aptly
What it is
aptly manages Debian package repositories and publishes controlled package sets for systems that use apt. It can mirror remote repositories, maintain local repositories, pull selected package versions with dependencies, and publish repositories. Immutable snapshots can be compared, merged, filtered, searched, and used to create repeatable package environments with controlled changes and rollback to earlier versions. Mirroring supports regular and flat repositories over HTTP(S) and FTP, with filters for architectures, components, and packages. Packages from mirrors and local repositories are kept in a deduplicated pool that can be searched and cleaned up. Repositories can be published to local storage, Amazon S3, OpenStack Swift, Azure, or JFrog Artifactory Storage, and signed with a user-provided GnuPG key. aptly is available free as a CLI tool and HTTP REST service, with downloads listed for Linux, macOS, and FreeBSD. Its REST API has no authentication or protection; the documentation warns against exposing it to the internet without a proxy that adds HTTPS and authentication. The embedded aptly serve web server is described as unsuitable for production use.
For and against
For
- Free CLI tool and HTTP REST service
- Snapshots support comparisons, merges, and rollback
- Publishes to local and cloud storage destinations
- Package pool is deduplicated
Against
- REST API has no authentication or protection
- Embedded web server is unsuitable for production
- Publishing requires a user-provided GnuPG key
The verdict
aptly offers repository mirroring, snapshot management, and publishing for apt-based package workflows. Secure the REST API behind a proxy with HTTPS and authentication, and do not rely on the embedded web server for production.
Who it suits
aptly is intended for people maintaining controlled package environments and publishing repositories consumed by apt on Debian systems. It may suit administrators who need snapshots, repository mirroring, or publishing to listed storage destinations.
Plans and prices
Aptly
Free to try · CLI tool · HTTP REST service
Read 9 Oct 2026 · aptly.info
On the record
- API security
- The REST API documentation warns that the API has no authentication or protection and should not be exposed to the internet without a proxy that adds HTTPS and authentication.aptly.info · read 9 Oct 2026
- Cloud storage
- Repositories can be published to Amazon S3, OpenStack Swift, Azure, or JFrog Artifactory Storage.aptly.info · read 9 Oct 2026
- Download caveat
- The site says Debian and Ubuntu packages may lack some features depending on available Go dependencies.aptly.info · read 9 Oct 2026
- Download platforms
- The download page lists packages for Debian and Ubuntu, Homebrew for Mac OS X, and binary releases for Linux, macOS, and FreeBSD.aptly.info · read 9 Oct 2026
- Free availability
- The site says aptly can be tried for free and is available as a CLI tool and an HTTP REST service.aptly.info · read 9 Oct 2026
- Integrations
- The integrations page lists community tools and examples including Molior, OpenAPT, Docker, Ansible, Chef, Puppet, and SaltStack.aptly.info · read 9 Oct 2026
- Intended users
- The overview describes aptly as a tool for maintaining repeatable, controlled package environments and publishing repositories consumed by apt on Debian systems.aptly.info · read 9 Oct 2026
- Linux packages
- The download page provides packages for Debian and Ubuntu distributions, including bullseye, bookworm, trixie, focal, jammy, noble, and resolute.aptly.info · read 9 Oct 2026
- Other downloads
- The download page lists binary releases for Generic Linux, FreeBSD, and Mac OS X, and Homebrew installation for Mac OS X.aptly.info · read 9 Oct 2026
- Package storage
- Packages from mirrors and local repositories are stored in a deduplicated package pool that can be searched and cleaned up.aptly.info · read 9 Oct 2026
- Production serving limit
- The embedded aptly serve web server is described as unsuitable for production use.aptly.info · read 9 Oct 2026
- Project history
- The aptly project was founded by Andrey Smirnov in 2013 and has received contributions from more than 45 developers.aptly.info · read 9 Oct 2026
- Publishing destinations
- Repositories can be published to local storage, Amazon S3, OpenStack Swift, Azure, or JFrog Artifactory Storage.aptly.info · read 9 Oct 2026
- Purpose
- aptly manages Debian repositories by mirroring remote repositories, managing local package repositories, taking snapshots, pulling package versions with dependencies, and publishing repositories.aptly.info · read 9 Oct 2026
- Repeatable package environments
- aptly creates fixed package sets for deterministic installation and upgrades, with controlled changes and rollback to earlier versions.aptly.info · read 9 Oct 2026
- Repository mirroring
- It mirrors regular and flat repositories over HTTP(S) and FTP, with options to select architectures, components, and packages using filters.aptly.info · read 9 Oct 2026
- Repository publishing
- Published repositories can be served over HTTP, FTP, or rsync, and can be consumed directly by apt.aptly.info · read 9 Oct 2026
- Repository signing
- Published repositories are signed with a user-provided GnuPG key, which must be generated before publishing.aptly.info · read 9 Oct 2026
