Skip to main content
emisar

Debian/Ubuntu package operations

v0.1.13

Operator pack for Debian/Ubuntu hosts. Read-only inventory and patching diagnostics, plus narrow apt install/remove actions for a single named package. Designed for production hosts where a human approver must see the package name before a write happens.

6 allowed by default 3 need approval by default
Pack ID
debian
Vendor
emisar
OS
linux
Actions
9
Required binaries. Install these on the host before relying on the pack — an action that calls a missing one fails at run time.
apt apt-get dpkg

Install

emisar pack install fetches this pack, re-validates it, and verifies its content hash against the --hash below — the exact bytes this page was rendered against, so a tampered copy is rejected — before copying it into the runner's packs dir. The command reloads a running daemon itself; no manual restart.

on the runner host 
sudo emisar pack install debian --hash sha256:27500074e0e21a8860610f44590737503cb52708842294f030c52d6f31526589

Setup

Operates on the local runner host — no credentials needed.

Host access

Run these commands yourself on the runner host. Emisar shows and copies setup recipes; it never runs them.

Update apt state and install or remove packages as root.

debian.apt_updatedebian.apt_installdebian.apt_removedebian.apt_autoremove

Run the Emisar service as root

Grant access 
sudo install -d -m 0755 /etc/systemd/system/emisar.service.d
printf '%s\n' '[Service]' 'User=root' 'Group=root' | sudo tee /etc/systemd/system/emisar.service.d/10-debian-host-access.conf >/dev/null
sudo systemctl daemon-reload
sudo systemctl restart emisar
Verify access 
test "$(systemctl show emisar --property=User --value)" = root

Impact: Every Emisar action on this runner executes as root. Package actions can run maintainer scripts and change any file or service those packages control.

Notes

  • Read-only inventory (dpkg_status, apt_upgradable, apt_security_check, kernel_info) needs no privilege.

Verify it works

Runs debian.dpkg_status, a low-risk read that confirms the pack can reach its target. Run it on the host once the pack is installed; pack install runs it for you.

on the runner host 
sudo emisar pack verify debian

Install and configure a pack walks through the whole sequence on a host.

Actions 9 total

View on GitHub
  • debian.apt_autoremove exec high High — service-affecting

    apt autoremove

    Drop packages that were installed as dependencies and are no longer required. Run after a series of removes. Considered high-risk because old kernels and headers are exactly the things autoremove cleans up — verify the running kernel is not on the removal list before approving.

    View source on GitHub
  • debian.apt_install exec high High — service-affecting

    apt install (one package)

    Install ONE named package non-interactively. Its maintainer scripts run as root and typically start or restart the service it ships. Args are restricted to one package — multi-package installs and arbitrary apt flags are intentionally not supported. Verify with `dpkg_status` afterward. Holds the apt lock for the duration; concurrent dpkg/apt operations will queue.

    View source on GitHub
  • debian.apt_remove exec high High — service-affecting

    apt remove (one package)

    Remove ONE named package non-interactively. Config files are kept (apt remove, not purge). For data-bearing packages this still drops the binaries — confirm via `dpkg_status` first that you are not removing a service still in use. Holds the apt lock.

    View source on GitHub
  • debian.apt_security_check exec low Low — read-only or trivially reversible

    Pending security upgrades

    List upgradable packages whose origin matches the security archive (`-security`). Read-only. Use as a one-shot patch-posture check. Requires `unattended-upgrades` or at minimum the security source enabled in /etc/apt/sources.list.

    View source on GitHub
  • debian.apt_update exec medium Medium — changes state, easily reversible

    apt-get update

    Refresh the apt package index from configured sources. Does not upgrade anything. Network-bound, may fail on a host behind a restrictive egress filter. Counts as medium-risk because it touches /var/lib/apt and a stale index can confuse later patching.

    View source on GitHub
  • debian.apt_upgradable exec low Low — read-only or trivially reversible

    List upgradable packages

    List packages that have an upgrade available based on the current apt index. Read-only — does NOT refresh the index. Pair with `apt_update` if you suspect the cache is stale.

    View source on GitHub
  • debian.dpkg_changes exec low Low — read-only or trivially reversible

    Recent dpkg installs/removes

    Show recent dpkg install / remove / upgrade activity across /var/log/dpkg.log and its rotated logs (.1 and .*.gz), returned in time order. Use to answer "what was changed on this host recently?" before deeper forensics. Read-only.

    View source on GitHub
  • debian.dpkg_status exec low Low — read-only or trivially reversible

    dpkg package status

    Return the dpkg status (installed version, architecture, depends, maintainer) for one named package. Read-only. The package name is pattern-restricted to safe Debian package syntax.

    View source on GitHub
  • debian.kernel_info exec low Low — read-only or trivially reversible

    Kernel + uptime + reboot-required

    Show kernel version (`uname -a`), uptime, and whether the host has /var/run/reboot-required (set by some packages — most often after a libc or kernel upgrade). Read-only. Use to plan a reboot window.

    View source on GitHub
← Back to registry
Pack reference  Publish your own