A CLI tool (and HTML viewer) for analyzing Go projects using callgraph to detect the usage of cryptographic algorithms from golang.org/x/crypto.

go mod tidy
go build -o fips-analyzer

or

make all

to populate bin/.

Analyze all packages in a directory:

./fips-analyzer -source /path/to/source/code

Build the syntax tree from only files matching certain patterns (comma-separated):

./fips-analyzer -source /path/to/source/code -patterns main.go,foo.go

By default, all discovered init functions are loaded into the call graph. You can disable this with:

./fips-analyzer -source /path/to/source/code -init-all=false

To include call tree information in the output (may increase computation time):

./fips-analyzer -source /path/to/source/code -call-tree

You can also control the maximum call tree depth (default: 10):

./fips-analyzer -source /path/to/source/code -call-tree -call-tree-depth 5

Export results to a JSON file:

./fips-analyzer -source /path/to/source/code -output results.json

Get detailed information about detected usages:

./fips-analyzer -source /path/to/source/code -verbose