sbomnix is a Software Bill of Materials generator designed specifically for the Nix ecosystem.
It accepts Nix flake references, derivations and store paths, determines their dependencies and exports the resulting inventory in standard SBOM formats. The distinction between build-time and runtime dependencies is important in Nix, and sbomnix can work with either. When sufficient Nixpkgs information is available, it also enriches discovered components with metadata rather than limiting the result to package names and dependency relationships. The repository contains several related utilities for investigating Nix software supply chains.
This is free and open source software.
Key Features
- Generates SBOMs from Nix flake references.
- Accepts Nix store paths and result symlinks as targets.
- Produces CycloneDX and SPDX output.
- Can also export package information as CSV.
- Uses runtime dependencies by default.
- Optionally inventories the complete build-time dependency closure.
- Enriches packages with Nixpkgs descriptions, licences, maintainers and homepage information where available.
- Supports Package URL identifiers exposed through Nix derivation metadata.
- Generates CPE identifiers for identified packages.
- Records information about the Nixpkgs metadata source in generated documents.
- nixgraph queries and visualises package dependency graphs.
- vulnxscan demonstrates vulnerability scanning using generated SBOM data.
- nix_outdated identifies outdated dependencies and prioritises them according to dependency impact.
- Includes Repology command-line clients for package and vulnerability information.
- Provides tooling for producing SLSA provenance attestations from Nix flakes and derivations.
Website: github.com/tiiuae/sbomnix
Support:
Developer: Technology Innovation Institute
License: Apache License 2.0
sbomnix is written in Python. Learn Python with our recommended free books and free tutorials.
Related Software
| Software Bills of Materials | |
|---|---|
| Syft | Catalog packages and dependencies in images and filesystems |
| ScanCode Toolkit | Detect licences, copyrights and package metadata in source code |
| ORT | Automate dependency analysis, licence compliance and policy checks |
| SBOM Tool | Create SPDX-compatible component inventories at scale |
| Trivy | Scan containers and filesystems for vulnerabilities and licence issues |
| bom | Create, inspect, transform and validate SPDX manifests |
| CycloneDX CLI | Analyse, merge, convert, sign and validate CycloneDX documents |
| sbomnix | Analyse Nix packages for dependencies, licences and vulnerabilities |
Read our verdict in the software roundup.
 LinuxLinks helps you discover the best free and open source software for Linux. Explore our extensive collection of recommended applications, including alternatives to popular proprietary software.We also publish software reviews, Linux tutorials, hardware reviews, free programming books and articles covering the wider open source community. Browse our Linux resources to discover more. Know a useful free and open source Linux application we haven't covered? Suggest a program for inclusion. Has your software been featured on LinuxLinks? Display one of our Featured on LinuxLinks badges on your website or GitHub README. |
Please read our Comment Policy before commenting.