a private rpm repository that remembers
One .repo file and a RHEL-family fleet, RHEL, Rocky, Alma,
Fedora, pulls through gastropod: a caching mirror of upstream repositories, a hosted home
for your own rpms, and a per-host record of exactly which package version landed where.
The record a patch-compliance audit keeps asking for.
connect in one line
# /etc/yum.repos.d/gastropod.repo baseurl=https://gastropod.io/rpm/...
dnf install and yum update work unchanged.
what happens on every install
- Identity is fixed. The package resolves to an exact PURL, version, and sha256 digest.
- Integrity is checked at intake against the repository's signed metadata, before a package is served to a host.
- Advisories are correlated. Known OSV advisories attach to the exact version, mapped across dependents.
- The install is recorded. Which host or principal pulled which package, when, on the audit spine and exportable.
- It's remembered. Findings, provenance, and where-seen history stay on the digest across the fleet.
the fleet problem
Enterprise Linux estates have a characteristic failure mode: the inventory gap. Hundreds or thousands of hosts, several teams, staged rollouts, and when an advisory lands on a package, the honest answer to "which hosts run the affected version?" is a config-management query that's only as good as its last sync, cross-checked against hope. Gastropod closes the gap at the source. Every package a host pulls is identified, verified, and attributed at the repository, so the record of what's deployed is generated by the act of deploying it, not reconstructed afterward. "Which hosts installed the affected version, and which have pulled the patched one since" becomes a query against the audit spine. Your own rpms, internal tools, packaged apps, ship through the same repository with the same record.
proxy, hosted, virtual
proxy
A verified, caching mirror of upstream RHEL-family repositories. The first pull fetches, verifies, and stores content-addressed and deduplicated.
hosted
Your own rpm packages, token-gated, served through the same endpoint.
virtual
One repo definition aggregating both.
Every feature is on every tier: OIDC SSO, scoped tokens, SBOMs, blast radius, and audit are all present starting at our published rates.
FAQ
which distributions does this cover?
The RHEL family: RHEL, Rocky, Alma, Fedora, and other rpm/dnf-based distributions, via standard repository definitions.
can gastropod mirror upstream rpm repositories?
Yes. Proxy mode fronts the upstream, verifying signed metadata at intake and caching packages locally so fleet updates don't depend on upstream mirror availability.
how does this help with patch compliance?
Every pull is attributed: host, package, version, time, and it's exportable. Demonstrating that the fleet installed a patched version becomes a query, not a config-management reconciliation project.
can I host internal rpms?
Yes. A hosted repository serves your own packages through the same endpoint as the mirror, token-gated with reader and publisher roles.
can it run alongside our Satellite/Foreman/existing mirror setup?
Yes. Hosts point a .repo file at gastropod, so it can serve a
subset of the fleet or of repositories during evaluation.
Part of the full product overview. Also speaking: apt · OCI.
Red Hat and RHEL are trademarks of Red Hat, Inc. Rocky Linux, AlmaLinux, and Fedora are trademarks of their respective owners. Gastropod is not affiliated with any of them. Details current as of July 2026.