Add: nix flakes support

flake.nix

@@ -0,0 +1,107 @@
+{
+  description = "OpenVAS — Open Vulnerability Assessment Scanner";
+
+  inputs = {
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.11";
+    flake-parts.url = "github:hercules-ci/flake-parts";
+    crane = {
+      url = "github:ipetkov/crane";
+    };
+    fenix = {
+      url = "github:nix-community/fenix";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+  };
+
+  outputs =
+    inputs@{ self, flake-parts, ... }:
+    flake-parts.lib.mkFlake { inherit inputs; } {
+      systems = [
+        "x86_64-linux"
+        "aarch64-linux"
+        "x86_64-darwin"
+        "aarch64-darwin"
+      ];
+
+      perSystem =
+        { system, pkgs, ... }:
+        let
+          rustToolchain = pkgs.fenix.fromToolchainFile {
+            dir = self + /rust;
+            sha256 = "sha256-gh/xTkxKHL4eiRXzWv8KP7vfjSk61Iq48x47BEDFgfk=";
+          };
+
+          craneLib = (inputs.crane.mkLib pkgs).overrideToolchain rustToolchain;
+        in
+        rec {
+          formatter = pkgs.nixfmt-rfc-style;
+
+          _module.args.pkgs = import inputs.nixpkgs {
+            inherit system;
+            overlays = [ inputs.fenix.overlays.default ];
+          };
+
+          packages = import ./nix/packages {
+            inherit pkgs craneLib;
+            src = self;
+          };
+
+          apps =
+            let
+              mkApp = name: {
+                type = "app";
+                program = "${packages.${name}}/bin/${name}";
+              };
+            in
+            {
+              openvasd = mkApp "openvasd";
+              scannerctl = mkApp "scannerctl";
+              feed-filter = mkApp "feed-filter";
+              openvas = mkApp "openvas";
+            };
+
+          devShells.default = pkgs.mkShell {
+            inputsFrom = builtins.attrValues packages;
+            buildInputs = with pkgs; [
+              cmake
+              gcc
+              pkg-config
+              bison
+              flex
+              doxygen
+              pandoc
+              glib
+              json-glib
+              libgcrypt
+              gpgme
+              libpcap
+              libssh
+              libksba
+              gnutls
+              curl
+              libbsd
+              krb5
+              file
+              net-snmp
+              nmap
+              redis
+              rustToolchain
+              clang-tools
+              gdb
+              valgrind
+            ];
+          };
+        };
+
+      flake.overlays.default = final: prev: {
+        inherit (self.packages.${final.system})
+          gvm-libs
+          openvasd
+          scannerctl
+          feed-filter
+          scannerlib
+          openvas
+          ;
+      };
+    };
+}

nix/packages/default.nix

@@ -0,0 +1,45 @@
+{
+  pkgs,
+  craneLib,
+  src,
+}:
+
+let
+  inherit (pkgs) gvm-libs;
+
+  # Read scanner release version from CMakeLists.txt — upstream releases
+  # use this version for both the C scanner and the Rust binaries.
+  version = builtins.head (
+    builtins.match ".*project[[:space:]]*\\([^)]*VERSION[[:space:]]+([0-9.]+).*" (
+      builtins.readFile ./CMakeLists.txt
+    )
+  );
+
+  cargoToml = fromTOML (builtins.readFile (src + "/rust/Cargo.toml"));
+
+  # Each binary is its own derivation (buildDepsOnly shared, see scannerlib.nix).
+  rustOutputs = pkgs.callPackage ./scannerlib.nix {
+    inherit craneLib;
+    inherit gvm-libs;
+    inherit version;
+    pname = cargoToml.package.name;
+    src = src + "/rust";
+    repoRoot = src;
+  };
+
+in
+{
+  inherit gvm-libs;
+
+  inherit (rustOutputs)
+    openvasd
+    scannerctl
+    feed-filter
+    scannerlib
+    ;
+
+  openvas = pkgs.callPackage ./openvas.nix {
+    inherit src version;
+    inherit gvm-libs;
+  };
+}

nix/packages/openvas.nix

@@ -0,0 +1,97 @@
+{
+  stdenv,
+  lib,
+  version,
+  autoPatchelfHook,
+  cmake,
+  pkg-config,
+  bison,
+  flex,
+  glib,
+  json-glib,
+  libgcrypt,
+  gpgme,
+  libpcap,
+  libssh,
+  libksba,
+  gnutls,
+  curl,
+  libbsd,
+  krb5,
+  file,
+  net-snmp,
+  nmap,
+  redis,
+  doxygen,
+  pandoc,
+  gvm-libs,
+  paho-mqtt-c,
+  src,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "openvas";
+  inherit version;
+
+  inherit src;
+
+  # Upstream builds with -Werror; nixpkgs GCC 14+ triggers a sign-compare
+  # warning in the NASL packet-forgery code. Strip it rather than adding a
+  # blanket -Wno-error= flag.
+  postPatch = ''
+    substituteInPlace CMakeLists.txt nasl/CMakeLists.txt src/CMakeLists.txt misc/CMakeLists.txt \
+      --replace-warn "-Werror" ""
+  '';
+
+  nativeBuildInputs = [
+    autoPatchelfHook
+    cmake
+    pkg-config
+    bison
+    flex
+    doxygen
+    pandoc
+  ];
+
+  buildInputs = [
+    glib
+    json-glib
+    libgcrypt
+    gpgme
+    libpcap
+    libssh
+    libksba
+    gnutls
+    curl
+    libbsd
+    krb5
+    file
+    net-snmp
+    nmap
+    redis
+    gvm-libs
+    paho-mqtt-c
+  ];
+
+  # CMAKE_INSTALL_PREFIX=/usr sets the *runtime* prefix baked into the
+  # binary (so it looks for /etc/openvas/openvas.conf at runtime).
+  # DESTDIR=$out overlays the Nix store on top at build time, and
+  # autoPatchelfHook fixes RPATH since libs land in $out/usr/lib/.
+  cmakeFlags = [ "-DCMAKE_INSTALL_PREFIX=/usr" ];
+
+  installPhase = ''
+    runHook preInstall
+    DESTDIR="$out" cmake --install .
+    mkdir -p "$out/bin"
+    ln -sf "$out/usr/sbin/openvas" "$out/bin/openvas"
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Open Vulnerability Assessment Scanner";
+    homepage = "https://github.com/greenbone/openvas";
+    license = licenses.gpl2Plus;
+    platforms = platforms.linux ++ platforms.darwin;
+    mainProgram = "openvas";
+  };
+})