Bill Me Up Boss

Container scanners guess what’s in your image by grepping package manager databases after the fact. They miss transient build tools, ignore unrecorded host dependencies, and produce an SBOM that is fiction. If you can’t reconstruct the binary from declared inputs, your SBOM is just paperwork.

Traditional package managers lose track of transient build tools, while container images hide untracked layers and ambient state.

Packaging with Nix solves this at the root. Every package is defined by a derivation: an explicit, hash-addressed record of every tool, source file, and compiler required to construct the artifact. Stepping through a derivation’s dependency graph yields a complete, deterministic bill of materials. Tools like sbomnix parse store paths directly to emit standardized SPDX or CycloneDX inventories.

Attach generation tools directly to the derivation using the passthru attribute. passthru binds helper scripts to a package without altering its build hash or forcing an expensive rebuild. SBOM generation sits right next to the package definition, versioned and ready to execute.

Nix is not a silver bullet. It tracks system-level inputs, but it won’t audit unpinned vendored code or raw language-level locks unless specialized tools inspect those files. What it provides is the foundation: a verifiable dependency graph that turns auditability from a manual guessing game into an automated guarantee.