From 56e74021cbdf620fbcf82e52b93d5750ea53e782 Mon Sep 17 00:00:00 2001 From: m-khan-97 Date: Tue, 4 Aug 2026 18:13:36 +0100 Subject: [PATCH 1/2] Add tooling directory per lead request in Slack Creates the tooling/ home John suggested creating via PR: an index of in-repo tools and community reference tooling, each mapped to the QS entries it operationalises, with contribution steps and an open question on code licensing (CC BY-SA suits documentation, not source). Seeds the index with the incoming QIR/LLVM circuit mapper and pq-audit as reference tooling for QS04 inventory work. --- tooling/README.md | 44 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 44 insertions(+) create mode 100644 tooling/README.md diff --git a/tooling/README.md b/tooling/README.md new file mode 100644 index 0000000..bf50d74 --- /dev/null +++ b/tooling/README.md @@ -0,0 +1,44 @@ +# Tooling + +The in-repo home for tools, proofs of concept, and utilities built and +maintained by the OWASP Quantum Security Project community. + +The boundary with the [awesomelist](../awesomelist/) is build versus link: the +awesomelist curates external resources; this directory holds work the project +community contributes and maintains here. A tool that graduates to its own +repository keeps an index entry below. + +## Index + +| Tool | Status | Maps to | Maintainer | +|---|---|---|---| +| Quantum Readiness Assessment | proposed - markdown-first self-assessment operationalising the migration-surface entries | QS01-QS07 | *open* | +| QIR/LLVM circuit mapper | incoming - analyses LLVM bitcode / `.ll` files and maps quantum gates graphically, built on the QIR Alliance work | QS09 | Gabriel Ambroise (community) | + +Reference tooling developed by community members in their own repositories: + +- [pq-audit](https://github.com/mk-scorpiosec/pq-audit) - cryptographic + inventory across code, cloud/IaC, certificates, network, containers, and web3, + checked against FIPS 203/204/205, with JSON output for pipelines. Relevant to + QS04 (inventory and CBOM). + +## Contributing a tool + +1. Open a thread in `#project-quantum-security` describing the tool, or just + raise the pull request if it is already working. +2. Add a subdirectory under `tooling/` containing the tool and a README that + states: what it does, which QS entries it operationalises, how to run it, and + its maturity (proof of concept, usable, maintained). +3. Add a row to the index above, and state a named maintainer. + +Every tool should declare which Top 10 entries it maps to - the point of this +directory is that the Top 10 stays operational rather than purely descriptive, +which is the charter's Track 1 commitment. + +## Open question: code licensing + +The repository is licensed CC BY-SA 4.0, which suits documentation but is not +designed for source code. Before substantial code lands here, the project leads +may want to designate a standard code license for `tooling/` contents (Apache-2.0 +and MIT are the common OWASP choices), with CC BY-SA continuing to cover +documentation. Flagged for decision rather than assumed. From de8ac4ed1fd702c621cd7ee6b885e9b7de89e3fd Mon Sep 17 00:00:00 2001 From: m-khan-97 Date: Mon, 17 Aug 2026 17:26:37 +0100 Subject: [PATCH 2/2] tooling/: restrict scope to in-repo deliverables per Roy's review Removes the pq-audit external-repository reference and states the scope explicitly: this directory is for tools authored as OWASP Quantum Security Project output and living in this repo, not links to independently maintained external projects, which belong on the awesomelist instead. Addresses the risk Roy flagged directly - that listing an unmaintained external repo here reads as an endorsement or verification the project isn't positioned to give. Also records the sequencing point: general tooling work follows the readiness guides (the assessment in tooling/assessment/), not the other way round. --- tooling/README.md | 40 +++++++++++++++++++++++++--------------- 1 file changed, 25 insertions(+), 15 deletions(-) diff --git a/tooling/README.md b/tooling/README.md index bf50d74..320b91f 100644 --- a/tooling/README.md +++ b/tooling/README.md @@ -1,29 +1,39 @@ # Tooling -The in-repo home for tools, proofs of concept, and utilities built and -maintained by the OWASP Quantum Security Project community. - -The boundary with the [awesomelist](../awesomelist/) is build versus link: the -awesomelist curates external resources; this directory holds work the project -community contributes and maintains here. A tool that graduates to its own -repository keeps an index entry below. +The home for tools that are **OWASP Quantum Security Project deliverables** - +code authored as project output and living in this repository, not a directory +of links to independently maintained external projects. That distinction is +deliberate, per Roy's comment on the PR that opened this directory: this +project does not audit or maintain external repositories, and listing one here +would read as an endorsement or verification the project isn't in a position to +give. Tools built and maintained by the community in their own repositories - +however useful - belong on the [awesomelist](../awesomelist/), which exists +precisely to curate external resources without implying OWASP maintains them. +If you're looking for a tool someone else built, start there. + +**Sequencing:** general tooling work here follows the readiness guides, not the +other way round - the Quantum Readiness Assessment is what makes the Top 10 +operational, and it comes first. This directory exists right now to hold that +assessment and directly-contributed proofs of concept, not as a general tool +marketplace. + +Presence in the index below states a tool's own declared maturity (proof of +concept, usable, maintained) - it is not an OWASP quality certification, and +readers should treat it as such regardless of maturity label. ## Index | Tool | Status | Maps to | Maintainer | |---|---|---|---| | Quantum Readiness Assessment | proposed - markdown-first self-assessment operationalising the migration-surface entries | QS01-QS07 | *open* | -| QIR/LLVM circuit mapper | incoming - analyses LLVM bitcode / `.ll` files and maps quantum gates graphically, built on the QIR Alliance work | QS09 | Gabriel Ambroise (community) | - -Reference tooling developed by community members in their own repositories: - -- [pq-audit](https://github.com/mk-scorpiosec/pq-audit) - cryptographic - inventory across code, cloud/IaC, certificates, network, containers, and web3, - checked against FIPS 203/204/205, with JSON output for pipelines. Relevant to - QS04 (inventory and CBOM). +| QIR/LLVM circuit mapper | incoming - proof of concept to be contributed directly into this repository, analysing LLVM bitcode / `.ll` files and mapping quantum gates graphically, built on the QIR Alliance work | QS09 | Gabriel Ambroise (community) | ## Contributing a tool +Contributing here means contributing the tool's code into this repository (or +formally adopting an existing one into it) - not adding a link to somewhere +else it lives. For a link, use the awesomelist instead. + 1. Open a thread in `#project-quantum-security` describing the tool, or just raise the pull request if it is already working. 2. Add a subdirectory under `tooling/` containing the tool and a README that