CYCLONEDX CBOM SPEC
AQRA CBOM Generator.
Automate the generation of comprehensive Cryptographic Bill of Materials (CBOM) aligned with CycloneDX 1.6 specifications. Catalogs every cryptographic algorithm, key size, curve, and certificate across software supply chains.
- CycloneDX 1.6 Standard
- JSON & XML Export Formats
- CI/CD Native Build Gates
Cryptographic Supply Chain
Automated Software Supply Chain Cryptography
Ensure software supply chain transparency, automate compliance with NIST guidelines, and enforce build-time cryptographic quality gates.
CycloneDX 1.6 Formal Standard
Directly outputs standardized CycloneDX CBOM files containing cryptographic asset models, algorithm primitives, execution modes, key lengths, and padding schemes.
- Standardized JSON and XML schema outputs
- Cryptographic property tagging (ciphers, digests, MACs, KEMs)
- Zero proprietary formatting lock-in
Quantum Risk Scoring & Classification
Each identified asset is automatically evaluated against quantum exposure criteria, highlighting RSA-2048, ECDSA P-256, and DH key agreements requiring priority migration.
- Color-coded risk categorization (Critical, High, Medium, Quantum-Safe)
- Harvest Now, Decrypt Later (HNDL) exposure calculations
- NIST ML-KEM and ML-DSA algorithm replacement recommendations
Automated Build Quality Gates
Embeds directly into GitLab CI, GitHub Actions, Jenkins, and Azure DevOps to block pull requests introducing unapproved ciphers or hardcoded private keys.
- Customizable failure thresholds (fail on MD5, SHA-1, DES)
- Inline pull request comments and developer remediation steps
- Container image signing integration via Cosign / Notary
Software Supply Chain Transparency
Traces indirect cryptographic implementations embedded within deep package managers (npm, PyPI, Maven, NuGet, Cargo) back to their source code origins.
- Identifies open-source packages with vulnerable crypto wrappers
- Tracks licensing and maintainer activity for cryptographic modules
- Detects shadowed and conflicting security provider implementations
Executive & Regulatory Compliance
Generates turnkey audit reports proving cryptographic supply chain hygiene to internal auditors and external regulators such as RBI, DORA, and NIS2.
- White House Executive Order 14028 / NSM-10 alignment
- EU Digital Operational Resilience Act (DORA) cryptographic register
- RBI cybersecurity framework compliance exports
Cryptographic Drift Tracking
Compares CBOM snapshots between releases to alert security teams when legacy algorithms reappear or cryptographic posture degrades over time.
- Release-to-release cryptographic diff reporting
- Automated detection of regressed security standards
- Enterprise asset register synchronization
INTEGRATION & FORMAT SPECS
CBOM Pipeline Specifications
Designed for seamless integration into DevSecOps toolchains and air-gapped container build systems.
Supported Standards & Schemas
Outputs strictly compliant schema artifacts ready for downstream ingestion by vulnerability scanners and enterprise asset management systems.
- CycloneDX CBOM: 1.6 JSON and XML schema validation
- SPDX Compatibility: Extended crypto-metadata bridges
- JSON-LD: Linked Data format for enterprise knowledge graphs
- REST & CLI: Headless CLI runner for offline air-gapped CI workers
Supported CI/CD & Registry Systems
Compatible with all self-hosted and on-premise development platforms without outbound network dependencies.
- Platforms: GitLab Self-Managed, GitHub Enterprise, Jenkins, ArgoCD
- Registries: Harbor, JFrog Artifactory, Nexus, Sonatype
- Package Ecosystems: Maven, Gradle, npm, PyPI, Go Modules, NuGet
- Air-Gap Ready: Zero internet dependency during build-time extraction
AUTOMATE CRYPTOGRAPHIC AUDITS
Integrate AQRA CBOM Generator In Your Pipelines
Generate your first automated CycloneDX Cryptographic Bill of Materials and ensure software supply chain post-quantum readiness.