Generating Software Bill of Materials from Derivation

I’m looking into generating SPDX and/or CycloneDX spec Software Bill of Materials (SBOM) from Nix derivations. I have a few questions and proposals.

  • Is anyone aware of any work on this already?
  • If there isn’t already tooling on this, I could write some tooling for this but does anyone have any thoughts on the approach to take to pull the right info from derivation/nix environment required for generating an SBOM? Not just from nix-env but from things like nix built containers?
  • This is part of some supply chain security and software factory work as part of the Cloud Native Computing Foundation (CNCF). We would like to work with the Nix community as Nix’s approach to reproducibility, traceability, determinism, etc. is huge for supply chain security. Is anyone interested in collaborating on this?
4 Likes

Related topic

3 Likes

Thanks. Glad to know I’m not the only one trying to solve a similar issue. I ran into the recursive issue when testing some of this out myself. The way I did it was I just dumped all nix package metadata to a json file and then queried it based on the info I was getting from derivations. I think I saw vulnix queries the nix database itself.

My basic approach has been to fetch all derivations through something like:

 nix-store -q --requisites <derivation>

Followed by then getting info about all packages

nix-env -qa --meta --json '.*' > pkgs.json

And then going derivation by derivation and creating a list of all packages and then looking up the metadata of those packages in my pkgs.json. It’s not efficient but has gotten the job done.

Additionally it would be nice to figure out an easy way to also fetch metadata about the NARs in the nix cache as well.

1 Like