Add `nix` package type #314

RaitoBezarius · 2024-07-22T19:49:01Z

This adds a first version of the Nix package type.

This adds a first version of the Nix package type. Signed-off-by: Raito Bezarius <masterancpp@gmail.com>

flokli · 2024-09-17T05:10:37Z

PURL-TYPES.rst

+      pkg:nix/glibc@2.39-52?drvpath=/nix/store/3nxf8kw3vgghz2y72b9qwi01sz62nhyk-glibc-2.39-52.drv&output=out&repository=github:user/nixpkgs
+      pkg:nix/systemd@255.6?drvpath=/nix/store/r34i4md1cmc19392zbbp9ya5nmd0av0k-systemd-255.6.drv&output=dev
+
+


You probably want to remove "nix" from the old list below.

flokli · 2024-09-17T05:11:16Z

PURL-TYPES.rst

+nix
+---
+
+``nix`` for Nix derivations:


Suggested change

``nix`` for Nix derivations:

``nix`` for Nix store paths:

The PURL is for each store path, and we may have multiple PURL for different output paths in the same derivation.

flokli · 2024-09-17T05:14:35Z

PURL-TYPES.rst

+``nix`` for Nix derivations:
+
+- The default package repository is <https://github.com/NixOS/nixpkgs> but the ``repository`` qualifier can override the package repository.
+- The ``name`` is the package ``pname`` field of the given derivation. It is case sensitive.


We don't always have the pname / version separate. Deep down pname and version are concatenated into a single string. Should something creating a PURL try to split this off? (Probably fine, but in that case, see the comment on the version field).

the current state of name, pname, and versioning standards was part of why I didn't expect there to be a PURL standard yet for nix. (TBH I haven't checked on the current-state of discussions for a while so maybe it's settled lol)
Although it'd be great if this spec discussion helps push things forwards

flokli · 2024-09-17T05:15:32Z

PURL-TYPES.rst

+
+- The default package repository is <https://github.com/NixOS/nixpkgs> but the ``repository`` qualifier can override the package repository.
+- The ``name`` is the package ``pname`` field of the given derivation. It is case sensitive.
+- The ``version`` is the ``version`` field of the given derivation.


How do PURL look like for store paths where the version cannot be extracted? Is this field (and other fields) optional or required? The spec for other PURLs in this file do explicitly say what's required and what not.

flokli · 2024-09-17T05:16:27Z

PURL-TYPES.rst

+- The default package repository is <https://github.com/NixOS/nixpkgs> but the ``repository`` qualifier can override the package repository.
+- The ``name`` is the package ``pname`` field of the given derivation. It is case sensitive.
+- The ``version`` is the ``version`` field of the given derivation.
+- The ``drvpath`` qualifier is the derivation path (``.drvPath``).


Do we want to have an outpath here too, or are PURL always for individual output paths, so this information would be redundant?

Is drvpath optional or required?

flokli · 2024-09-17T05:19:35Z

PURL-TYPES.rst

+- The ``name`` is the package ``pname`` field of the given derivation. It is case sensitive.
+- The ``version`` is the ``version`` field of the given derivation.
+- The ``drvpath`` qualifier is the derivation path (``.drvPath``).
+- The ``output`` qualifier is the output field, by default: ``out``


Suggested change

- The ``output`` qualifier is the output field, by default: ``out``

- The ``output`` qualifier is the name of the output, which helps to distinguish in the case of multi-output derivations

The "default" behavior is confusing. It doesn't describe if it should always be set, or if it is "out" in case the field is not present.

Or should it always be set to something, and the fact it's "out" in single-output derivations is an implementation detail of Nix that should be left out of the spec? I prefer this one, which is my the suggestion uses this variant.

I don't think it should be omitted in case of single-output derivations, it'd be odd if it suddenly would appear if an expression is refactored to multiple outputs.

including the output field also accounts for if the default is changed in the future and shouldn't be very painful to just include

we should just map this to outputName of the drv. Then this works with lib.getLib etc

flokli · 2024-09-17T05:24:06Z

PURL-TYPES.rst

+
+``nix`` for Nix derivations:
+
+- The default package repository is <https://github.com/NixOS/nixpkgs> but the ``repository`` qualifier can override the package repository.


Does this field even matter at all? With just the PURL we cannot reproduce the drv path anyways, there's a lot of other details (like rev, system, ...) we'd need. Also, the line gets blurry if you have a repo that imports nixpkgs, but overrides an expression, what should this be set to?

Inclined to remove this, this can only be a hint at most.

With this field being mostly informative I feel we'd want a nar package type or at least a nar field to better identify where you got the package from if using a cache like cache.nixos.org. ommitted or something for if you built it locally?

It is not identifying the package. If you have a nar sha256 hash, you can fetch it from any content-addressed store.

"what" being covered by the hash, but "where" can also useful for some governance.
Also if you can find that hash in your content-addressed store then great, but if you can't you might at least want a possible alternative location to check to find the same artifact described by the PURL.

Also lightning quick response! ⚡

06kellyjac

General thanks for kicking this off.
Added some comments :)

06kellyjac · 2024-09-26T11:23:02Z

PURL-TYPES.rst

+- The ``name`` is the package ``pname`` field of the given derivation. It is case sensitive.
+- The ``version`` is the ``version`` field of the given derivation.
+- The ``drvpath`` qualifier is the derivation path (``.drvPath``).
+- The ``output`` qualifier is the output field, by default: ``out``


including the output field also accounts for if the default is changed in the future and shouldn't be very painful to just include

06kellyjac · 2024-09-26T11:27:19Z

PURL-TYPES.rst

+
+``nix`` for Nix derivations:
+
+- The default package repository is <https://github.com/NixOS/nixpkgs> but the ``repository`` qualifier can override the package repository.


