Repository Tracking

Overview

Every Linux host configures one or more package repositories: sources.list entries on Debian/Ubuntu, .repo files under /etc/yum.repos.d/ on RHEL-family, repositories on Alpine, pacman.conf entries on Arch, and pkg sources on FreeBSD. PatchMon's agent inventories those repositories on every report and sends them up alongside the package list. The server aggregates the results into a single fleet-wide view on the Repositories page.

This page walks through the Repositories list and detail view, the filters, how security is determined, and how repository data is kept current.

Permission required: can_view_hosts to read repositories; can_manage_hosts to edit or delete repository records.

What a Repository Entry Represents

A repository record in PatchMon corresponds to a package source as reported by a host's package manager:

Multiple hosts configured with the same URL are collapsed into a single repository record in the fleet view, so you can see at a glance which hosts pull from a given source. The per-host relationship is tracked separately so you can drill in and see exactly where a repo is in use.

Key fields on a repository entry:

• Name: a human-friendly identifier (often the repo's Label or id).
• URL: the base URL the package manager fetches from.
• Distribution / release codename: e.g. jammy, el9, 3.19.
• Is Secure: true when the URL starts with https://, false for plaintext http://.
• Is Active: whether the repo is currently enabled on at least one host.
• Host count: number of hosts currently configured with this repo.

Getting to the Repositories Page

Click Repositories in the left navigation. You can also deep-link:

• /repositories?host=<hostId>: pre-filter to a single host's repositories.
• The Repos card on the Host Detail page and the source-repo chips on the Packages page both use these query-string shortcuts.

Summary Cards

Four cards at the top:

A low Security Score is a quick signal that you still have HTTP-only repositories in the fleet, which is a good target for remediation.

Filter Toolbar

• Search: free-text search across the repository name and URL (debounced, matched server-side).
• Host filter indicator: when ?host=<id> is set, a pill shows Filtered by: with an X to clear.
• Security: All Security Types / HTTPS Only / HTTP Only.
• Status: All Statuses / Active Only / Inactive Only.
• Columns: customise visible columns and their order.

Reading the Table

Default columns:

Column visibility and order are persisted per browser.

Clicking into a Repository

Clicking a repository opens /repositories/<id>, the Repository Detail page. It has three main sections stacked vertically:

Repository Details

• Name, Description, URL, Distribution, Is Active, Priority.
• Inline edit toggle (pencil icon, requires can_manage_hosts) lets you change the friendly name, description, active flag, and priority.
• Delete repository button opens a confirmation dialog.
• Top-right summary chips: secure / insecure, active / inactive, last updated.

Editing or deleting a repository from this screen affects the PatchMon record, not the underlying host configuration. The next time an agent reports, PatchMon will reconcile with what's actually on the host. If the repo is still configured on any host, it will reappear. Delete is most useful for stale records where no host actively uses the repo.

Hosts Using This Repository

A searchable, paginated list of every host that has this repository configured. Each row shows:

• Friendly name (link to the Host Detail page).
• Hostname and IP.
• OS and version icon.
• When the host last reported the repository.
• Any host-specific settings (priority override, enabled flag).

Use this view to answer "who's still pulling from this old mirror?" questions.

Packages from this Repository

A searchable, paginated list of every package PatchMon has seen delivered through this repository. Each row shows:

• Package name (link to the Package Detail page).
• Latest version.
• Status badge: Up to Date, Update Available, or Security Update.
• Source repo chip.

This is the easy way to audit "which packages on my fleet come from this third-party repository?"

How Repositories Are Kept Up-to-Date

Agents collect their repository configuration on every report cycle:

1. The agent runs package-manager introspection (apt-cache policy, dnf repolist, etc.).
2. The result is serialised and sent alongside the package inventory and system info.
3. The PatchMon server upserts repository records and updates the per-host link table:
   • New repositories appear.
   • Removed repositories are marked inactive (and retained as records, so historical package activity can still reference them).
   • URL or distribution changes are reconciled. If you change a URL in /etc/apt/sources.list, the next report updates it.

Because updates are report-driven, the Repositories page reflects the last known state. To force an immediate refresh for one host, open the host and click Fetch Report.

Security Filter in Practice

The HTTPS Only / HTTP Only filter is the quickest audit tool for enforcing secure package sources:

1. Set Security to HTTP Only.
2. The list now shows every plaintext repository in the fleet.
3. For each, click into the repo and use the Hosts Using This Repository list to see who needs reconfiguring.
4. Fix on the host (swap URL to HTTPS in the relevant .list / .repo / apk repositories file, update the distribution's certificate stores if needed), then run Fetch Report on the host.
5. The next report will move the host off the insecure record and onto the HTTPS one.

Some legitimate setups (for example, local intranet mirrors, or signed-but-insecure-transport repos such as classic Debian archives protected purely by GPG) are unavoidably HTTP. Use repository descriptions (via the edit dialog) to flag "approved HTTP" entries so future reviewers know they were considered.

Deleting a Repository Record

From the Repositories table or detail page, operators with can_manage_hosts can delete a record. The confirmation dialog lists the impact:

• The repository record is removed from PatchMon.
• Per-host links to that record are removed.
• The underlying host configuration is not changed; no file on the host is modified.

Because the agent re-reports every cycle, a delete is only permanent if no host actually has the repo configured any more. This is why the Inactive Only status filter is helpful: records with zero hosts are safe to tidy up, while records still tied to hosts will reappear after the next report.

Related Pages

• Package Inventory: browse packages, and use the repository chips there to jump to the repo detail.
• Host Detail Page: per-host repositories surface through the Repos summary card.
• Managing the PatchMon Agent: how the agent collects repository data on each report.
• Integration API Documentation: repositories are exposed as API objects for external tooling and compliance reporting.