Prove what you publish
What is supported today
What Package-Master covers today, and what it does not. Boundaries are stated as plainly as coverage.
Shipped today
| Area | Coverage |
|---|---|
| Distributions | Any Debian or Ubuntu suite. The suite list is read from the upstream repository, not hardcoded, so new Debian and Ubuntu releases work without a product update. The server itself deploys on Ubuntu 22.04/24.04 and Debian 12/13. |
| Architectures | amd64 is the supported target. arm64, i386, armhf, ppc64el, s390x, riscv64, and 'all' can be mirrored, read from the upstream's own index, but are not yet supported targets: treat them as best-effort. Strict-architecture mode guarantees the list you configure is exactly what gets mirrored. |
| Upstream repos | Official Debian and Ubuntu repositories and vendor APT repositories. Presets ship for the common ones; any APT repository reachable by URL can be mirrored. |
| Advisory feeds | Ingests the issuers' own feeds — Ubuntu Security Notices and the Debian Security Tracker — with no third-party aggregator in between. Refreshed on a schedule, with manual sync available, and per-package advisory lookup. Connected deployments only; feeds require outbound HTTPS. |
| Signing | Published repositories are signed by default, with the public key served at a stable URL and a fingerprint-pinned URL. An unsigned publish is refused unless explicitly overridden. Preserve mode passes upstream Debian/Canonical signatures through byte for byte. Package-Master does not verify upstream signatures on ingest. |
| Deployment | Single binary, PostgreSQL 17 or newer as the only external dependency. Standalone or HA with controlled outbound access for upstream sync. No phone-home. |
| Machine bands | Team up to 50 machines (1 environment). Operations up to 250 (2 environments). Sovereign up to 500 per restricted-network environment. |
| Fleet observer (optional) | An optional per-host observer reports installed packages and drift against the published set to your own Package-Master instance. Serving never depends on it: machines use stock apt. Enrolment is per machine, and the inventory stays in your instance. Nothing is sent to us. |
| RPM / Yum / DNF | Shipped: mirroring, snapshots, publishing, and signed repository metadata, verified with real client installs. Fewer features than the APT path: no advisory feeds and fewer conveniences today. |
| npm | Shipped: registry mirroring, snapshots, and publishing, verified with real client installs. Same caveat as RPM: the APT path is the most mature, and npm has no advisory feeds. |
Boundaries
| Area | Where the product stops |
|---|---|
| Per-snapshot CVE verdicts | Package-Master reports issuer advisories against the packages a snapshot holds. It does not produce a version-aware affected or not-affected verdict. |
| Updates in disconnected networks | Upstream sync and advisory updates require outbound access. Previously stored packages remain available internally. Physical transfer into fully disconnected networks is in development. |
| SBOM export, evidence packs, audit reports | Package-Master does not export SBOMs and does not produce evidence packs or audit reports. |
| Enterprise single sign-on | Authentication is role-based bearer tokens. Package-Master does not ship SAML or SCIM. |
| Application-layer SCA and CNAPP | Out of scope. Pair with tools that cover application dependencies and cloud posture. |
| Compliance certification | Out of scope. Package-Master does not certify your organization, and does not produce audit evidence. |