nix-sbom

nix-sbom generates deterministic, output-aware CycloneDX inventories from a single Nix root-manifest evaluation. It keeps build and runtime evidence separate, inventories exact patches, verifies reviewed assertions before emitting VEX, and publishes to Dependency-Track with remote inventory checks.

The repository is standalone. Consumer flakes expose roots with lib.mkSbomRoots; the tool never imports consumer configuration by path.

Build

nix build
nix run .#nix-sbom -- version

Commands

nix-sbom inspect --config config.json
nix-sbom generate --config config.json [--runtime]
nix-sbom validate --config config.json --run-manifest artifacts/sbom/run-manifest.json
nix-sbom publish --config config.json --run-manifest artifacts/sbom/run-manifest.json
nix-sbom cache verify --config config.json
nix-sbom assertions lint --config config.json
nix-sbom advisories fetch --config config.json
nix-sbom advisories private-feed --snapshot advisory-snapshot.json --identities component-identities.json --out vulnerabilities.json
nix-sbom dtrack doctor --config config.json
nix-sbom dtrack plan-reconcile --config config.json --project-id UUID --receipts receipts.json --identities component-identities.json
nix-sbom dtrack reconcile --config config.json --requests reviewed-requests.json
nix-sbom dtrack wait-finding --config config.json --project-id UUID --vulnerability-id CVE-ID
nix-sbom dtrack sync-private-vulns --config config.json --desired vulnerabilities.json

Native dependency graphs

Repository configuration may add native.graphs entries for package-manager graphs generated by the pinned cdxgen package. Each graph declares its project type, repository-relative source path, Dependency-Track project name, and minimum component, dependency-node, and edge counts. Generation fails when the extractor regresses below those reviewed completeness floors.

nix-sbom native generate --config config.json --project-version "$(git rev-parse HEAD)"
nix-sbom native validate --config config.json --run-manifest artifacts/sbom/native-run-manifest.json
nix-sbom native publish --config config.json --run-manifest artifacts/sbom/native-run-manifest.json

Native BOMs retain the package-manager dependency edges and receive a repository/version root plus io.karpfen.nix-sbom:native:graph_id. Publication uses the same verified Dependency-Track upload, historical-version retention, latest-version, and collection-membership path as Nix BOMs.

Generic CycloneDX publication

cyclonedx validate and cyclonedx publish accept a glob of CycloneDX JSON documents from any generator. Each BOM supplies its project identity through metadata.component; publication verifies the complete graph, preserves every historical project version, marks the uploaded version latest, and attaches it to the configured collection without mutating project active state.

The reusable Forgejo workflow lives in karpfen/devices, outside this application repository. It can generate a multi-ecosystem graph with cdxgen or validate and publish SBOM artifacts supplied by a caller, such as cargo-cyclonedx output.

generate, validate, assertion linting, cache verification, and advisory retrieval and matching need no credentials. publish reads the automation key from the configured environment variable. The same least-privilege key may create/update INTERNAL feed entries and collection-project membership when configured; it is not an administrator key. Analysis reconciliation and finding verification use a separate, read-oriented analysis key. Every mutation still requires its repository policy gate and explicit command-line authorization.

See architecture, operations, and migration.