Example or documentation on how to use it via an API

[drupol]

Hello,

I'm currently investigating how I could potentially embed SBOMs in OCI containers made with Nix.
I would like to use this project which seems quite mature, but I wish I could use it through a Nix API, it would make sense to use it through it when building the container.

I have opened an issue at https://discourse.nixos.org/t/generate-sbom-from-oci-container-made-with-nix/39430, and I'm currently able to do what I want, but I wish I could also evaluate the use of this project too.

Thanks for shedding some lights on this!

[henrirosten]

Thanks, this is a valid reguest. I'll look into this as soon as possible.

[drupol]

Cool looking forward to it !!!

[henrirosten]

@drupol: Sorry for the delay in response.

Re-visiting the discussion here: https://discourse.nixos.org/t/generate-sbom-from-oci-container-made-with-nix/39430/14
I believe what you are trying to do cannot be done with sbomnix since it uses nix-store internally, and using nix-store
inside nix-build (in runCommand) will not work due to nix build sandbox.

Changing sbomnix so that it could be used during buildtime would require a major refactor.

If you (or anyone else reading this) have ideas how to workaround this limitation we certainly appreciate any suggestions or contributions.

[drupol]

So sad, thanks for the clear explanation.