SBOMs for any Nix flake, in seconds
FlakeBOM is a Rust CLI that generates spec-compliant CycloneDX SBOMs from any Nix flake. It integrates directly with Determinate Nix's C API for minimal overhead, covers every flake output, and pairs perfectly with Determinate Secure Packages.
CycloneDX 1.5 SBOMs
Generate industry-standard Software Bills of Materials in CycloneDX 1.5 JSON, covering every output of your flake, not just a single derivation.Runs on any flake
Point FlakeBOM at any flake, with no special integration required. It walks your flake's schema and recursively collects every derivation it depends on.Direct Nix C API integration
Written in Rust and integrated directly with Determinate Nix's C API for minimal overhead, with full use of parallel evaluation and provenance data.Vendored dependency detection
Detects and realises derivations that bundle language dependencies, includingfetchNpmDeps, fetchPnpmDeps, fetchCargoVendor, and Crane, then lists each package as a sub-component with its PURL.Comprehensive metadata
Enriches components with identifiers like CPEs and PURLs that vulnerability scanners such as Trivy can put to work, drawing on the metadata in Determinate Secure Packages.Built-in VEX support
Includes Vulnerability Exploitability eXchange data for manually mitigated CVEs, and merges your own VEX metadata into the generated SBOM in a single step.Built for scale
Routinely generates a ~60MiB SBOM spanning 10,000+ components in under two minutes, powered by Determinate Nix's parallel evaluation.Complements Secure Packages
Available exclusively to Determinate Secure Packages customers, and the perfect complement to a curated, auditable package set.Pairs with FlakeAudit
The SBOMs FlakeBOM generates feed straight into FlakeAudit (coming soon), which evaluates them against custom policies and compares them over time.Available with Determinate Secure Packages
FlakeBOM is available exclusively to Determinate Secure Packages customers, the curated, auditable package set it's built to work with.
- FlakeBOM documentation
FlakeBOM documentation (opens in a new tab)
The full FlakeBOM guide: features, best practices, and how to merge your own VEX metadata.
- Introducing FlakeBOM
Introducing FlakeBOM
The announcement post, with a deep dive on how FlakeBOM works and the challenges behind it.
- FlakeBOM webinar
FlakeBOM webinar (opens in a new tab)
Our webinar on reimagining supply chain security with FlakeBOM and Determinate Secure Packages.
- Determinate Secure Packages
Determinate Secure Packages
Secure, signed, auditable Nix packages that FlakeBOM is built to work with.
Explore more tools
- Learn more about fhLearn more
fh
The official CLI companion for FlakeHub.
- Learn more about FlakeAuditLearn more
FlakeAudit
Coming soonAudit SBOMs against custom policies and compare them with confidence.