feat: Simplify packages and apps

- import third party packages as flake inputs - one overall derivation instead of multiple derivations Signed-off-by: Brian McGee <[email protected]>
tiiuae · Nov 9, 2023 · b34d412 · b34d412
1 parent 520b125
commit b34d412
Show file tree

Hide file tree

Showing 12 changed files with 204 additions and 309 deletions.
diff --git a/flake.lock b/flake.lock
diff --git a/flake.nix b/flake.nix
@@ -26,8 +26,12 @@
       };
     };
     nix-visualize = {
-        url = "github:craigmbooth/nix-visualize";
-        flake = false;
+      url = "github:craigmbooth/nix-visualize";
+      flake = false;
+    };
+    vulnix = {
+      url = "github:henrirosten/vulnix";
+      flake = false;
     };
   };
 
@@ -45,8 +49,6 @@
 
       imports = [
         ./nix
-        ./scripts
-        ./sbomnix.nix
       ];
     };
 }
diff --git a/nix/apps.nix b/nix/apps.nix
@@ -0,0 +1,40 @@
+# SPDX-FileCopyrightText: 2023 Technology Innovation Institute (TII)
+#
+# SPDX-License-Identifier: Apache-2.0
+{
+  perSystem = {self', ...}: {
+    apps = let
+      inherit (self'.packages) sbomnix;
+    in {
+      # nix run .#repology_cli
+      repology_cli = {
+        type = "app";
+        program = "${sbomnix}/bin/repology_cli";
+      };
+
+      # nix run .#repology_cve
+      repology_cve = {
+        type = "app";
+        program = "${sbomnix}/bin/repology_cve";
+      };
+
+      # nix run .#nix_outdated
+      nix_outdated = {
+        type = "app";
+        program = "${sbomnix}/bin/nix_outdated";
+      };
+
+      # nix run .#nix_outdated
+      nixgraph = {
+        type = "app";
+        program = "${sbomnix}/bin/nixgraph";
+      };
+
+      # nix run .#vulnxscan
+      vulnxscan = {
+        type = "app";
+        program = "${sbomnix}/bin/vulnxscan";
+      };
+    };
+  };
+}
diff --git a/nix/default.nix b/nix/default.nix
@@ -3,8 +3,10 @@
 # SPDX-License-Identifier: Apache-2.0
 {
   imports = [
+    ./apps.nix
     ./checks.nix
     ./devshell.nix
+    ./packages.nix
     ./treefmt.nix
   ];
 }
diff --git a/nix/devshell.nix b/nix/devshell.nix
@@ -4,39 +4,44 @@
 {
   perSystem = {
     pkgs,
-    self',
+    lib,
     inputs',
     ...
   }: {
     devShells.default = let
-      pythonPackages = pkgs.python3Packages;
+      pp = pkgs.python3Packages;
     in
       pkgs.mkShell rec {
         name = "sbomnix-dev-shell";
 
-        buildInputs = [
-          pkgs.coreutils
-          pkgs.curl
-          pkgs.gnugrep
-          pkgs.gnused
-          pkgs.graphviz
-          pkgs.grype
-          pkgs.gzip
-          pkgs.nix
-          pkgs.reuse
-          pythonPackages.beautifulsoup4
-          pythonPackages.colorlog
-          pythonPackages.graphviz
-          pythonPackages.numpy
-          pythonPackages.packageurl-python
-          pythonPackages.packaging
-          pythonPackages.pandas
-          pythonPackages.requests
-          pythonPackages.requests-cache
-          pythonPackages.tabulate
-          pythonPackages.venvShellHook
-          pythonPackages.wheel
-          inputs'.nix-fast-build.packages.default
+        buildInputs = lib.flatten [
+          (with pkgs; [
+            coreutils
+            curl
+            gnugrep
+            gnused
+            graphviz
+            grype
+            gzip
+            nix
+            reuse
+          ])
+          (with pp; [
+            beautifulsoup4
+            colorlog
+            graphviz
+            numpy
+            packageurl-python
+            packaging
+            pandas
+            requests
+            requests-cache
+            tabulate
+            venvShellHook
+            wheel
+          ])
+
+          [inputs'.nix-fast-build.packages.default]
         ];
         venvDir = "venv";
         postShellHook = ''

