breachsafe/qureddy repository overview

⁠QuReddy

Evaluate your harvest-now, decrypt-later risk. QuReddy is a post-quantum cryptography (PQC) readiness scanner for TLS and SSH. It performs a real handshake, classifies the key exchange as quantum-safe, hybrid, or quantum-vulnerable, and emits a CycloneDX 1.7 cryptographic bill of materials (CBOM) for NIST PQC migration and evidence workflows.

You only need Docker. The image is public on Docker Hub and GHCR, runs as an unprivileged user, and bundles a verified OpenSSL 3.5.7 LTS runtime, so no account, login, or local crypto setup is required.

⁠Quick start

  docker run --rm docker.io/breachsafe/qureddy:latest scan tls mozilla.org

Illustrative result:

  ── QuReddy scan: tls://mozilla.org:443 ──
  Future Harvest-Now, Decrypt-Later Risk (HNDL):
    At risk of harvest-now/decrypt-later exposure
  Observed:
    - TLS negotiated X25519  (classical key exchange)
    - Classical certificate-chain issuer signature: sha256WithRSAEncryption
  readiness: quantum_vulnerable

More commands:

  # SSH host-key readiness
  docker run --rm docker.io/breachsafe/qureddy:latest scan ssh github.com

  # Machine-readable CBOM (CycloneDX 1.7)
  docker run --rm docker.io/breachsafe/qureddy:latest scan tls mozilla.org --format cbom

Output formats: --format json, --format jsonl, --format cbom.

⁠Images, tags, and registries

GHCR is the canonical registry; this Docker Hub repository is a byte-identical mirror.

  ghcr.io/breachsafe/qureddy:latest      # canonical
  docker.io/breachsafe/qureddy:latest    # mirror
ghcr.io/breachsafe/qureddy:latest      # canonical
docker.io/breachsafe/qureddy:latest    # mirror

• Multi-architecture: linux/amd64 and linux/arm64.
• Version tags track releases. Pin a @sha256: digest for reproducible deployments.
• In automation, run docker login or pull from GHCR: unauthenticated Docker Hub allows 100 pulls per 6 hours per IP, and GHCR has no equivalent pull-rate limit.

⁠Verify the image

Release images are signed with cosign (keyless, GitHub OIDC):

cosign verify ghcr.io/breachsafe/qureddy:latest \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity-regexp '^https://github.com/BreachSAFE/qureddy/\.github/workflows/'

⁠Runtime

• Python 3.14, OpenSSL 3.5.7 LTS, X25519MLKEM768 hybrid group available
• Non-root (uid 1000)
• Exit codes: 0 success, 2 target scan failure, 3 dependency error, 4 usage error

⁠Links

• Source and documentation: https://github.com/BreachSAFE/qureddy⁠
• Docker and registry guide: https://github.com/BreachSAFE/qureddy/blob/main/docs/how-to/docker.md⁠

License: Apache-2.0