Consume linPEAS-flake as a flake input

This page covers importing this flake as an input to another flake. For one-shot use see nix run and the Docker image in the project README.

Plain flake consumer

{
  inputs.nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
  inputs.linpeas-flake = {
    url = "github:rvenutolo/linPEAS-flake/<TAG>";
    inputs.nixpkgs.follows = "nixpkgs";
  };

  outputs = { self, nixpkgs, linpeas-flake, ... }: {
    packages.x86_64-linux.linpeas =
      linpeas-flake.packages.x86_64-linux.default;
  };
}

Replace <TAG> with the latest release tag from releases.

Both packages.<system>.default and packages.<system>.linpeas are exposed; they alias the same derivation.

The snippets follow only nixpkgs: the flake's separate nixpkgs-unstable input backs the dev shells, the site output, the tooling packages (cosign, diffoscopeMinimal, git-cliff, nix), the formatter, and the lint tooling, so it stays in your lock file but never enters the linpeas package closure.

flake-parts consumer

{
  inputs = {
    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
    flake-parts.url = "github:hercules-ci/flake-parts";
    linpeas-flake = {
      url = "github:rvenutolo/linPEAS-flake/<TAG>";
      inputs.nixpkgs.follows = "nixpkgs";
    };
  };

  outputs = inputs@{ flake-parts, ... }:
    flake-parts.lib.mkFlake { inherit inputs; } {
      systems = [ "x86_64-linux" ];
      perSystem = { inputs', ... }: {
        packages.linpeas = inputs'.linpeas-flake.packages.default;
      };
    };
}

Pinning recommendation

Pin to a release tag (shaped YYYYMMDD-<sha>), not main. Both are locked to a rev, but nix flake update linpeas-flake on a main input advances to whatever main now points at; a tag pin only moves when you change the tag.

Note that inputs.nixpkgs.follows = "nixpkgs" (as in the snippets above) rebuilds linpeas against your nixpkgs rather than the stable channel this flake pins and tests against. That is normally what a flake consumer wants — one nixpkgs in the closure — but omit the follows line if you want the exact closure this repo's CI builds.

Update the pin with:

nix flake update linpeas-flake

No binary cache

This flake does not publish a substituter. The first import fetches the upstream linpeas.sh asset directly from the pinned release URL and installs it — no compilation. Subsequent evaluations hit your local Nix store.