Post-quantum TLS readiness report
io.moderne.cryptography.pqc.PqcReadinessReportArtifactio.moderne.recipe:rewrite-cryptographyClassifies every Maven and Gradle module by how far it is from post-quantum TLS, joining the module's JDK level with the BouncyCastle artifacts it resolves, and records one row per module per BouncyCastle artifact in a data table. Modules with no BouncyCastle at all get exactly one row, so absence is reported rather than inferred from silence. Direct org.bouncycastle declarations in modules that have a gap are marked. bcutil and everything reachable only through it is pruned from the graph walk: it is an internal support artifact that declares BouncyCastle with version ranges, which would otherwise make the reported versions drift with every patch release. Only BouncyCastle that appears in a resolved dependency graph is seen: jars vendored into the repository and wired up with Gradle fileTree/flatDir or Maven system scope, and BouncyCastle shaded into a fat jar, carry no coordinates and therefore report as no-bc. Modules whose build tool did not run are reported as build-file-not-resolved rather than being dropped, so that gap is visible instead of silent.
Usage
This recipe has no required configuration options. You’ll need the Moderne CLI configured before running the command below.
mod run . --recipe io.moderne.cryptography.pqc.PqcReadinessReportIf the recipe isn’t available locally, install it with:
mod config recipes jar install io.moderne.recipe:rewrite-cryptography:RELEASEOptions
| Name | Type | Description |
|---|---|---|
minimumBctlsVersion | String | The lowest bctls version considered hybrid-capable, compared as the Semver range [version,). Defaults to 1.81, the first release carrying NamedGroup.X25519MLKEM768; 1.80 has only the pure ML-KEM draft codepoints. Raise to 1.84 if the interop stance requires the javax.crypto.KEM based implementation.e.g. 1.84 |
minimumJdkForNativeHybrid | Integer | The lowest JDK level whose JSSE offers hybrid ML-KEM key exchange, per JEP 527. Defaults to 27. e.g. 27 |
minimumJdkForPqcAlgorithms | Integer | The lowest JDK level shipping the ML-KEM and ML-DSA providers, per JEP 496 and JEP 497. TLS is an explicit non-goal of those JEPs, so this level alone does not make TLS post-quantum. Defaults to 24. e.g. 24 |
Data tables
Structured output this recipe can produce.
- PQC readinessPer-module post-quantum TLS readiness derived from the resolved Maven and Gradle dependency models and the `JavaVersion` markers of the module's Java sources. Modules built by tools OpenRewrite does not parse (Bazel, Ant) and BouncyCastle shaded into fat jars are invisible here, so an absent row is not evidence of health.
io.moderne.cryptography.pqc.table.PqcReadinessTable - Cryptography inventoryEvery cryptographic finding this module detects, joined into one sparse table so that a consumer does not have to match the per-detector tables on source location. A row carries the columns of whichever detectors reported at its location and leaves the others empty; the `Finding type` column names those detectors. The per-detector tables (`Cipher inventory`, `PQC readiness`, `TLS configuration inventory`, `TLS named groups inventory`) are still emitted unchanged, and carry the same findings unjoined.
io.moderne.cryptography.table.CryptographyInventoryTable - Source files that had resultsSource files that were modified by the recipe run.
org.openrewrite.table.SourcesFileResults - Source files that had search resultsSearch results that were found during the recipe run.
org.openrewrite.table.SearchResults - Source files that errored on a recipeThe details of all errors produced by a recipe run.
org.openrewrite.table.SourcesFileErrors - Recipe performanceStatistics used in analyzing the performance of recipes.
org.openrewrite.table.RecipeRunStats