The existing Nix cataloger looks for directories within **/nix/store and parses the directory names as packages in the form hash-name-version[-outputname]. This PR changes the behavior of the default Nix cataloger used:

• swaps to reading the nix tooling cache database at /nix/var/nix/db/db.sqlite for package existence
• adds relationships between packages (for runtime dependencies only)
• nix derivation details are listed on each nix package (both in the purl and metadata)
• capturing owned files is an option that can be togged on, but is off by default

Package + relationship results from the new DB approach should match that of the results of nix-env -q --tree $(path to bin), so for example:

$ nix-store -q --tree $(which jq)

/nix/store/nzwfgsp28vgxv7n2gl5fxqkca9awh4dz-jq-1.6-bin3.4
├───/nix/store/02mqs1by2vab9yzw0qc4j7463w78p3ps-glibc-2.37-8
│   ├───/nix/store/cw8fpl8r1x9rmaqj55fwbfnnrgw7b40k-libidn2-2.3.4
│   │   ├───/nix/store/h1ysk4vvw48winwmh38rvnsj0dlsz7c1-libunistring-1.1
│   │   │   └───/nix/store/h1ysk4vvw48winwmh38rvnsj0dlsz7c1-libunistring-1.1 [...]
│   │   └───/nix/store/cw8fpl8r1x9rmaqj55fwbfnnrgw7b40k-libidn2-2.3.4 [...]
│   ├───/nix/store/fmz62d844wf4blb11k21f4m0q6n6hdfp-xgcc-12.3.0-libgcc
│   └───/nix/store/02mqs1by2vab9yzw0qc4j7463w78p3ps-glibc-2.37-8 [...]
├───/nix/store/mzj90j6m3c3a1vv8j9pl920f98i2yz9q-oniguruma-6.9.8-lib
│   ├───/nix/store/02mqs1by2vab9yzw0qc4j7463w78p3ps-glibc-2.37-8 [...]
│   └───/nix/store/mzj90j6m3c3a1vv8j9pl920f98i2yz9q-oniguruma-6.9.8-lib [...]
└───/nix/store/1x3s2v9wc9m302cspfqcn2iwar0b5w99-jq-1.6-lib
    ├───/nix/store/02mqs1by2vab9yzw0qc4j7463w78p3ps-glibc-2.37-8 [...]
    ├───/nix/store/mzj90j6m3c3a1vv8j9pl920f98i2yz9q-oniguruma-6.9.8-lib [...]
    └───/nix/store/1x3s2v9wc9m302cspfqcn2iwar0b5w99-jq-1.6-lib [...]

The only difference being that cyclic and self dependencies are pruned.

When the internal nix DB cannot be found then:

• the original directory store-name approach is used instead to find packages
• derivation files are discovered, paired up with output packages, and parsed to discover package runtime relationships (note: this is limited and will only generate a partial graph in most cases).

Each package raised up by any nix cataloger (either the new one or the existing legacy one) has the following details:

{
  "id": "b52daaf120fb1da9",
  "name": "zlib",
  "version": "1.3",
  "type": "nix",
  "foundBy": "nix-cataloger",
  "locations": [
    {
      "path": "/nix/var/nix/db/db.sqlite",
      "layerID": "sha256:2f7c7b1832ba50ba3e3f06dd8815cb83985522ca2cf3d79d2d1d8f818b969435",
      "accessPath": "/nix/var/nix/db/db.sqlite",
      "annotations": {
        "evidence": "primary"
      }
    },
    {
      "path": "/nix/store/4rx3vkkd91wkbhpflsplfga603cp1l1c-zlib-1.3",
      "accessPath": "/nix/store/4rx3vkkd91wkbhpflsplfga603cp1l1c-zlib-1.3",
      "annotations": {
        "evidence": "supporting"
      }
    },
    {
      "path": "/nix/store/q9jf8xl1gsfmx4f1jhqpdc11yf0w9gv4-zlib-1.3.drv",
      "layerID": "sha256:2f7c7b1832ba50ba3e3f06dd8815cb83985522ca2cf3d79d2d1d8f818b969435",
      "accessPath": "/nix/store/q9jf8xl1gsfmx4f1jhqpdc11yf0w9gv4-zlib-1.3.drv",
      "annotations": {
        "evidence": "supporting"
      }
    }
  ],
  "licenses": [],
  "language": "",
  "cpes": [
    {
      "cpe": "cpe:2.3:a:zlib:zlib:1.3:*:*:*:*:*:*:*",
      "source": "syft-generated"
    }
  ],
  "purl": "pkg:nix/zlib@1.3?drvpath=q9jf8xl1gsfmx4f1jhqpdc11yf0w9gv4-zlib-1.3.drv&output=out&outputhash=sha256%3Aec7b5d2fd77a9dd19ebe15f8b7f991ad16923e555634002c06f004ddb3dbc94c",
  "metadataType": "nix-store-entry",
  "metadata": {
    "path": "/nix/store/4rx3vkkd91wkbhpflsplfga603cp1l1c-zlib-1.3",
    "derivation": {
      "path": "/nix/store/q9jf8xl1gsfmx4f1jhqpdc11yf0w9gv4-zlib-1.3.drv",
      "system": "x86_64-linux",
      "inputDerivations": [
        {
          "path": "/nix/store/6p6gk14y6b5mjpjz6al6ysyg6q9av59h-zlib-1.3.tar.gz.drv",
          "outputs": [
            "out"
          ]
        },
        {
          "path": "/nix/store/6zzlzgnsnsjygf82k83nz2vspbahibb3-bootstrap-stage3-stdenv-linux.drv",
          "outputs": [
            "out"
          ]
        },
        {
          "path": "/nix/store/ks6kir3vky8mb8zqpfhchwasn0rv1ix6-bootstrap-tools.drv",
          "outputs": [
            "out"
          ]
        }
      ],
      "inputSources": [
        "/nix/store/6xg259477c90a229xwmb53pdfkn6ig3g-default-builder.sh"
      ]
    },
    "output": "out",
    "outputHash": "sha256:ec7b5d2fd77a9dd19ebe15f8b7f991ad16923e555634002c06f004ddb3dbc94c"
  }
}

Where the specific changes are:

• The purl now has an additional drvpath qualifier that is the basename of the derivation path
• The full store path for this output is listed in the metadata
• Partial derivation information is captured in the metadata, including
  • path: full path to the derivation path
  • system: platform information from the standard system attribute
  • inputDerivations: the set of other derivation outputs needed as inputs to perform the build for this package
  • inputSources: a set of paths required as input to perform the build for this package (essentially immutable blobs)

The original nix-store-cataloger is now deprecated and replaced with a new nix-cataloger which automatically determines the best source to reference when raising up packages. The legacy nix-store-cataloger still captures all files discovered, however, it will be raising up far more files than it had been in the past (a bug was fixed that resulted in fewer files found than what should have been raised).

The new cataloger can be configured to include all files within store paths (off by default):

# .syft.yaml

nix:
  # enumerate all files owned by packages found within Nix store paths (env: SYFT_NIX_CAPTURE_OWNED_FILES)
  capture-owned-files: true

• Fixes Detect nix dependencies #3814

Type of change

• New feature (non-breaking change which adds functionality)

Checklist:

• I have added unit tests that cover changed behavior
• I have tested my code in common scenarios and confirmed there are no regressions
• I have added comments to my code, particularly in hard-to-understand sections