Scanning NIX packages with Sonatype (Nexus IQ) CLM scan tool

[Pamplemousse]

As far as I can tell, what you are looking for doesn’t exist yet.

---

Brainstorming around this need happened at NixCon in 2022, you can learn about the status of the effort at the time there:

The future of the vulnerability roundups

Hi everyone, I’d like to give a summary on the state of discussion here @ NixCon. Disclaimer: Discussion is still in progress. But I’d like to share at what we have arrived so far to get opinions from the broader community. General thoughts We do not necessarily need to maintain our own scanning engine. There quite a few scanners around e.g., Trivy or Grype. Focus should be on providing data as a software bill of materials (SBOM) in a compatible format like in CycloneDX or SPDX) and make the …

Now, at least, we have moved forward, and have an SBOM generator.

Identifying packages is hard.

As far as I know, we still have a problem with this. It’s unclear to me where we are at with updating the PURL spec to support Nix. The following thread seems relevant Package URL's (purl) for Nix packages.

Then, on paper, one could use any vulnerability scanner out there (Trivy or Grype were mentioned at NixCon2022 for example). Maybe Vulnix can also fill that gap, as @nixinator pointed out.