Scripting with JSON

Two inputs:

pqdoctor github.com --json > report.json                 # one host, one object
pqdoctor scan hosts.txt --json --quiet > results.jsonl    # one object per line

Note

Match on verdict and causeCode (or cause in scan records). They’re stable. headline and the fix text are for people and can change between versions. Schema: JSON output.

The PowerShell examples were run against real pqdoctor output.

Count verdicts in a scan

PowerShell

Get-Content results.jsonl | ConvertFrom-Json | Group-Object verdict | Select-Object Name, Count

Name    Count
----    -----
noTls13     1
pq          1
notPq       1

jq

jq -s 'group_by(.verdict) | map({verdict: .[0].verdict, count: length})' results.jsonl

List the hosts that aren’t post-quantum, with why

PowerShell

Get-Content results.jsonl | ConvertFrom-Json |
  Where-Object { $_.verdict -notin 'pq', 'pqWithWarning' } |
  Select-Object host, cause, stack

host       cause      stack
----       -----      -----
nginx.org  tls12-only nginx
github.com no-mlkem

jq

jq -r 'select(.verdict != "pq" and .verdict != "pqWithWarning") | [.host, .cause, (.stack // "-")] | @tsv' results.jsonl

Post-quantum share of the hosts that answered

PowerShell

$r = @(Get-Content results.jsonl | ConvertFrom-Json |
  Where-Object { $_.verdict -notin 'unreachable', 'error', 'skipped', 'resolved' })
$pq = @($r | Where-Object { $_.verdict -in 'pq', 'pqWithWarning' }).Count
'{0} of {1} post-quantum ({2:P1})' -f $pq, $r.Count, ($pq / $r.Count)

1 of 3 post-quantum (33.3%)

@(…) keeps a single match countable in Windows PowerShell 5.1.

jq

jq -s 'map(select(.verdict | IN("unreachable","error","skipped","resolved") | not))
       | {answered: length, pq: map(select(.verdict | startswith("pq"))) | length}' results.jsonl

That’s the same “answered TLS” denominator the scan summary uses.

Print the first fix for one host

PowerShell

(Get-Content report.json -Raw | ConvertFrom-Json).fixes[0].snippet

# Go
cfg.CurvePreferences = nil // Go 1.24+ default includes X25519MLKEM768
# OpenSSL-based
Groups = X25519MLKEM768:X25519:prime256v1

jq

jq -r '.fixes[0].snippet // "nothing to fix"' report.json

See every probe’s reply

PowerShell

(Get-Content report.json -Raw | ConvertFrom-Json).probes | Select-Object id, summary

id                summary
--                -------
tls13Classical    TLS 1.3: picked X25519
pqOnly            TLS 1.3: asked to retry with X25519
pqPreference      TLS 1.3: picked X25519
kyberDraft        TLS 1.3: asked to retry with X25519
pqSplit           TLS 1.3: asked to retry with X25519
bigClassicalSplit TLS 1.3: picked X25519
nistOnly          TLS 1.3: picked P-256

jq

jq -r '.probes[] | [.id, .summary] | @tsv' report.json

Export a scan to CSV

PowerShell

Get-Content results.jsonl | ConvertFrom-Json | Export-Csv results.csv -NoTypeInformation

jq

jq -r '[.host, .port, .verdict, .cause, (.group // ""), (.stack // "")] | @csv' results.jsonl > results.csv

Compare two scans

Which hosts changed between last week’s scan and today’s:

$old = @{}; Get-Content last-week.jsonl | ConvertFrom-Json | ForEach-Object { $old["$($_.host):$($_.port)"] = $_.cause }
Get-Content today.jsonl | ConvertFrom-Json | ForEach-Object {
  $k = "$($_.host):$($_.port)"
  if ($old.ContainsKey($k) -and $old[$k] -ne $_.cause) { "$k  $($old[$k]) -> $($_.cause)" }
}

Flarebox does this for you per origin, with fixed and regressed notes and alerts.