Catalog nix flakes
- Dominant language
- Go
- Stars
- 9.6k
- Forks
- 954
- Avg merge
- 23h 27m
- Merged PRs (30d)
- 48
Description
**What would you like to be added**:
Add support for scanning nix flakes, specifically `flake.lock` + `flake.nix` files to detect packaging information.
**Why is this needed**:
Today syft can detect nix packages that are installed in `/nix/store`. However, if you are attempting to scan a git repo that can be packaged/installed via a flake, this is not detected today. To be clear, it is very typical that flake files reside next to other language-specific files, so it's not that software would not be detected, this is more about being able to detect the specific packaging of the project. Take for instance:
- https://github.com/huggingface/text-embeddings-inference , there are flake.lock/nix files that reside next to Cargo.lock/toml files -- today syft detects this as a rust package.
- https://github.com/serokell/haskell-crypto , there are flake.lock/nix files that reside next to stack.lock/yaml files -- today syft detects this as a haskell package.
**Additional considerations / questions**:
- Should we catalog the original language-package + the nix package in the SBOM? should we pick one over the other? should we merge them into one? There are lots of design questions here that are not answered yet.
- There are also [`flake.lock.license`](https://github.com/rumpelsepp/rtcp/blob/master/flake.lock.license) files that have SPDX copyright and license information associated. This should also be captured.
Contributor guide
Research direction
Start by reviewing the requested flake.lock and flake.nix inputs and how Syft currently detects packages in repositories. Define how the original language package and the flake package should coexist in the SBOM, and whether flake.lock.license metadata is included. Done means repository scans detect the flake packaging with an agreed representation.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- cli, tooling
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100