nFPM
What it is
nFPM is a free Go tool for creating DEB, RPM, APK, IPK, Arch Linux and MSIX packages. It runs as a command-line program or as a Go library, and the project describes it as a single binary without external runtime dependencies. A YAML file defines package metadata, files, dependencies, scripts and format-specific overrides. Installation options include package managers, prebuilt archives, Docker, Go install and building from source; documented managers include Homebrew, Scoop, APT, Yum, Winget and NPM. GoReleaser can use nFPM to generate and publish Linux packages and Windows MSIX packages. The install guide says release artifacts are checksummed and checksums are signed with cosign, while Docker images are also signed. MSIX support is described as experimental, with symlinks skipped. nFPM targets Linux, macOS and Windows, uses the MIT license, links to a security policy and directs support questions to the GoReleaser community.
For and against
For
- Free MIT-licensed package tool
- Creates six listed package formats
- Works as CLI or Go library
- Offers multiple installation methods
- Cosign signatures support artifact verification
Against
- MSIX support is experimental
- Symlinks are skipped for MSIX
- Support is directed to the GoReleaser community
The verdict
nFPM provides dependency-light package creation through a CLI or Go library, with YAML configuration and broad installation choices. MSIX users should account for its experimental status and skipped symlinks.
Who it suits
nFPM suits developers who need package creation from Linux, macOS or Windows. It is especially relevant when a simple binary or library without dependencies such as Ruby and tar is preferred.
Plans and prices
nFPM
No paid plans or usage limits stated on the pages reviewed
Read 8 Oct 2026 · github.com
On the record
- Artifact verification
- The install guide says release artifacts are checksummed and the checksum is signed with cosign; Docker images are also signed with cosign.nfpm.goreleaser.com · read 8 Oct 2026
- Configuration
- Packages are defined with a YAML configuration file.nfpm.goreleaser.com · read 8 Oct 2026
- Install options
- The project documents installation through package managers, prebuilt archives, Docker, Go install, or building from source.nfpm.goreleaser.com · read 8 Oct 2026
- Integrations
- GoReleaser can use nFPM to generate and publish Linux packages and Windows MSIX packages.goreleaser.com · read 8 Oct 2026
- Intended use
- The project presents nFPM as an alternative for users who want a simple binary or library without dependencies such as Ruby and tar.github.com · read 8 Oct 2026
- License
- The repository identifies its license as MIT.github.com · read 8 Oct 2026
- MSIX limitation
- The GoReleaser documentation describes MSIX support as experimental and says symlinks are skipped.goreleaser.com · read 8 Oct 2026
- Package contents
- Configuration can specify package metadata, files, dependencies, scripts, and format-specific overrides.nfpm.goreleaser.com · read 8 Oct 2026
- Purpose
- nFPM is a Go tool for creating deb, rpm, apk, ipk, Arch Linux, and MSIX packages.nfpm.goreleaser.com · read 8 Oct 2026
- Runtime
- The project describes nFPM as a single binary with no external runtime dependencies.nfpm.goreleaser.com · read 8 Oct 2026
- Security policy
- The GitHub repository links to a security policy.github.com · read 8 Oct 2026
- Support
- The repository directs users with questions or support needs to the GoReleaser community.github.com · read 8 Oct 2026
- Supported package managers
- Documented installation options include Homebrew, Scoop, APT, Yum, Winget, and NPM.nfpm.goreleaser.com · read 8 Oct 2026
- Ways to use
- nFPM can be used as a command-line tool or as a Go library.nfpm.goreleaser.com · read 8 Oct 2026