With this field being mostly informative I feel we'd want a nar package type or at least a nar field to better identify where you got the package from if using a cache like cache.nixos.org. ommitted or something for if you built it locally?

06kellyjac · 2024-09-26T11:29:49Z

PURL-TYPES.rst

+``nix`` for Nix derivations:
+
+- The default package repository is <https://github.com/NixOS/nixpkgs> but the ``repository`` qualifier can override the package repository.
+- The ``name`` is the package ``pname`` field of the given derivation. It is case sensitive.


the current state of name, pname, and versioning standards was part of why I didn't expect there to be a PURL standard yet for nix. (TBH I haven't checked on the current-state of discussions for a while so maybe it's settled lol)
Although it'd be great if this spec discussion helps push things forwards

jkowalleck · 2024-10-17T16:10:08Z

see #149

jkowalleck

please also add examples to the test suite
please also remove nix from the list of "Other candidate types to define"

jkowalleck

please rebase onto latest master branch, and then remove nix from the Other candidate types to define

RaitoBezarius · 2024-11-06T13:20:32Z

Thanks for the review, and sorry for the delay, this PR was opened to spark discussions and discussions are still continuing in the Nix ecosystem on what is the best format as we have some special challenges.

In terms of expectations, I'd like to ensure that most stakeholders are willing to carry on this, if so, I will apply the changes and add some examples whenever I have time (the other stakeholders are of course welcome to send me patches :P). If we are not to continue this path, we will probably close this PR and document why we cannot continue on this path.

Sorry again for the delay and thanks to flokli to pester me.

Add nix package type

2a0a266

This adds a first version of the Nix package type. Signed-off-by: Raito Bezarius <masterancpp@gmail.com>

nikstur mentioned this pull request Sep 16, 2024

How to match pkg/nix/* PURLs to Vulnerabilities? nikstur/bombon#135

Open

flokli reviewed Sep 17, 2024

View reviewed changes

06kellyjac reviewed Sep 26, 2024

View reviewed changes

jkowalleck added the Proposed new type label Oct 17, 2024

jkowalleck mentioned this pull request Oct 17, 2024

Add guix and nix as package types #149

Open

jkowalleck requested changes Oct 17, 2024

View reviewed changes

jkowalleck added PURL type definition Non-core definitions that describe and standardize PURL types and removed Proposed new type labels Oct 17, 2024

johnmhoran added Proposed new type type: nix Proposed new type labels Oct 18, 2024

jkowalleck removed the Proposed new type label Oct 19, 2024

jkowalleck requested changes Oct 19, 2024

View reviewed changes

johnmhoran added the Proposed new type label Oct 22, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add `nix` package type #314

Add `nix` package type #314

RaitoBezarius commented Jul 22, 2024

flokli Sep 17, 2024

flokli Sep 17, 2024

flokli Sep 17, 2024 •

edited

Loading

06kellyjac Sep 26, 2024

flokli Sep 17, 2024 •

edited

Loading

flokli Sep 17, 2024

flokli Sep 17, 2024

06kellyjac Sep 26, 2024

arianvp Sep 28, 2024

flokli Sep 17, 2024

06kellyjac Sep 26, 2024

flokli Sep 26, 2024

06kellyjac Sep 26, 2024 •

edited

Loading

06kellyjac left a comment

06kellyjac Sep 26, 2024

06kellyjac Sep 26, 2024

06kellyjac Sep 26, 2024

jkowalleck commented Oct 17, 2024

jkowalleck left a comment

jkowalleck left a comment

RaitoBezarius commented Nov 6, 2024

		pkg:nix/glibc@2.39-52?drvpath=/nix/store/3nxf8kw3vgghz2y72b9qwi01sz62nhyk-glibc-2.39-52.drv&output=out&repository=github:user/nixpkgs
		pkg:nix/systemd@255.6?drvpath=/nix/store/r34i4md1cmc19392zbbp9ya5nmd0av0k-systemd-255.6.drv&output=dev

	- The ``output`` qualifier is the output field, by default: ``out``
	- The ``output`` qualifier is the name of the output, which helps to distinguish in the case of multi-output derivations


		``nix`` for Nix derivations:

		- The default package repository is <https://github.com/NixOS/nixpkgs> but the ``repository`` qualifier can override the package repository.

Add nix package type #314

Are you sure you want to change the base?

Add nix package type #314

Conversation

RaitoBezarius commented Jul 22, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

flokli Sep 17, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

flokli Sep 17, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

06kellyjac Sep 26, 2024 • edited Loading

Choose a reason for hiding this comment

06kellyjac left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jkowalleck commented Oct 17, 2024

jkowalleck left a comment

Choose a reason for hiding this comment

jkowalleck left a comment

Choose a reason for hiding this comment

RaitoBezarius commented Nov 6, 2024

Add `nix` package type #314

Add `nix` package type #314

flokli Sep 17, 2024 •

edited

Loading

flokli Sep 17, 2024 •

edited

Loading

06kellyjac Sep 26, 2024 •

edited

Loading