linPEAS-flake¶
Personal Nix-flake wrapper around peass-ng/PEASS-ng linpeas.sh. All credit for LinPEAS itself belongs to the PEASS-ng authors.
Pin
20261017-c2b70018
Drift
0 days
Latest release
20261017-c2b70018
Upstream parity
success
Install¶
Persistent: nix profile add github:rvenutolo/linPEAS-flake. Full options on the Nix install page.
That audits the host filesystem. Sidecar (container) audits, the image-only smoke test, and tag-pinned alternatives are on the Docker install page.
{
inputs.linpeas-flake.url = "github:rvenutolo/linPEAS-flake";
}
# access via: inputs.linpeas-flake.packages.${system}.default
Overlay form on the Nix install page.
What this is¶
A thin Nix wrapper. Upstream releases linpeas.sh; this repo pins the asset by SRI hash, asserts pin shape at flake-eval, cross-checks the GitHub Releases API .digest field on each bump, and re-verifies upstream parity weekly. Three automation groups keep the flake current, and two staleness watchdogs watch that the weekly dependency upkeep is still refreshing inputs and that the pin bump is still landing — see Architecture → Auto-update.
Trust model in 60 seconds¶
- Build provenance: every release artifact has a SLSA attestation.
gh attestation verify <artifact> --repo rvenutolo/linPEAS-flakeproves it was built here. - Content trust on upstream: upstream PEASS-ng ships no signatures. SRI hash binds you to a specific upstream artifact, not to a particular author. If upstream is compromised, the wrapper faithfully ships the compromise.
- Site: documentation only, not a trust anchor.
Full breakdown: Security → Trust model → Verification walkthrough.