Has anyone here tried sbomnix together with grype? How well does it work? Last time I looked into vulnerability checking for Nix, stuff seemed rather unreliable, though I'm not sure I looked into sbomnix (or it already existed at the time).
sbomnix writes purl (package URL) and cpe fields in the sbom, see the baseline SBOM in nixos-vex: https://github.com/datosh/nixos-vex/blob/6c6bbba6d30cf474dcf...
The nix purls are not supported by anything, as far as I can tell :/ But grype does a good job matching the CPE data!
Grype does warn about some unknown CPEs, for nix build artifacts:
[0000] WARN invalid CPE: cpe:2.3:a:nixos-system-desktop-26.11.20261001.c59305b:nixos-system-desktop-26.11.20261001.c59305b::*:*:*:*:*:*:* from=syft