a private apt repository that remembers
One sources-list line and Debian and Ubuntu hosts pull through gastropod: a verified mirror of upstream distributions, a hosted repository for your own .deb packages, and a record, per host, of which package landed where. Apt is the one ecosystem where every install runs as root on a production machine.
connect in one line
# /etc/apt/sources.list.d/gastropod.list deb https://gastropod.io/deb/<distro> ...
apt update and apt install work unchanged.
what happens on every install
- Identity is fixed. The package resolves to an exact PURL, version, and sha256 digest.
- Signatures are verified. Signed apt release metadata is checked at intake before a package is served to a host.
- Advisories are correlated. Known OSV advisories attach to the exact version, mapped across everything that depends on it.
- The install is recorded. Which host or principal pulled which package, when, on the audit spine and exportable. For OS packages this is the record patch-compliance audits ask for.
- It's remembered. Findings, provenance, and where-seen history stay on the digest for every later pull across the fleet.
root on every host
An apt package carries the deepest trust infrastructure grants: it installs as root, on every machine that pulls it, often via unattended upgrades nobody watches. The ecosystem's defense is repository signing, and it works if something actually checks it on the path to your fleet, and if anyone can later say which hosts got which version. Gastropod does both jobs at the choke point. Signed metadata is verified at intake once, centrally, rather than trusted machine by machine; every pull is attributed, so "which hosts installed the affected version, and when" is a query, whether the asker is an incident channel or an auditor. Your own .deb packages ship through the same repository with the same record.
proxy, hosted, virtual
proxy
A verified, caching mirror of upstream Debian/Ubuntu repositories. The first pull fetches, verifies, and stores content-addressed and deduplicated.
hosted
Your own .deb packages, token-gated, served through the same endpoint.
virtual
One sources entry aggregating both.
Every feature is on every tier: OIDC SSO, scoped tokens, SBOMs, blast radius, and audit are all present starting at our published rates.
FAQ
can gastropod mirror official Debian and Ubuntu repositories?
Yes. Proxy mode fronts the upstream distribution, verifying signed release metadata at intake and caching packages locally so fleet updates don't depend on upstream mirrors.
can I host my own .deb packages?
Yes. A hosted repository serves internal packages through the same apt endpoint as the mirror, token-gated with reader and publisher roles.
how does this help with patch-compliance audits?
Every pull attributes on the audit spine: which host, which package, which version, when, and it's exportable. Showing which machines installed a patched version becomes a query rather than a fleet-wide inventory scramble.
does it verify package signatures?
Signed apt metadata is verified at intake, centrally, before packages are served, so the check doesn't depend on each individual host's keyring hygiene.
can this replace our current apt mirror?
For standard apt workflows, yes. Hosts change one sources line, and it runs alongside your current mirror during evaluation.
Part of the full product overview. Also speaking: rpm · Alpine.
Debian is a trademark of Software in the Public Interest, Inc. Ubuntu is a trademark of Canonical Ltd. Gastropod is not affiliated with either. Details current as of July 2026.