An APT mirror for Debian and Ubuntu

Pick the advisory feed of its distro, and in whitelist mode add an APT allow rule of *, then deny or kill what you do not want. Security updates are their own archive, like https://security.debian.org/debian-security. Clients put the mirror in their sources and the login in /etc/apt/auth.conf.d/:

# /etc/apt/sources.list
deb https://packages.example.com/apt/debian/ bookworm main

# /etc/apt/auth.conf.d/company.conf
machine packages.example.com/apt/ login your-user-name password <your token>

Two ways to hand out the index

By default each suite's InRelease goes out untouched, so apt keeps checking the distro's signature. Every package download is checked: the rules, the kill switch, holds, advisories and cooling off, then the .deb is checked against its SHA256, kept and scanned. The catch is that apt still sees every version, so it can pick one that is then refused.

Filtered index has the box check the distro's signature itself, then hand out Packages files of only what the rules and the kill switch allow, for amd64 and arm64, signed with the box's own key. Clients fetch that key from https://packages.example.com/apt/signing-key.asc into /etc/apt/keyrings/ and name it with signed-by. The key is made on first use and kept in the cache folder; if it is ever lost, every client has to fetch the new one.

What applies, and what does not

Rules, the kill switch, quarantine, malware scanning (the OSV known malicious check included), requests and auto approve all apply. Advisories come from OSV by source package, so libssl3 gets the advisories of openssl, in the feed you pick for each mirror: Debian 11, 12 or 13, or Ubuntu 20.04, 22.04, 24.04 or 26.04 LTS.

Honest limits: an APT index gives no publish times, so cooling off follows the A version with no publish time setting, which lets them through by default. The license of a Debian package is in its copyright file, not the index, so it counts as unknown under license policy. Filtered mode serves amd64 and arm64 only. Nothing is published here. Typosquat checks, provenance checks and the tree walk are not offered for APT.