sbomnix is a Software Bill of Materials generator designed specifically for the Nix ecosystem.
It accepts Nix flake references, derivations and store paths, determines their dependencies and exports the resulting inventory in standard SBOM formats. The distinction between build-time and runtime dependencies is important in Nix, and sbomnix can work with either. When sufficient Nixpkgs information is available, it also enriches discovered components with metadata rather than limiting the result to package names and dependency relationships. The repository contains several related utilities for investigating Nix software supply chains.
This is free and open source software.
Key Features
- Generates SBOMs from Nix flake references.
- Accepts Nix store paths and result symlinks as targets.
- Produces CycloneDX and SPDX output.
- Can also export package information as CSV.
- Uses runtime dependencies by default.
- Optionally inventories the complete build-time dependency closure.
- Enriches packages with Nixpkgs descriptions, licences, maintainers and homepage information where available.
- Supports Package URL identifiers exposed through Nix derivation metadata.
- Generates CPE identifiers for identified packages.
- Records information about the Nixpkgs metadata source in generated documents.
- nixgraph queries and visualises package dependency graphs.
- vulnxscan demonstrates vulnerability scanning using generated SBOM data.
- nix_outdated identifies outdated dependencies and prioritises them according to dependency impact.
- Includes Repology command-line clients for package and vulnerability information.
- Provides tooling for producing SLSA provenance attestations from Nix flakes and derivations.
Website: github.com/tiiuae/sbomnix
Support:
Developer: Technology Innovation Institute
License: Apache License 2.0
sbomnix is written in Python. Learn Python with our recommended free books and free tutorials.
Related Software
| Software Bills of Materials | |
|---|---|
| Syft | Catalog packages and dependencies in images and filesystems |
| ScanCode Toolkit | Detect licences, copyrights and package metadata in source code |
| ORT | Automate dependency analysis, licence compliance and policy checks |
| SBOM Tool | Create SPDX-compatible component inventories at scale |
| Trivy | Scan containers and filesystems for vulnerabilities and licence issues |
| bom | Create, inspect, transform and validate SPDX manifests |
| CycloneDX CLI | Analyse, merge, convert, sign and validate CycloneDX documents |
| sbomnix | Analyse Nix packages for dependencies, licences and vulnerabilities |
Read our verdict in the software roundup.
 Explore our carefully curated directory of recommended free and open source software, covering every major software category.The directory forms part of our extensive collection of articles for Linux enthusiasts. It includes hundreds of detailed reviews, together with free and open source alternatives to proprietary software from companies such as Google, Microsoft, Apple, Adobe, IBM, Cisco, Oracle, and Autodesk. LinuxLinks also covers interesting projects worth exploring, Linux-compatible hardware, free programming books and tutorials, and much more. Know a useful free and open source Linux application that we haven’t covered? Tell us about it using our submission form. |
Please read our Comment Policy before commenting.