sbomnix – generate Software Bills of Materials for Nix

sbomnix is a Software Bill of Materials generator designed specifically for the Nix ecosystem.

It accepts Nix flake references, derivations and store paths, determines their dependencies and exports the resulting inventory in standard SBOM formats. The distinction between build-time and runtime dependencies is important in Nix, and sbomnix can work with either. When sufficient Nixpkgs information is available, it also enriches discovered components with metadata rather than limiting the result to package names and dependency relationships. The repository contains several related utilities for investigating Nix software supply chains.

This is free and open source software.

Key Features

• Generates SBOMs from Nix flake references.
• Accepts Nix store paths and result symlinks as targets.
• Produces CycloneDX and SPDX output.
• Can also export package information as CSV.
• Uses runtime dependencies by default.
• Optionally inventories the complete build-time dependency closure.
• Enriches packages with Nixpkgs descriptions, licences, maintainers and homepage information where available.
• Supports Package URL identifiers exposed through Nix derivation metadata.
• Generates CPE identifiers for identified packages.
• Records information about the Nixpkgs metadata source in generated documents.
• nixgraph queries and visualises package dependency graphs.
• vulnxscan demonstrates vulnerability scanning using generated SBOM data.
• nix_outdated identifies outdated dependencies and prioritises them according to dependency impact.
• Includes Repology command-line clients for package and vulnerability information.
• Provides tooling for producing SLSA provenance attestations from Nix flakes and derivations.

Website: github.com/tiiuae/sbomnix
Support:
Developer: Technology Innovation Institute
License: Apache License 2.0

sbomnix is written in Python. Learn Python with our recommended free books and free tutorials.

Explore our carefully curated directory of recommended free and open source software, covering every major software category. The directory forms part of our extensive collection of articles for Linux enthusiasts. It includes hundreds of detailed reviews, together with free and open source alternatives to proprietary software from companies such as Google, Microsoft, Apple, Adobe, IBM, Cisco, Oracle, and Autodesk. LinuxLinks also covers interesting projects worth exploring, Linux-compatible hardware, free programming books and tutorials, and much more. Know a useful free and open source Linux application that we haven’t covered? Tell us about it using our submission form.