How do i query the nix store for all packages i have built myself

I want to have all store paths that i have built myself and not downloaded from Hydra or other substitutors.

Best would be if i can filter it to only contain packages and not sources, configs or tests.

I would like to submit those to Trustix.

Does the Nix database store the source of an output path (substitute vs. build)? That’s the only place I could imagine sourcing this information from, otherwise any output path is the same.

If this isn’t available, your only bet would be to set up a quick script to hash output paths and compare them with the cache.

Not an expert on nix store, but i think ultimate signature means it was built on your machine:

$ nix path-info -r  --sigs /run/current-system | fgrep ultimate
/nix/store/s0niplml4flh94q36lkdllb87xk4r4ly-etc-lvm.conf                                        ultimate
/nix/store/sb92hx576xlhjz607nz433w3hilljhrl-lightdm.pam                                         ultimate
/nix/store/swc0x2yrmr3pq3j1i0aw62i8h6s0025g-etc-lsb-release                                     ultimate

Fetching all local paths:

$ sqlite3  /nix/var/nix/db/db.sqlite 'SELECT path FROM ValidPaths WHERE ultimate IS NOT NULL;'
1 Like

That seems to be the case; substituted paths are signed by the NixOS cache.

To add a bit of color to it: looking at nix/ at 059ae7f6c4b491d728714207c082a03d94c06744 · NixOS/nix · GitHub ultimate is not mutually exclusive with other signatures (local or remote):

# fetch from cache:
$ nix build -f '<nixpkgs>' lv
$ nix path-info --sigs ./result

# build locally
$ nix build -f '<nixpkgs>' lv --rebuild
$ nix path-info --sigs ./result
/nix/store/0ip5dpkj6lmv2xcixnfkkmxf966vqjz0-lv-4.51     ultimate

Note that up to just signature one more was added: ultimate. Depending on what you’d like to achieve you might need to filter some cases out.

1 Like

yes, that is true

So to get all local built store paths:

nix path-info --all --sigs | fgrep ultimate | awk '{print $1}'

Many config files are less than 1KB, many service files are between 1 and 4KB, everything above is mostly packages and sources.

We can also remove paths with known endings we don’t want.

So here we go:

nix path-info --all --sigs --size | fgrep ultimate | awk '{ if ($2 > 4000) print $1}' | sed -E '/.*\.zip$|.*\.gz$|.*\.tgz$|.*\.bz$|.*\.xz$|.*\.deb$|.*\.conf$|.*\.target$|.*\.socket$|.*\.timer$|.*\.pam$|.*\.json$|.*\.patch$|.*\.service$|.*-etc$|.*-nixos-system.*$|.*-system-units$|.*-user-environment$|.*-etc-environment$|.*-env$/d'

Thank you!