Metadata-Version: 2.4
Name: qorescan
Version: 0.1.0
Summary: QoreScan Community: cryptographic inventory (CycloneDX 1.6 CBOM) of a QoreChain deployment. Downloads the matching qorescan release binary and verifies its SHA-256 before running it.
Author: QoreChain Association
License-Expression: Apache-2.0
Project-URL: Homepage, https://github.com/qorechain/qorescan
Project-URL: Issues, https://github.com/qorechain/qorescan/issues
Keywords: qorechain,cbom,cyclonedx,cryptography,inventory,post-quantum
Classifier: Programming Language :: Python :: 3
Classifier: Operating System :: MacOS
Classifier: Operating System :: POSIX :: Linux
Classifier: Operating System :: Microsoft :: Windows
Classifier: Topic :: Security :: Cryptography
Requires-Python: >=3.9
Description-Content-Type: text/markdown
License-File: LICENSE
License-File: NOTICE
Dynamic: license-file

# qorescan

Python launcher for [QoreScan Community](https://github.com/qorechain/qorescan): a read-only tool that inventories the cryptography of a QoreChain deployment and writes a CycloneDX 1.6 CBOM.

```bash
pipx run qorescan scan --node-home ~/.qorechain --network mainnet --out cbom.json
pipx run qorescan report --framework dora --cbom cbom.json
```

On first use the package downloads the qorescan release binary for your platform from GitHub, checks its SHA-256 against the digests shipped in this package (`checksums.json`), and caches it. A binary whose digest does not match, after download or later in the cache, is never run. Python 3.9 or later, standard library only.

- `QORESCAN_CACHE_DIR`: cache location (default: the user cache directory).
- `QORESCAN_DOWNLOAD_BASE`: download from a mirror instead; the digest check still applies.

QoreScan output is an inventory aid, not a certification or a legal opinion. Documentation: <https://github.com/qorechain/qorescan>. Apache-2.0.
