Skip to content
pqdoctor

History, diff and CBOM

–history

Section titled “–history”
Terminal window
pqdoctor scan hosts.txt --history pq-history.jsonl --quiet
pqdoctor example.org --history pq-history.jsonl

Appends one scan record per check. ssh and quic records carry "protocol". The file only grows: run it from cron or CI and keep it.

pqdoctor diff

Section titled “pqdoctor diff”
Terminal window
pqdoctor diff last-week.jsonl today.jsonl
Fixed (1)
  api.example.com:443                          notPq (no-mlkem) → pq (pq-preferred)
Regressed (1)
  shop.example.com:443                         pq (pq-preferred) → notPq (pinned-nist)
1 fixed, 1 regressed, 0 changed, 0 added, 0 removed, 40 unchanged

The newest record per target in each file is compared:

  • fixed: not post-quantum before, post-quantum now;
  • regressed: post-quantum before, not now, and it still answers;
  • changed: verdict, cause or group changed otherwise, including a host that stopped answering;
  • added / removed: in only one file.

It exits 1 when anything regressed, so pqdoctor diff base.jsonl new.jsonl || exit 1 fails a CI job on a regression. --json prints the diff as JSON.

CBOM

Section titled “CBOM”
Terminal window
pqdoctor scan hosts.txt --cbom cbom.json
pqdoctor example.org --cbom example.cbom.json

A CycloneDX 1.6 cryptography bill of materials. For each host that answered TLS:

  • a protocol component with the TLS version and cipher suites (the negotiated one, plus those an --audit found);
  • the key exchange group, a hybrid linked to its parts (X25519MLKEM768 → ML-KEM-768 + X25519), and every post-quantum group the survey found;
  • the leaf certificate, its signature algorithm and its public key with its size, when the certificate check ran;
  • NIST quantum security categories and OIDs (the ML-KEM, ML-DSA and SLH-DSA OIDs are NIST CSOR’s).

SSH servers get an ssh protocol component with the key exchange methods offered. Hosts that didn’t answer are listed as skipped in metadata.properties, never guessed. The output is tested against the official CycloneDX 1.6 JSON schema. Flarebox exports the same shape from its history.