Support for C/C++ Language and OpenSSL library

.github/workflows/maven-publish.yml

@@ -20,7 +20,7 @@ jobs:
     - name: Set up JDK
       uses: actions/setup-java@v6
       with:
-        java-version: '17'
+        java-version: '21'
         distribution: 'temurin'
     - name: Deploy to GitHub Packages
       run: mvn --batch-mode deploy

.github/workflows/maven.yml

@@ -10,7 +10,6 @@ name: Java CI with Maven
 
 permissions:
   contents: write
-  packages: write
 
 on:
   push:
@@ -23,16 +22,22 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v7
-    - name: Set up JDK 17
+    - name: Set up JDK 21
       uses: actions/setup-java@v6
       with:
-        java-version: '17'
+        java-version: '21'
         distribution: 'temurin'
         cache: maven
     - name: Build with Maven
       run: mvn -B clean package
     - name: Verify analyzer redistribution materials
       run: python3 sonar-cryptography-plugin/src/test/python/verify_analyzer_packaging.py sonar-cryptography-plugin/target/sonar-cryptography-plugin-*.jar
+    - name: Upload JaCoCo coverage reports
+      uses: actions/upload-artifact@v7
+      with:
+        name: "jacoco-coverage-reports"
+        path: "**/target/site/jacoco/"
+        if-no-files-found: warn
     # The build must not write into the source tree. It used to: the mapper
     # module regenerated ciphersuites.json and JsonCipherSuites.java from a live
     # API on every compile. Fail here if that ever comes back.

.github/workflows/update-cipher-suites.yml

@@ -26,10 +26,10 @@ jobs:
     steps:
       - uses: actions/checkout@v7
 
-      - name: Set up JDK 17
+      - name: Set up JDK 21
         uses: actions/setup-java@v6
         with:
-          java-version: '17'
+          java-version: '21'
           distribution: 'temurin'
           cache: maven
 

CLAUDE.md

@@ -0,0 +1,128 @@
+# CLAUDE.md
+
+This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
+
+## Project Overview
+
+This is the **Sonar Cryptography Plugin (CBOMkit-hyperion)** - a SonarQube plugin that detects cryptographic assets in source code and generates Cryptographic Bill of Materials (CBOM) in CycloneDX format. Part of the [CBOMKit](https://github.com/cbomkit) toolset.
+
+**Supported languages/libraries:**
+
+- Java: JCA (100%), BouncyCastle light-weight API (100%)
+- Python: pyca/cryptography (100%)
+- Go: `crypto` standard library (100%, except `crypto/x509`), `golang.org/x/crypto` (partial: `hkdf`, `pbkdf2`, `sha3`)
+- C/C++: OpenSSL (EVP, legacy API, SSL/TLS, PRNG), analyzed via the bundled sonar-cxx plugin
+- C#: `System.Security.Cryptography` - in development, ANTLR-based parser, only engine-verification rules; not for active use
+
+## Build Commands
+
+```bash
+# Build with tests
+mvn clean package
+
+# Build without tests
+mvn clean package -DskipTests
+
+# Build specific module
+mvn clean package -pl java
+
+# Format code (Google Java Format, AOSP style)
+mvn spotless:apply
+
+# Check formatting
+mvn spotless:check
+
+# Check code style
+mvn checkstyle:check
+```
+
+**Cipher-suite data:** `mapper/ciphersuites.json` and the generated
+`mapper/src/main/java/.../ssl/json/JsonCipherSuites.java` are checked into git. The build does
+not touch them. To refresh them from ciphersuite.info, run `mapper/download-cipher-suites.sh`
+and then `mvn -pl mapper spotless:apply`, or trigger the `Update cipher suites` workflow, which
+opens a pull request with the change.
+
+## Testing
+
+```bash
+# Run all tests
+mvn test
+
+# Run tests for specific module
+mvn test -pl java
+mvn test -pl python
+mvn test -pl go
+mvn test -pl cpp
+mvn test -pl csharp
+mvn test -pl mapper
+mvn test -pl engine
+
+# Run specific test class
+mvn test -Dtest=SimpleGuidelineTest
+
+# Run specific test method
+mvn test -Dtest=SimpleGuidelineTest#testBasicAssertion
+```
+
+**Testing Framework:** JUnit 5 + AssertJ + SonarQube Test Fixtures
+
+**Detection rule tests:**
+
+- Extend the `TestBase` of the language module you're testing (`java`, `python`, `go`, `cpp` and `csharp` each have their own at `<module>/src/test/java/com/ibm/plugin/TestBase.java`)
+- Use the verifier for that language: `CheckVerifier` (Java), `PythonCheckVerifier` (Python), `GoVerifier` (Go), `CxxVerifier` (C/C++), `CSharpVerifier` (C#) - the last two live in the module's own test sources
+- Test files (actual code to analyze) go in `src/test/files/`, not `src/test/java/`
+- Implement `asserts()` method to verify detection store values and translated nodes
+
+## Architecture
+
+Multi-module Maven project (Java 21):
+
+```
+sonar-cryptography-plugin/    # Main SonarQube plugin entry point
+├── CryptographyPlugin.java   # Plugin registration
+├── OutputFileJob.java        # CBOM output handler
+engine/                       # Core detection engine
+├── detection/                # DetectionStore, Finding classes
+├── rule/                     # IDetectionRule interface
+├── language/<lang>/          # Per-language ILanguageSupport/ILanguageTranslation (java, python, go, cxx, csharp)
+java/                         # Java language support (JCA, BouncyCastle)
+├── rules/detection/          # Java detection rules
+python/                       # Python language support (pyca/cryptography)
+go/                           # Go language support (crypto stdlib, golang.org/x/crypto)
+├── rules/detection/gocrypto/ # Go detection rules
+cpp/                          # C/C++ language support (OpenSSL, via sonar-cxx)
+├── rules/detection/openssl/  # OpenSSL detection rules
+csharp/                       # C# language support (ANTLR grammar, in development)
+mapper/                       # Translation layer to CBOM model
+├── model/                    # Core data model (Algorithm, Key, Protocol, etc.)
+├── ITranslator.java          # Main translation interface
+enricher/                     # Adds algorithm details to findings
+output/                       # CBOM/CycloneDX generation
+common/                       # Shared utilities
+rules/                        # Shared rule definitions
+bom/                          # Sample CBOM output (bom.json)
+```
+
+**Data flow:** Source code → Language module (AST) → Engine (detection) → Mapper (translation) → Enricher → Output (CBOM)
+
+## Code Style
+
+- **Formatting:** Google Java Format (AOSP style) via Spotless - runs on `mvn package`
+- **License:** Apache 2.0 header required in all Java files (applied by Spotless)
+- **Checkstyle rules:** No unused imports, camelCase lambda params, max 5 boolean operators, private utility constructors, @Override required
+
+## Running with SonarQube
+
+```bash
+docker-compose up  # Starts PostgreSQL + SonarQube
+```
+
+Plugin JAR is built to `sonar-cryptography-plugin/target/` and copied to `.SonarQube/plugins/`.
+
+## Key Documentation
+
+- `docs/LANGUAGE_SUPPORT.md` - Extending for new languages/libraries
+- `docs/DETECTION_RULE_STRUCTURE.md` - Writing detection rules
+- `docs/TROUBLESHOOTING.md` - Testing configuration guide
+- `docs/PERFORMANCE_TESTING.md` - Runtime/heap measurement, including full Keycloak scans
+- `README.md` (Build section) - Adding packages to `sonar-go-to-slang` when Go type resolution fails