# Generated from the package source. Do not edit.
"""A cryptographic bill of materials, written as facts for the `pqc` module.

A CBOM is a CycloneDX document, version 1.6 or later, whose cryptographic
assets carry `cryptoProperties`. `read` turns one into a `Cbom`, and `programs`
turns that into DKE Python programs, each sized for one run, through
`dke.factwriter`.

WHAT IS WRITTEN, by kind:

- `Algorithm.<a>`, for each cryptographic asset whose `assetType` is
  `algorithm`: `quantum`, "vulnerable" when its `nistQuantumSecurityLevel` is 0
  (the document's own definition: none of NIST's categories is met) and
  "resistant" when it is 1 or more; and `strength`, its
  `classicalSecurityLevel` in bits. Each is written only when the document
  states it, so an algorithm with no quantum level is left unclassified and
  the module names every use of it in `unclassified()`.
- `Use.<u>`, for each `dependsOn` edge from a component that is not a
  cryptographic asset to an algorithm: `system`, the component, and
  `algorithm`, the algorithm. The subject is the two subjects joined by `__`.

`provides` is not a use. CycloneDX says so in the field's own definition: a
component that implements an algorithm does not imply the implementation is in
use. An edge that reaches an algorithm only through another cryptographic
asset, such as a protocol or a certificate, is not read either: the edge does
not say which use of which algorithm it stands for. Both are counted, with
edges to a reference the document does not define, in each program's header
and in `Cbom.skipped`, so what was left out can be seen.

Nothing a CBOM does not hold is written: what each use protects, how long that
must stay protected, how long a system takes to migrate, the plan, the horizon
and the deadlines are the customer's own facts, recorded beside these.

SUBJECTS. Every subject is minted from the document's `bom-ref`s through
`dke.factwriter.Ids`, in sorted order, so the same document gives the same
subjects every time and loading it again revises the same cells. A use that a
later document no longer lists is not removed by loading that document: forget
it in the store.

A store refuses a program larger than a size it is set up with, so the size to
split at is yours to pass, as `FactLoad` describes.

Usage:
    dke-pqc-cbom <cbom.json> --max-bytes N [--source S] [--module M]
                                       print the programs, separated by a line
                                       holding only `# ---`"""

import argparse
import json
import pathlib
import sys
from dataclasses import dataclass, field
from datetime import datetime
from dke.factwriter import FactLoad, Ids
MODULE: ...
SOURCE: ...
FIRST_VERSION: ...

@dataclass
class Algorithm:
    subject: str
    quantum: str | None = None
    strength: int | None = None

@dataclass
class Use:
    subject: str
    system: str
    algorithm: str

@dataclass
class Cbom:
    """What a CBOM states that the module reads, with its subjects minted."""
    serial: str
    stamp: int
    algorithms: list[Algorithm] = field(default_factory=list)
    uses: list[Use] = field(default_factory=list)
    skipped: dict[str, int] = field(default_factory=dict)
    def skip(self, why: str, n: int=1) -> None:
        ...

def read(doc: dict) -> Cbom:
    ...

def programs(cbom: Cbom, *, max_bytes: int, module: str=MODULE, source: str=SOURCE) -> list[str]:
    """The programs that write `cbom`, in the order they run, into a store
    holding the module as `module`, each claim from `source` and none larger
    than `max_bytes`. Each carries the load marker `Load.pqc_cbom_<n>`, so a
    store can tell a load that finished from one that stopped part-way."""
    ...

def main(argv: list[str] | None=None) -> int:
    ...