Software bill of materials
A CycloneDX SBOM is generated and validated in CI on every build.
Enterprise governance & trust
Built to be audited.
Provenance, licensing, and governance for the open-source payments and post-quantum libraries — the evidence a vendor-risk or compliance review needs, in one place.
Provenance
Evidence, not assurances.
Build provenance (SLSA)
The deployed SBOM carries a signed build-provenance attestation. Verify it yourself:
gh attestation verify sbom.cdx.json \ --owner sebastienrousseau
Signed publications
Every article is Sigstore-signed and dated, so a reader can prove authorship and integrity independently.
OpenSSF Scorecard
Supply-chain posture is scored weekly.
Preview
The evidence, applied.
Case study
pain001: automating ISO 20022 payment files
The global MT → MX migration forces every bank and corporate treasury to produce structured pain.001 messages.
Signed article
Quantum Thresholds Are Moving: 10,000-Qubit Shor Risk
Shor’s algorithm may now run on as few as 10,000 qubits. RSA, ECC and the timeline for post-quantum migration are all moving up.
Licensing
Free to use, fork, and audit.
| Library | Scope | License |
|---|---|---|
| pain001 | ISO 20022 pain.001 generation | Apache-2.0 / MIT |
| pacs008 | ISO 20022 pacs.008 FI-to-FI transfer | Apache-2.0 / MIT |
| KyberLib | ML-KEM (CRYSTALS-Kyber, NIST FIPS 203) | Apache-2.0 / MIT |
| BankStatementParser | Structured statement parsing | Apache-2.0 / MIT |
Every library is permissively licensed and runs on your own infrastructure — no proprietary translator between your systems and the clearing network, no vendor lock-in.
Governance
The single-maintainer question, answered honestly.
These libraries are authored and maintained by one person. For regulated adoption that raises a fair bus-factor question, so here is the mitigation, stated plainly rather than hidden:
- Open source, permissively licensed. Apache-2.0 / MIT means your organisation can fork, vendor, and continue maintaining the code independently of the original author.
- Reproducible, signed releases. SBOM, SLSA provenance, and Sigstore signing let you verify exactly what you run.
- Inspectable, not a black box. Every library ships as a reference implementation with tests and documentation.
- Foundation stewardship is the stated direction. The intent for the payments libraries is to pursue neutral stewardship (for example FINOS or the Linux Foundation) to add multi-maintainer redundancy. This is a roadmap intent, not a completed donation.
Recognition
Conferred, not claimed.
Every item below links to a dated, externally verifiable artefact.
- Quantum-Safe Payments: Why the Payments Industry Must Act NowEmerging Payments Association Asia2025-09Contributor, Quantum-Safe Cryptography Working Group
- Quantum-Safe Cryptography Working GroupEmerging Payments Association Asia2025-01Member
- Banking On Quantumsebastienrousseau.com2024-01Author
- Banking On AIsebastienrousseau.com2025-05Author