Replace nix-env metadata scanning with targeted metadata lookup#294
Merged
Conversation
henrirosten
force-pushed
the
sbomnix-package-root-metadata
branch
from
cdc2a4e to
8a86569
Compare
henrirosten
changed the title
henrirosten
force-pushed
the
sbomnix-package-root-metadata
branch
2 times, most recently
from
3626d8a to
13757f3
Compare
Signed-off-by: Henri Rosten <henri.rosten@unikie.com>
Move flake metadata resolution helpers into sbomnix so the SBOM metadata pipeline no longer depends on the nixmeta package. The helper also centralizes local flake reference normalization for current-flake shorthand and path-based flake references. Signed-off-by: Henri Rosten <henri.rosten@unikie.com>
Add the Python and Nix helpers used to evaluate package metadata from package roots and flake package outputs. The lookup request stays compact and the result includes derivation and output identities so callers can reject metadata that does not belong to an SBOM component. Signed-off-by: Henri Rosten <henri.rosten@unikie.com>
Replace the old name-based nixpkgs metadata join with an exact component identity match against derivation and output paths. Cache package-root scans by stable source identity and lookup set, and scan flake input package roots only for components left unmatched by the primary source. Signed-off-by: Henri Rosten <henri.rosten@unikie.com>
Drop --meta-nixpkgs now that metadata enrichment is derived from the flakeref target and its package roots. Store-path targets still skip metadata because they do not identify the nixpkgs source that produced the path; users should use a flakeref target when metadata is required. Signed-off-by: Henri Rosten <henri.rosten@unikie.com>
Remove the standalone nixmeta command, its nix packaging entries, documentation, and tests. sbomnix now uses its own targeted package metadata resolver instead of the legacy nix-env metadata scanner, so the CLI is no longer part of the public tool set. Signed-off-by: Henri Rosten <henri.rosten@unikie.com>
Signed-off-by: Henri Rosten <henri.rosten@unikie.com>
henrirosten
force-pushed
the
sbomnix-package-root-metadata
branch
from
13757f3 to
d831180
Compare
Closed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Replace sbomnix’s old nixpkgs metadata path, which relied on a broad
nix-env -qa --meta --jsonstyle scan, with targeted package metadata lookup.The new path evaluates compact lookup requests against the relevant package roots and only accepts metadata when the returned derivation/output path matches an SBOM component exactly.
This also removes the legacy
nixmetaCLI and its tests, since metadata lookup is now an internal sbomnix implementation detail.Why?
The old nix-env-based scan was hacky, joined metadata too opportunistically by package name+version, and was slow on cold cache. The new approach is faster, more target-aware, and avoids ambiguous/questionable metadata matches.
Notes
This is an intentional behavior change: broad/opportunistic metadata coverage is lower than earlier because sbomnix no longer scans all nixpkgs metadata and avoids questionable metadata matches.
Fixes: #150