10  Recipe: refresh wordlists and data packs

Tool: kailash (kailash-data.* packs) · Section: Administrator · Level: easy · Time: ~10 min · Layer/Category: CLASSIC / c-05 (+ the C-7 SDR pack) · Tags: admin, data-packs, wordlists, opt-in

10.1 Problem

Part of the catalogue is data, not commands: wordlists, password packs and specialised corpora ride as DATA-pack manifest rows (seclists, pw-packs/rockyou.txt, the C-7 signal/SDR pack). They are excluded from every default image by construction and never ride a default profile — you opt in deliberately, and you can state exactly which revision of a corpus you installed and whether its content licences are established.

10.2 Solution

Inspect the pack rows, add the opt-in derivation, rebuild, verify:

# 1. See the pack rows the manifest declares
kailash info seclists        # status: data; rides kailash-data.wordlists-mega (KA-29)
kailash info pw-packs        # rockyou.txt as the pw-packs DATA pack
kailash list --status data

# 2. Opt in via the pack's derivation in your host configuration, e.g.:
#    environment.systemPackages = [ kailash-data.wordlists-mega ];
#
#    (packs are opt-in derivations, NOT a category enablement — they
#     never ride a default profile)

# 3. Rebuild and switch
sudo nixos-rebuild switch

# 4. Verify what landed and from which source revision
ls /opt/seclists/ 2>/dev/null || nix build github:kailash-os/kailash-packages#seclists -o result && ls result/

Expected output shape:

pack:    seclists          (KA-29, pkgs/seclists)
version: <nvfetcher rev>   (the lock/sources revision)
status:  data pack installed, default-OFF pack opted in

10.3 Discussion

  • Why data packs are special rows: manifest rows may carry data rather than command invocations — the treatment is the same single-source-of-truth discipline (the pack row IS the routing record), but the delivery is an opt-in derivation, because a multi-gigabyte corpus has no business inside a ≤4 GB image budget.
  • The licence caveat is part of the row: the repository licence (MIT for seclists) does NOT establish per-file corpus content licences — the manifest rows say so explicitly. Check what you redistribute before you redistribute it.
  • Refresh is a sources/lock event, not a background updater: upstream pins are re-checked on cadence (update:slow for these packs); a refresh lands as a reviewed PR — a system pinned to last month’s lock keeps rebuilding the same corpus until its operator pulls a newer lock, the exact anti-churn posture of Ride a release without breaking pinned tooling.
  • The provenance rules apply to data exactly as to tools: the guide’s man-page version-lock contract and this book’s recipe provenance footers exist so any pin movement is a visible, reviewable event.

10.4 See also

Recipe provenance. Data-pack facts (seclists riding kailash-data.wordlists-mega KA-29, pw-packs as rockyou.txt, C-7 SDR opt-in pack, default-OFF posture, licence caveats per row, packaging status data) are from the packages manifest rows + the guide’s images/install chapters, verified 2026-10-14. The host-level pack PATH layout on a live system: PENDING — the delivery path is the pack derivation’s own record; the worked verification lands with the upkeep lane’s host checks.