Skip to main content
emisar

Debian/Ubuntu package operations

v0.1.5

Operator pack for Debian/Ubuntu hosts. Read-only inventory and patching diagnostics, plus narrow apt install/remove actions for a single named package. Designed for production hosts where a human approver must see the package name before a write happens.

6 allowed by default 3 need approval by default
Pack ID
debian
Vendor
emisar
OS
linux
Actions
9
Required binaries. Install these on the host before relying on the pack — an action that calls a missing one fails at run time.
apt-get dpkg

Install

emisar pack install fetches this pack, re-validates it, and verifies its content hash against the --hash below — the exact bytes this page was rendered against, so a tampered copy is rejected — before copying it into the runner's packs dir. The command reloads a running daemon itself; no manual restart.

on the runner host 
sudo emisar pack install debian --hash sha256:40e920d0a423e014ba1f12d5f57e6ca1ae64dd2da76402f7476d9d6a4a6c6e91

Actions 9 total

View on GitHub
  • debian.apt_autoremove exec high

    apt autoremove

    Drops packages that were installed as dependencies and are no longer required. Run after a series of removes. Considered high-risk because old kernels and headers are exactly the things autoremove cleans up — verify the running kernel is not on the removal list before approving.

    View source on GitHub
  • debian.apt_install exec high

    apt install (one package)

    Installs ONE named package non-interactively. Args are restricted to one package — multi-package installs and arbitrary apt flags are intentionally not supported. Verify with `dpkg_status` afterward. Holds the apt lock for the duration; concurrent dpkg/apt operations will queue.

    View source on GitHub
  • debian.apt_remove exec high

    apt remove (one package)

    Removes ONE named package non-interactively. Config files are kept (apt remove, not purge). For data-bearing packages this still drops the binaries — confirm via `dpkg_status` first that you are not removing a service still in use. Holds the apt lock.

    View source on GitHub
  • debian.apt_security_check exec low

    Pending security upgrades

    Lists upgradable packages whose origin matches the security archive (`-security`). Read-only. Use as a one-shot patch-posture check. Requires `unattended-upgrades` or at minimum the security source enabled in /etc/apt/sources.list.

    View source on GitHub
  • debian.apt_update exec medium

    apt-get update

    Refreshes the apt package index from configured sources. Does not upgrade anything. Network-bound, may fail on a host behind a restrictive egress filter. Counts as medium-risk because it touches /var/lib/apt and a stale index can confuse later patching.

    View source on GitHub
  • debian.apt_upgradable exec low

    List upgradable packages

    Lists packages that have an upgrade available based on the current apt index. Read-only — does NOT refresh the index. Pair with `apt_update` if you suspect the cache is stale.

    View source on GitHub
  • debian.dpkg_changes exec low

    Recent dpkg installs/removes

    Show recent dpkg install / remove / upgrade activity across /var/log/dpkg.log and its rotated logs (.1 and .*.gz), returned in time order. Use to answer "what was changed on this host recently?" before deeper forensics. Read-only.

    View source on GitHub
  • debian.dpkg_status exec low

    dpkg package status

    Returns the dpkg status (installed version, architecture, depends, maintainer) for one named package. Read-only. The package name is pattern-restricted to safe Debian package syntax.

    View source on GitHub
  • debian.kernel_info exec low

    Kernel + uptime + reboot-required

    Show kernel version (`uname -a`), uptime, and whether the host has /var/run/reboot-required (set by some packages — most often after a libc or kernel upgrade). Read-only. Use to plan a reboot window.

    View source on GitHub
← Back to registry
Pack reference Publish your own →