Docs

Deploy it, then check it yourself

Single binary. PostgreSQL only. No secrets required to start.

Deployment shape

A single binary against PostgreSQL 17 or newer. Standalone or HA; the binary and database can share a host. Upstream sync and advisory updates require outbound access.

The quickstart, with the exact commands and the snapshot verification walkthrough, is in the install guide. It takes a work email and nothing else.

Get the install & verification guide

Packages are served inside your network. Physical transfer into fully disconnected networks is in development. See the Sovereign plan for offline licensing and deployment scope.

Architecture, one page

Component	What it does
Ingress policy	Defines which sources, vendors, and package sets are approved. Everything Package-Master mirrors and signs is filtered against it first.
Mirror & signing engine	Mirrors upstream repositories, applies the ingress policy, and signs the published result with your instance key by default. An unfiltered mirror can instead preserve the upstream signature byte for byte.
Storage	Keeping many snapshots does not multiply your disk: snapshots are cheap to retain. Local filesystem, S3-compatible, and Azure Blob backends.
PostgreSQL	The only external dependency (17 or newer). Holds metadata, the request audit log, and task history. No other datastore required.
Advisory tracking	Ingests Ubuntu Security Notices and the Debian Security Tracker, the issuers' own feeds. It does not produce a version-aware affected/not-affected verdict per snapshot, and it does not export SBOMs.
REST API, CLI, admin UI	Every surface talks to the same instance. Fits into existing platform automation instead of requiring a new one.

What Package-Master does not do

The boundaries, stated plainly, so you don't find out from a failed evaluation.

Boundary	Explanation
Certify any compliance framework	Package-Master creates operational records that a compliance program can reference. It does not certify SOC 2, ISO 27001, EU CRA, or CPCSC. That is an auditor's call, not ours.
Replace application-layer scanning	Snyk, Sonatype, and Checkmarx cover application dependencies. Package-Master covers the OS package layer underneath, a layer those tools are not built to control.
Replace cloud posture management	Cloud posture tools tell you the cloud is misconfigured. Package-Master controls and records the package source your machines install from.
Scan hosts or container images	Package-Master describes the package sets you publish: what a snapshot holds and what changed between snapshots. It is not a scanner. Per-host install reporting exists only through the optional fleet observer, which reports to your own instance for machines you enroll.
Treat RPM and npm as equals of APT	RPM (Yum/DNF) and npm mirroring are shipped and tested with real client installs. But the APT path is the flagship: RPM and npm have no advisory feeds and fewer conveniences today.
Phone home	No outbound telemetry. Nothing calls back to us. Upstream sync requires outbound access; physical transfer into fully disconnected networks is in development.