The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →sbomnix generates CycloneDX and SPDX software bills of materials (SBOMs) from a Nix flake reference or store path. By default, it inventories runtime dependencies and must build the target to discover them; use --buildtime to inventory build-time dependencies without building the target. For richer nixpkgs metadata, the project recommends using a flake reference rather than a store path.
What sbomnix does
The sbomnix README describes the tool as a utility that generates SBOMs from a Nix flake reference or store path. An SBOM is a machine-readable inventory of software components and their relationships or identifying details. sbomnix is part of a broader repository of Nix supply-chain tools that also includes dependency-graph, vulnerability-scanning, outdated-dependency, and provenance utilities.
As an Amazon Associate I earn from qualifying purchases.
The main documented export formats are CycloneDX JSON and SPDX JSON. The README’s example also produces CSV, which can be convenient for spreadsheet review. Exporting an SBOM records an inventory; it does not, by itself, establish that the components are vulnerability-free or that every component has complete metadata.
Choose an input: flake reference or store path
Use a flake reference when source context matters
A flake reference identifies a target in a flake, for example github:NixOS/nixpkgs/nixos-unstable#wget. This is the recommended choice when you want sbomnix to enrich the SBOM with metadata associated with nixpkgs. For ordinary flake targets, the tool searches the flake lock graph for the pinned nixpkgs source; for NixOS toplevel flakerefs, it uses the evaluated configuration package set. Enrichment can include descriptions, licenses, maintainers, and homepage links. The project documents these rules in its metadata-enrichment guide.
#1 Best Overall
Use a store path when the realized output is your starting point
You can also give sbomnix a store path, such as /nix/store/…, or a result symlink pointing to one. A store path identifies an output but does not say which nixpkgs source produced it. Consequently, sbomnix skips nixpkgs metadata enrichment for store-path targets. The tool can still generate an SBOM, but expect less source-derived descriptive and identification metadata than when using a flake reference.
Runtime versus build-time dependencies
| View | What it represents | Does the target need to be built? | How to select it |
|---|---|---|---|
| Runtime dependencies | Store paths referenced by the built output | Yes. The target must be built so its runtime closure can be determined. | Default |
| Build-time dependencies | Store paths needed to reproduce the derivation’s build, including build tools and compilers | No. Evaluating this closure does not require building the target. | --buildtime |
These inventories answer different questions. Runtime scope is useful when you need to understand what an output brings into an installed or deployed environment. Build-time scope is useful when you need to account for tools and dependencies involved in producing that output. A build-time inventory is not a substitute for a runtime inventory, or vice versa; choose the scope that matches the policy or analysis you need.
Rank #2
Install and generate the SBOM
Nix must be available on your PATH. The documented flake invocation can run sbomnix directly:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
nix run github:tiiuae/sbomnix#sbomnix -- --helpFor a flake target, the README demonstrates writing CycloneDX JSON, SPDX JSON, and CSV outputs:
nix run github:tiiuae/sbomnix#sbomnix -- github:NixOS/nixpkgs/nixos-unstable#wget
--output sbom.cdx.json sbom.spdx.json sbom.csvUse a store path or result symlink in place of the flake reference when that is the input you have. Add --buildtime when you want the derivation’s build-time dependency closure rather than the default runtime view. Check --help for the current command’s available options and output syntax. For direct, non-flake use, the project requires a modern Nix with nix-command and --json-format 1. Developers cloning the repository can enter its development shell with nix develop.
Why metadata may be missing or uncertain
Metadata enrichment depends on the target context
Flake references give sbomnix context from which to select nixpkgs metadata. Store paths do not carry that provenance, so enrichment is skipped for them. If metadata is missing from a store-path SBOM, that does not necessarily mean the underlying package has no metadata in nixpkgs; sbomnix may simply lack the source context needed to associate it.
Names and versions are hints, not proof of identity
For metadata matching, package names, pnames, and versions are lookup hints. The metadata helper accepts a match only when the derivation path (drvPath) or output path (outPath) exactly matches an SBOM component. This helps avoid attaching metadata solely because two packages have similar names.
CPE identifiers may be exact or heuristic
When nixpkgs metadata provides an exact CPE identifier, sbomnix prefers it. Heuristic CPE matching is a fallback and can be disabled. If the CPE dictionary cannot be used, fallback identifiers may be less accurate unless strict dictionary behavior is requested. Treat a heuristic identifier as a possible match, not definitive proof that a component is the named upstream product.
Explicit PURLs have documented limits
The README describes experimental support for an explicit PURL in derivation JSON. When present, a singular meta.identifiers.purl takes precedence over a PURL generated from the package name and version, and is normalized for export. sbomnix does not validate that the explicit PURL truly identifies the package. The documentation also notes a limitation for multi-output or grouped components, so explicit identifiers should not be assumed to resolve every identification edge case.
How sbomnix fits among Nix SBOM tools
There are other Nix-focused approaches, but the available descriptions point to different integration models rather than establishing a universal winner.
nix-sbom-helperis described as tooling for standard Nix and flakes that exposes sbomnix-generated SBOMs as Nix outputs.- Bombon describes generating CycloneDX v1.7 SBOMs for Nix packages.
Choose based on how you want to invoke the generator, which export formats you need, the metadata behavior you require, and whether you need runtime or build-time dependency scope. The cited project descriptions do not provide a comprehensive feature or quality comparison.
Version context
The project’s releases page lists v1.8.0. Its release notes describe a switch by sbomnix and nixgraph to structured Nix data sources, removal of legacy fallback code paths, and improvements to flakeref handling and metadata enrichment, including component-identity lookup and preference for nixpkgs CPE data. The rendered release entry shows “09 Jun 09:02” without a year, so the date should not be read as a particular year. See the sbomnix releases page for the project’s release details.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
