Apt Inventory

@aaronge/apt-inventoryv2026.08.25.1· 1d agoMODELSREPORTS

01README

Observes APT package inventory and pending upgrades on Debian/apt-based Linux, with security-update classification, versioned delta reporting, debsecan CVE cross-checking, and a safety-gated install/remove for verified security updates. Verified on Raspberry Pi 5 / Debian 13 trixie, arm64.

02Models1

@aaronge/apt-inventoryv2026.08.25.5apt.ts

Global Arguments

Argument	Type	Required	Description
securityOrigin	string	yes	Substring matched against the origin field in `Inst` lines to classify
timeout	number	yes	Timeout in milliseconds for apt/dpkg subprocess calls. Apt operations
suite	string	yes	Debian release codename passed to debsecan's --suite flag. Unlike

fn query()

Reads currently installed packages via dpkg-query (read-only, no privileges).

fn listUpgradable()

Simulates a dist-upgrade via apt-get -s (no root, no system change) and classifies pending packages, including security relevance.

fn refresh()

Refreshes apt's package lists via `sudo apt-get update -qq` (root required; apt lists only, no other system changes). Produces no resource — run listUpgradable/query afterward to see updated state.

fn install(package: string, version?: string)

Installs a package via the root-owned `/usr/local/sbin/apt-security-install`

Argument	Type	Required	Description
package	string	yes	Package name to install.
version?	string	no	Exact version to install (e.g. `1:2.3.4-1`). If the package is already

fn remove(package: string)

Removes a package via `sudo DEBIAN_FRONTEND=noninteractive apt-get remove -y -qq` (root required; sudoers grants this for any package — no analogous safety gate to install's, since there's no equivalent notion of a 'verified safe' removal). Idempotent: no-ops if already absent. Produces a fresh `installed` snapshot either way.

Argument	Type	Required	Description
package	string	yes	Package name to remove.

fn scanVulnerabilities()

Runs debsecan against installed packages and cross-checks its fix-available claims against dpkg's own version comparison — debsecan's database doesn't understand vendor rebuild suffixes (e.g. Raspberry Pi OS's `+rptN`), which produces false positives (verified on this machine: every current fix-available entry is one). Read-only, no privileges (debsecan itself needs no root).

Resources

installed(infinite)— Snapshot of installed packages, per `dpkg-query`.

upgradable(infinite)— Packages apt would upgrade/install right now, per `apt-get -s -qq dist-upgrade`.

vulnerabilities(infinite)— Known CVEs against installed packages, per `debsecan`, cross-checked against dpkg's own version comparison to filter out vendor-rebuild false positives.

03Reports1

@aaronge/apt-inventory-deltamodel

apt_delta.ts

Total upgradable, security-relevant, and installed package counts, with the delta since the previous run.

aptinventory

04Stats

100 / 100

Downloads

Archive size

26.2 KB