third-party dependencies for cryptographic usage\n- **[Configuration](docs/CONFIGURATION.md)** - Detailed configuration guide and skip patterns\n\n## Contributing\n\nWe welcome contributions! For more details, see [CONTRIBUTING.md](CONTRIBUTING.md) and our [Code of Conduct](CODE_OF_CONDUCT.md).\n\n### Quick Start\n\n1. Fork the repository\n2. Create a feature branch (`git checkout -b feature/amazing-feature`)\n3. Make your changes\n4. Run tests (`make test`)\n5. Install pinned linter (`make lint-install`)\n6. Run linter (`make lint`)\n7. Commit your changes (`git commit -m 'feat: add an amazing feature'`)\n8. Push to the branch (`git push origin feature/amazing-feature`)\n9. Open a Pull Request\n\n## Changelog\n\nSee [CHANGELOG.md](CHANGELOG.md) for a detailed history of changes.\n\n## License\n\nCopyright (C) 2026 SCANOSS.COM\n\nThis program is free software; you can redistribute it and/or modify it under the terms of the **GNU General Public License version 2** as published by the Free Software Foundation.\n\nThis program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the [LICENSE](LICENSE) file for the full license text.\n\n**SPDX-License-Identifier:** GPL-2.0-only\n\n## Links\n\n- [SCANOSS Website](https://www.scanoss.com)\n- [SCANOSS Documentation](https://scanoss.readthedocs.io)\n- [SCANOSS Settings Schema](https://scanoss.readthedocs.io/projects/scanoss-py/en/latest/scanoss_settings_schema.html)\n- [Issue Tracker](https://github.com/scanoss/crypto-finder/issues)\n\n## Support\n\nFor questions, issues, or feature requests, please use the [GitHub Issues](https://github.com/scanoss/crypto-finder/issues) page.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fscanoss%2Fcrypto-finder","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fscanoss%2Fcrypto-finder","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fscanoss%2Fcrypto-finder/lists"}