nikstur / bombon

Nix CycloneDX Software Bills of Materials (SBOMs)
MIT License
61 stars 9 forks source link

how to deal with string contexts #74

Open MangoIV opened 7 months ago

MangoIV commented 7 months ago

the issue is as follows:

pkgs.callPackage ./buildtime-dependencies.nix {} (
  pkgs.runCommand "foo" {} ''cp -r ${pkgs.hello}/bin $out''
)

this package clearly depends on pkgs.hello but bombon doesn't recognize that.

I have not found a solution but a very sad one:

nikstur commented 6 months ago

That's a very good observation, thank you! I don't have a clear answer yet how I can/want to solve this.

arianvp commented 8 hours ago

We need https://github.com/NixOS/nix/issues/4677

MangoIV commented 7 hours ago

https://github.com/wireapp/wire-server/blob/develop/nix/pkg-info.nix https://github.com/wireapp/wire-server/blob/develop/nix/all-toplevel-derivations.nix https://github.com/wireapp/wire-server/blob/develop/hack/bin/Sbom.hs

I’ve made this abomination a while ago. It works but it probably needs a ton of adjustments if you want to use it for anything but wireserver

MangoIV commented 7 hours ago

It goes what I described above though.

arianvp commented 7 hours ago

because pkgs is actually not a tree but a graph so you

will go around in circle

You could use https://nix.dev/manual/nix/2.18/language/builtins#builtins-genericClosure for this

MangoIV commented 7 hours ago

That’s not the only problem though. Nix will also memory leak like crazy. So probably not going to work anyway. You need to be careful what to recurse on. I think I also excluded a couple of attrsets to not look at.