anchore / anchore/syft

Catalog nix flakes

Open
#3,951 0 comments 1 reaction 0 assignees View on GitHub
ecosystem:nix enhancement new-cataloger
Dominant language
Go
Stars
9.6k
Forks
954
Avg merge
23h 27m
Merged PRs (30d)
48

Description

**What would you like to be added**:
Add support for scanning nix flakes, specifically `flake.lock` + `flake.nix` files to detect packaging information.

**Why is this needed**:
Today syft can detect nix packages that are installed in `/nix/store`. However, if you are attempting to scan a git repo that can be packaged/installed via a flake, this is not detected today. To be clear, it is very typical that flake files reside next to other language-specific files, so it's not that software would not be detected, this is more about being able to detect the specific packaging of the project. Take for instance:
- https://github.com/huggingface/text-embeddings-inference , there are flake.lock/nix files that reside next to Cargo.lock/toml files -- today syft detects this as a rust package.
- https://github.com/serokell/haskell-crypto , there are flake.lock/nix files that reside next to stack.lock/yaml files -- today syft detects this as a haskell package.

**Additional considerations / questions**:
- Should we catalog the original language-package + the nix package in the SBOM? should we pick one over the other? should we merge them into one? There are lots of design questions here that are not answered yet.
- There are also [`flake.lock.license`](https://github.com/rumpelsepp/rtcp/blob/master/flake.lock.license) files that have SPDX copyright and license information associated. This should also be captured.

Contributor guide

Open the contributing guide

Research direction

Start by reviewing the requested flake.lock and flake.nix inputs and how Syft currently detects packages in repositories. Define how the original language package and the flake package should coexist in the SBOM, and whether flake.lock.license metadata is included. Done means repository scans detect the flake packaging with an agreed representation.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
cli, tooling
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.