{"id":14967982,"url":"https://github.com/katexochen/govulncheck-nixpkgs","last_synced_at":"2025-10-26T00:30:47.887Z","repository":{"id":240537101,"uuid":"790408973","full_name":"katexochen/govulncheck-nixpkgs","owner":"katexochen","description":"Scanning nixpkgs for vulnerabilities in Go packages","archived":false,"fork":false,"pushed_at":"2025-02-10T09:33:43.000Z","size":5915,"stargazers_count":9,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-02-10T10:22:02.358Z","etag":null,"topics":["go","golang","nix","nixos","nixpkgs","security"],"latest_commit_sha":null,"homepage":"","language":"Nix","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"isc","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/katexochen.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2024-04-22T20:33:20.000Z","updated_at":"2025-02-10T09:02:17.000Z","dependencies_parsed_at":"2024-05-19T16:33:08.913Z","dependency_job_id":"7cf55f6b-ff27-4268-ad2c-23389bb9b301","html_url":"https://github.com/katexochen/govulncheck-nixpkgs","commit_stats":{"total_commits":33,"total_committers":1,"mean_commits":33.0,"dds":0.0,"last_synced_commit":"72846d3d9585c81bd275bf0a42f39d960a7bf81c"},"previous_names":["katexochen/govulncheck-nixpkgs"],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/katexochen%2Fgovulncheck-nixpkgs","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/katexochen%2Fgovulncheck-nixpkgs/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/katexochen%2Fgovulncheck-nixpkgs/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/katexochen%2Fgovulncheck-nixpkgs/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/katexochen","download_url":"https://codeload.github.com/katexochen/govulncheck-nixpkgs/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":238229940,"owners_count":19437723,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["go","golang","nix","nixos","nixpkgs","security"],"created_at":"2024-09-24T13:39:03.864Z","updated_at":"2025-10-26T00:30:47.882Z","avatar_url":"https://github.com/katexochen.png","language":"Nix","funding_links":[],"categories":[],"sub_categories":[],"readme":"## Govulncheck on nixpkgs\n\nThis project runs [govulncheck](https://go.dev/blog/govulncheck) on the source of Go packages\nin [nixpkgs](https://github.com/NixOS/nixpkgs) to identify security vulnerabilities not handled\ndownstream (due to missing updates) or upstream (unmaintained or unaware projects).\n\nScans use a pinned version of nixpkgs and the [govulndb](https://vuln.go.dev/) so that the results\nare reproducible. The [scan report](https://github.com/katexochen/govulncheck-nixpkgs/blob/main/report.txt)\nis tracked as part of this repo. It can be inspected with the `report-tool`, which gives an overview and\nallows easy access to the relevant part of the report.\n\n```\n❯ report-tool stats\nPackages discovered:   2511\nPackages failed:       442 (17%)\nPackages scanned:      2069 (82%)\nPackages vulnerable:   577 (29% of scanned)\nTotal vulnerabilities: 1822\n```\n\u003cp align=\"center\"\u003e\n    \u003cimg src=\"https://docs.google.com/spreadsheets/d/e/2PACX-1vRmIRrf8Xs-gWjELNtujQAGxQInZseqpnculzfNtulc6pTzJPnFuIJA3n1UxVwXC0YiGD-rjpS6qcbc/pubchart?oid=1646482397\u0026format=image\" /\u003e\n    \u003cimg src=\"https://docs.google.com/spreadsheets/d/e/2PACX-1vRmIRrf8Xs-gWjELNtujQAGxQInZseqpnculzfNtulc6pTzJPnFuIJA3n1UxVwXC0YiGD-rjpS6qcbc/pubchart?oid=169772779\u0026format=image\" /\u003e\n\u003c/p\u003e\n\nReports for releases can be found on the release branches:\n\n- [24.11](https://github.com/katexochen/govulncheck-nixpkgs/tree/release-24.11)\n\n### Current limitations\n\n- Primitive package discovery (see `isGoPkg`)\n  - Only looking at package attributes to identify Go packages\n  - Not recursing into nested attribute sets\n  - `rg -c 'buildGo\\d*Module (|rec )\\{' | awk -F: '{s+=$2} END {print s}'` on nixpkgs gives 2417 findings,\n    so the 2422 packages found by the heuristic might should at least be somewhat close\n- Checks are running directly on `src`\n  - `patches` not taken into account\n  - `cgo` dependencies are not present (see `report-tool failed`)\n  - `srcRoot`, `subPackages` etc not taken into account (some failures as `go.mod` is not found)\n  - `goModules` isn't used by the govulncheck invocation\n- Scan is not running in the sandbox\n- All the [limitations of govulncheck](https://pkg.go.dev/golang.org/x/vuln/cmd/govulncheck#hdr-Limitations)\n- Only covers nixpkgs-unstable (support for releases upcoming)\n- Report lacks a structured format. I couldn't befriend with the JSONline output of govulncheck, it misses\n  some important info like scan failures, which won't be part of the structured output. The current report\n  can be somehow worked with using the report-tool. In the future, some kind of website would be nice to\n  present the results.\n\n\n### `report-tool`\n\n```\nUsage: report-tool \u003ccommand\u003e [args]\n\nCommands:\n    stats\n        Show statistics about the report.\n\n    discovered\n        List packages which were tried to be checked.\n\n    failed\n        List packages for which the check failed.\n\n    scanned\n        List packages that were successfully scanned.\n\n    vulnerable\n        List packages that have vulnerabilities.\n\n    non-vulnerable\n        List packages that do not have vulnerabilities.\n\n    report \u003cpkgName\u003e\n        Show the report for a specific package.\n\n    findings \u003cpkgName\u003e\n        List the found vulnerabilities (URL) for a specific package.\n\n    mark \u003cpkgName\u003e\n        Show the vulnerabilities for a specific package in a format that can be\n        used to mark the package as vulnerable in the nixpkgs repository.\n\n    fix \u003cpkgName\u003e\n        Show the commands to fix the vulnerabilities upstream.\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fkatexochen%2Fgovulncheck-nixpkgs","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fkatexochen%2Fgovulncheck-nixpkgs","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fkatexochen%2Fgovulncheck-nixpkgs/lists"}