nix-sbom-helper/default.nix at development · cyberus-technology/nix-sbom-helper · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
# SPDX-License-Identifier: Apache-2.0
{ pkgs ? null
, nixpkgs_path ? null
}@args:

let
  inputs =
    let
      lock = builtins.fromJSON (builtins.readFile ./flake.lock);
    in
    {
      # Borrow the Nixpkgs pin from the Flake.
      nixpkgs = builtins.fetchTarball {
        inherit (lock.nodes.nixpkgs.locked)
          url
        ;
        sha256 = lock.nodes.nixpkgs.locked.narHash;
      };
    }
  ;

  pkgs =
    (
      if args ? pkgs && args ? nixpkgs_path then
        builtins.abort "Either one of `pkgs` or `nixpkgs_path` can be given, not both."
      else if args ? pkgs then
        args.pkgs
      else
        import ( args.nixpkgs_path or inputs.nixpkgs ) {}
    ).appendOverlays [(import ./overlay)]
  ;

  # NOTE: This attribute set is exposed directly in the Flake.
  # Only the flake-specific `sbomsForFlakeOutputs` functions are defined in the Flake.
  # (And its usage for checks.)
  self = {
    inherit pkgs;
    overlay = import ./overlay;
    support = {
      inherit (pkgs) mkRegistrationDb buildSbom;
    };

    packages = {
      # NOTE: this is also used to produce SBOMs with autoSbom.
      inherit (pkgs)
        # Re-export `sbomnix`.
        # Allows running the exact `sbomnix` build used here, if needed.
        sbomnix
        # Exported for `sbomsForFlakeOutputs` checks.
        hello
      ;
    };

    # For standard Nix usage checks.
    sbomsForChecks = {
      hello = pkgs.buildSbom { input = pkgs.hello; };
      sbomnix = pkgs.buildSbom { input = pkgs.sbomnix; };
    };

    checks = {
      # Synthetic integration test
      checks = self.pkgs.callPackage ./checks.nix {};

      # Checks cross-compiled packages can be BOM'd
      cross-hello =
        let pkgs = self.pkgs.pkgsCross.aarch64-multiplatform; in
        pkgs.buildSbom { input = pkgs.hello; }
      ;
      cross-sbomnix =
        let pkgs = self.pkgs.pkgsCross.aarch64-multiplatform; in
        pkgs.buildSbom { input = pkgs.sbomnix; }
      ;

      # Trivial SBOMs
      sbom-hello = self.support.buildSbom {
        input = pkgs.hello;
      };
      sbom-hello-multi = self.support.buildSbom {
        name = "hello-multi";
        input = [
          pkgs.hello
          pkgs.hello-cpp
        ];
      };
      sbom-sbomnix = self.support.buildSbom {
        input = pkgs.sbomnix;
      };

      # Checks packages that don't build still can be BOM'd
      broken-build =
        let
          drv = (pkgs.hello.overrideAttrs(_: {
            patchPhase = ''
              echo "fail"
              exit 2
            '';
          }));
        in
        self.support.buildSbom {
          input = pkgs.hello;
        }
      ;
    };
  };
in
self