Nixpkgs security tracker

The Nixpkgs security tracker is a web service for managing information on vulnerabilities in software distributed through Nixpkgs and NixOS.

It is intended to help with solving the record linkage problem of matching packages in the CVE database and Nixpkgs.

It is deployed at https://tracker.security.nixos.org.

The tool serves three audiences:

• NixOS security team: review incoming CVEs and link them to affected packages
• Nixpkgs maintainers: get notified when their packages have vulnerabilities
• Nixpkgs users: subscribe to notifications for packages they care about

Contributing

Please see the contributing guide for more information on how to get started.

Maintainers can be reached in the Nixpkgs security tracker Matrix room, which is the place for questions and informal discussion.

History

• 2023

  The prototype was funded through the Sovereign Tech Fund "Contribute Back Challenge" 2023 investment, after a successful application with a proposal to strengthen NixOS security infrastructure.

• 2024

  Production deployment got delayed due to technical and organisational challenges, with slow progress on volunteered time past the original schedule.

  Remaining work was picked up end of the year, and concluded with a demo to the NixOS security team.

• 2025

  Continued development of the Nixpkgs security tracker funded via Tweag, as part of a larger effort to improve robustness of the Nix ecosystem.

  The NixOS security team started productive use, publishing and addressing numerous security issues.

Acknowledgements

This contribution to critical IT infrastructure would not be possible without the financial support of: