Installation · Pavois

This page covers the full install (verified binary or from source). Already installed? Jump straight to your first scan: Get started.

Prerequisites

Control host : Linux or macOS. Pavois is a Go CLI on CINC Auditor; it scans a local, SSH or Docker target from this host, no agent on the target.
curl : that is the whole dependency list for installing the binary. No mise, no Go, no toolchain: the rule corpus is already inside it. mise is only needed to build from source, which is covered further down.
sudo : effective service config needs root (sshd -T, sysctl, auditctl). Scan with --sudo.
SSH : for a remote target, Pavois uses your ~/.ssh/config and key, like oscap or lynis.

Install the binary

Pavois is a single static binary. The rule corpus is embedded: nothing to generate, no toolchain to install, nothing to compile. This is how Pavois is installed.

The binaries are pulled from the repository, from the GitHub releases: one static binary per platform (Linux and macOS, amd64 and arm64), .deb and .rpm packages, a checksums.txt, a CycloneDX SBOM and a SLSA provenance attestation. The binary is self-contained (rule corpus embedded): download, verify integrity and provenance, then scan.

With curl, installing nothing else

BASE=https://github.com/stephrobert/pavois/releases/download/v0.1.1
curl -fsSLO $BASE/pavois-linux-amd64 && curl -fsSLO $BASE/checksums.txt
sha256sum --ignore-missing --check checksums.txt   # integrity
sudo install -m 0755 pavois-linux-amd64 /usr/local/bin/pavois
pavois doctor                            # corpus embedded, ready to scan

On macOS, use shasum -a 256 -c instead of sha256sum. The binary has no shared dependency: it needs neither Ruby, nor Go, nor Python.

With a .deb or .rpm package

curl -fsSLO $BASE/pavois_0.1.1_amd64.deb && sudo dpkg -i pavois_0.1.1_amd64.deb
curl -fsSLO $BASE/pavois-0.1.1.amd64.rpm && sudo rpm -i pavois-0.1.1.amd64.rpm

Check the provenance (optional, recommended)

sha256sum proves the file has not changed since the checksums were published. It does not prove WHO built it: someone replacing both the binary and checksums.txt produces a consistent pair. The SLSA provenance attestation answers that question, and checking it needs GitHub CLI (official Debian, Ubuntu, Fedora and Homebrew packages, or a standalone binary on that page):

gh attestation verify pavois-linux-amd64 --repo stephrobert/pavois   # who built it

It confirms this exact file came out of this repository’s release workflow, on that tag, rather than merely being a file with the right name. It queries the public transparency log: no access to the repository is required, and a binary obtained elsewhere verifies just as well.

Build from source (contributors)

This section is for contributors. It is not how the tool is meant to be installed, and it never will be: the build pulls a pinned Go, Node and Python toolchain and regenerates artifacts a release binary already carries inside it.

The repository ships only the source of truth. The InSpec corpus (.rb) and the OSCAL bundle are derived artifacts, regenerated from the reference. So setting up is two steps: build, then regen.

The toolchain is pinned in mise.toml, and mise installs it, so you have no Go, Node or Python to manage by hand, and you get exactly the versions CI uses. One command, then reopen your shell:

sudo apt install -y extrepo && sudo extrepo enable mise   # a signed repository, never a piped script
sudo apt update && sudo apt install -y mise
# Fedora / RHEL: dnf copr enable jdxcode/mise && dnf install mise
# macOS: brew install mise

A signed repository, never a script piped into a shell. Pavois will never ask you to curl | sh: a hardening tool whose first line is that has already lost the argument. extrepo enables mise’s signed APT repository and checks its key; the curl blocks above download a file whose checksum you then verify, which is not the same thing as executing code fetched blind.

git clone https://github.com/stephrobert/pavois.git && cd pavois
mise trust && mise install   # pinned Go, Node, Python
mise run build               # -> go/pavois
mise run regen               # rule corpus + OSCAL from the reference
./go/pavois doctor           # check CINC, sudo, SSH, OS, corpus

Verify: ./go/pavois version.

The scan engine (CINC Auditor)

Installing Pavois is not enough to scan. Pavois runs its controls with CINC Auditor (the open-source build of Chef InSpec), and CINC is in no distribution repository: no package manager can fetch it, so the Pavois package cannot declare it as a dependency. Installing it is on you, and it is the only thing to install besides the binary.

Skip this step and the first scan stops on no native CINC engine found. Nothing is missing from the Pavois package: the engine is what is absent.

META="https://omnitruck.cinc.sh/stable/cinc-auditor/metadata?p=el&pv=9&m=x86_64"
URL=$(curl -sS "$META" | awk '/^url/{print $2}')     # the package for that platform
SUM=$(curl -sS "$META" | awk '/^sha256/{print $2}')  # and its published checksum
curl -fsSLO "$URL"
echo "$SUM  ${URL##*/}" | sha256sum --check         # integrity, before anything runs
sudo dnf install -y "./${URL##*/}"                  # Debian/Ubuntu: sudo apt install ./<file>
pavois doctor                                        # CINC engine (native): /usr/bin/cinc-auditor

The p and pv keys are omnitruck’s own: el/8, el/9, debian/12, debian/13, ubuntu/22.04, ubuntu/24.04. AlmaLinux and Rocky declare as el, as they do for Pavois’s own profile detection. The metadata endpoint publishes the package URL and its sha256, so you download, verify, then install with the system package manager. Upstream also documents a script piped into a root shell; this site will not ask you for that, and this recipe is its equivalent without executing code fetched blind.

Two modes exist, picked by --engine (default: auto):

native (recommended) : the cinc-auditor binary installed above. Required to audit the current host (local) and convenient over SSH (it honors your ~/.ssh/config). On a remote target, and only there, --bootstrap-cinc lets Pavois install it for you.
Docker (fallback) : zero-install, handy to scan a container. A container cannot audit its host, so this mode does not replace the native engine for a local target: keep it for docker:// targets.

Targets and transports

pavois scan local --sudo                 # current host (native)
pavois scan user@host --key ~/.ssh/id_ed25519 --sudo   # remote over SSH
pavois scan my-container                 # container over docker://

Supported systems

The control host runs on Linux or macOS. Audited targets cover 9 profiles, one per OS:

Debian 12
Debian 13
Fedora
RHEL 10 / Rocky 10 / AlmaLinux 10
RHEL 8 / Rocky 8 / AlmaLinux 8
RHEL 9 / Rocky 9 / AlmaLinux 9
Ubuntu 22.04
Ubuntu 24.04
Ubuntu 26.04

The profile is auto-detected from the target: --profile is only needed for a custom profile. AlmaLinux and Rocky are detected as RHEL of the same version.

Common errors

Before scanning, run pavois doctor: it checks each prerequisite (CINC engine, sudo, SSH, OS, corpus) and prints the exact fix for each gap (see the output). Otherwise, the common cases:

no native CINC engine found : the engine is not installed. This is by far the most common case after a package install, and it is often read as a missing dependency of the Pavois package: it is not one, the binary is static and asks for no library. Install the engine: CINC Auditor.
sudo: a terminal is required / requires a TTY : some targets (e.g. Debian 12 with Defaults use_pty) reject sudo over non-interactive SSH. Use --on-target to run the engine on the target.
SSH connection fails despite a valid key : a global ProxyJump (Host *) in ~/.ssh/config can break direct connections. Pavois neutralizes this internally.
empty corpus / profile not found : only in a clone of the repository, where the .rb corpus is regenerated rather than committed. Run mise run regen. A release binary cannot hit this: its corpus is embedded.

Install Pavois