Install with Nix¶
The flake exposes a linpeas package, a runnable linpeas app, and an overlay. Pin and content integrity are enforced at eval and build time — see Security → Trust model.
Run without installing¶
Equivalent to executing linpeas -a against the currently-pinned upstream linpeas.sh.
Persistent install¶
Installs packages.<system>.default. Nix names the resulting profile element after the flake (linPEAS-flake), not the package, so upgrade with nix profile upgrade --all, which is robust to the element name.
As a flake input¶
{
inputs.linpeas-flake.url = "github:rvenutolo/linPEAS-flake";
outputs = { self, nixpkgs, linpeas-flake, ... }: {
# ...
# access via: linpeas-flake.packages.${system}.default
};
}
As an overlay¶
{
nixpkgs.overlays = [ inputs.linpeas-flake.overlays.default ];
# ...
# then pkgs.linpeas is available
}
Platform support¶
The flake declares packages for both Linux systems via flake-parts' perSystem (the systems list in flake.nix). Both are built and CI-tested by the same run steps; the arm64 jobs differ in runner label, in an arch tag on their job, step and build-artifact names (-arm64 on the jobs and the artifact, (aarch64) on the steps), and — for the build and image-smoke jobs — in a larger timeout budget:
| System | Flake builds | CI tested |
|---|---|---|
x86_64-linux |
yes | yes (ubuntu-latest) |
aarch64-linux |
yes | yes (ubuntu-24.04-arm) |
Both linpeas-image and site are gated on a Linux stdenv — the image because containers run a Linux kernel regardless of host OS — so adding a non-Linux system to the systems list in flake.nix would not publish them there.
The systems list in flake.nix is the single source of truth for the declared systems above; the flake re-exports it as flake.lib.systems, the attribute the checker reads. CI's flake-check job runs scripts/check-flake-systems-eval.sh, which reads flake.lib.systems and force-evaluates each declared system's packages down to every package's derivation — not just the attribute names — failing with the system named if one breaks. nix flake check alone does not force per-system module thunks (e.g. a second nixpkgs input imported per perSystem), so a platform that silently stopped evaluating would otherwise pass CI undetected.
Pin / version¶
The currently pinned upstream tag is 20261017-c2b70018. See the Dashboard for full pin metadata.