diff --git a/nix/packages.nix b/nix/packages.nix
@@ -0,0 +1,104 @@
+# SPDX-FileCopyrightText: 2023 Technology Innovation Institute (TII)
+#
+# SPDX-License-Identifier: Apache-2.0
+{inputs, ...}: {
+  perSystem = {
+    pkgs,
+    lib,
+    ...
+  }: let
+    pp = pkgs.python3Packages;
+
+    # We use vulnix from 'https://github.com/henrirosten/vulnix' to get
+    # vulnix support for runtime-only scan ('-C' command-line option)
+    # which is currently not available in released version of vulnix.
+    vulnix = (import inputs.vulnix) {
+      inherit (inputs) nixpkgs; # required but not used as we provide pkgs
+      inherit pkgs lib;
+    };
+
+    nix-visualize = (import inputs.nix-visualize) {inherit pkgs;};
+
+    pyrate-limiter = pp.buildPythonPackage rec {
+      version = "2.10.0";
+      pname = "pyrate-limiter";
+      format = "pyproject";
+
+      src = pkgs.fetchFromGitHub {
+        owner = "vutran1710";
+        repo = "PyrateLimiter";
+        rev = "v${version}";
+        hash = "sha256-CPusPeyTS+QyWiMHsU0ii9ZxPuizsqv0wQy3uicrDw0=";
+      };
+
+      propagatedBuildInputs = [
+        pp.poetry-core
+      ];
+    };
+
+    requests-ratelimiter = pp.buildPythonPackage rec {
+      version = "0.4.0";
+      pname = "requests-ratelimiter";
+      format = "pyproject";
+
+      src = pkgs.fetchFromGitHub {
+        owner = "JWCook";
+        repo = pname;
+        rev = "v${version}";
+        hash = "sha256-F9bfcwijyyKzlFKBJAC/5ETc4/hZpPhm2Flckku2z6M=";
+      };
+
+      propagatedBuildInputs = [pyrate-limiter pp.requests];
+    };
+  in {
+    packages = rec {
+      default = sbomnix;
+
+      sbomnix = pp.buildPythonPackage rec {
+        pname = "sbomnix";
+        version = pkgs.lib.removeSuffix "\n" (builtins.readFile ../VERSION);
+        format = "setuptools";
+
+        src = lib.cleanSource ../.;
+
+        propagatedBuildInputs = lib.flatten [
+          [
+            pyrate-limiter
+            requests-ratelimiter
+          ]
+          [pkgs.reuse]
+          (with pp; [
+            beautifulsoup4
+            colorlog
+            graphviz
+            numpy
+            packageurl-python
+            packaging
+            pandas
+            requests
+            requests-cache
+            tabulate
+          ])
+        ];
+
+        pythonImportsCheck = ["sbomnix"];
+
+        postInstall = ''
+
+          wrapProgram $out/bin/sbomnix \
+                        --prefix PATH : ${lib.makeBinPath [pkgs.nix pkgs.graphviz]}
+
+          wrapProgram $out/bin/nixgraph \
+                        --prefix PATH : ${lib.makeBinPath [pkgs.nix pkgs.graphviz]}
+
+          wrapProgram $out/bin/nix_outdated \
+              --prefix PATH : ${lib.makeBinPath [nix-visualize]}
+
+          wrapProgram $out/bin/vulnxscan \
+              --prefix PATH : ${lib.makeBinPath [pkgs.grype pkgs.nix vulnix]}
+
+        '';
+      };
+    };
+  };
+}
diff --git a/sbomnix.nix b/sbomnix.nix
diff --git a/scripts/default.nix b/scripts/default.nix