diff --git a/.cargo/audit.toml b/.cargo/audit.toml
index 9e353b7e..ba6b8868 100644
--- a/.cargo/audit.toml
+++ b/.cargo/audit.toml
@@ -4,7 +4,14 @@
 [advisories]
 ignore = [
     # rsa 0.9 Marvin timing side channel (no fixed release): a dev-dependency
-    # only (forge-core, forge-server and forge-e2e tests sign test JWTs with
-    # it); not in the shipped forge-server binary.
+    # (forge-core, forge-server and forge-e2e tests sign test JWTs with it),
+    # and linked into forge-server by rPGP (pgp, apt's signing keys), which
+    # never signs or decrypts with RSA there: Forge's signing keys are Ed25519,
+    # generated or imported (other algorithms are refused).
     "RUSTSEC-2023-0071",
+    # crypto-bigint 0.5 timing variability (no fixed 0.5 release): linked by
+    # rPGP (pgp) for its NIST-curve and X448 support (elliptic-curve 0.13,
+    # cx448), which forge-server never uses with a secret key: apt's signing
+    # keys are Ed25519 (curve25519-dalek), other algorithms are refused.
+    "RUSTSEC-2026-0387",
 ]
diff --git a/.github/scripts/apt-e2e.sh b/.github/scripts/apt-e2e.sh
new file mode 100755
index 00000000..62a3a8a7
--- /dev/null
+++ b/.github/scripts/apt-e2e.sh
@@ -0,0 +1,325 @@
+#!/usr/bin/env bash
+# End-to-end check of apt repositories with the real apt-get (used by
+# ci.yml): boots forge-server, then
+#
+#   1. hosted: uploads packages built with dpkg-deb (Nexus' raw-body POST
+#      and a PUT), refuses a redeploy and path traversal, verifies InRelease
+#      and Release.gpg with gpgv against the repository's key.gpg, and in a
+#      debian:bookworm container adds the source with signed-by and
+#      credentials in /etc/apt/auth.conf.d, runs apt-get update (no warning),
+#      installs a package, and upgrades it after a newer version is uploaded;
+#   2. key rotation: adds a second signing key; InRelease and Release.gpg
+#      verify with either key alone, and apt-get update trusting only the
+#      old key still has no warning; the old key is then deleted;
+#   3. proxy: a mock Debian mirror (dpkg-scanpackages, signed with its own
+#      key, by-hash copies) behind a proxy repository; apt-get installs
+#      through it, then installs again in a fresh container while the mirror
+#      is down.
+#
+# Usage: apt-e2e.sh <forge-server binary> <results dir>
+# Needs on PATH: curl, jq, python3, docker, dpkg-deb, dpkg-scanpackages,
+# gpg, gpgv, sha256sum, gzip, openssl. Postgres and S3 come from the
+# environment (defaults match ci.yml):
+#   FORGE_E2E_DATABASE_URL  (postgres://forge:forge@localhost:5432/forge)
+#   FORGE_E2E_S3_ENDPOINT   (http://localhost:7070), access/secret forge-e2e-key
+#   FORGE_E2E_PORT          (8441: forge-server's)
+#   FORGE_E2E_MIRROR_PORT   (5031: the mock mirror's)
+set -euo pipefail
+
+server_bin="$(realpath "$1")"
+results="$(mkdir -p "$2" && realpath "$2")"
+db_url="${FORGE_E2E_DATABASE_URL:-postgres://forge:forge@localhost:5432/forge}"
+s3_endpoint="${FORGE_E2E_S3_ENDPOINT:-http://localhost:7070}"
+port="${FORGE_E2E_PORT:-8441}"
+mirror_port="${FORGE_E2E_MIRROR_PORT:-5031}"
+base="http://127.0.0.1:$port"
+admin_password="e2e-$(openssl rand -hex 12)"
+# Docker Hub images come through mirror.gcr.io (AGENTS.md), pinned.
+debian_image="mirror.gcr.io/library/debian:bookworm@sha256:d74df7598108a173a621eda4d58a2adbf850b2d9a9d81bc2cca1a6c21174a880"
+
+work=$(mktemp -d)
+server_pid=""
+mirror_pid=""
+cleanup() {
+  if [ -n "$server_pid" ]; then kill "$server_pid" 2>/dev/null || true; fi
+  if [ -n "$mirror_pid" ]; then kill "$mirror_pid" 2>/dev/null || true; fi
+  cp "$work/server.log" "$work/mirror.log" "$work"/apt-*.log "$results/" 2>/dev/null || true
+  rm -rf "$work"
+}
+trap cleanup EXIT
+
+step() { echo; echo "── $* ──"; }
+fail() { echo "FAIL: $*" >&2; exit 1; }
+expect_status() { # <status> <curl args...>
+  local want=$1
+  shift
+  local got
+  got=$(curl -sS -o "$work/body" -w '%{http_code}' "$@")
+  [ "$got" = "$want" ] || fail "curl $* answered $got, not $want: $(head -c 300 "$work/body")"
+}
+
+# A binary package <name> <version> <arch> [section] in $work/debs.
+deb() {
+  local name=$1 version=$2 arch=$3 section=${4:-utils}
+  local dir="$work/build/${name}_${version}_${arch}"
+  mkdir -p "$dir/DEBIAN" "$dir/usr/bin" "$work/debs"
+  printf '#!/bin/sh\necho "%s %s"\n' "$name" "$version" > "$dir/usr/bin/$name"
+  chmod 755 "$dir/usr/bin/$name"
+  cat > "$dir/DEBIAN/control" <<EOF
+Package: $name
+Version: $version
+Architecture: $arch
+Maintainer: Forge e2e <forge@example.com>
+Section: $section
+Priority: optional
+Description: $name for the apt e2e
+ A package built by apt-e2e.sh.
+EOF
+  dpkg-deb -Zxz --build --root-owner-group "$dir" "$work/debs/${name}_${version}_${arch}.deb" >/dev/null
+}
+
+# Run <script> in a fresh debian:bookworm container on the host's network,
+# with the files of $work/client mounted at /client; its output goes to
+# $work/apt-<label>.log, which must hold no apt warning or error.
+apt_container() { # <label> <script>
+  local label=$1 script=$2
+  printf 'set -eu\n%s\n' "$script" > "$work/client/run.sh"
+  if ! docker run --rm --network host -v "$work/client:/client:ro" "$debian_image" \
+      sh /client/run.sh > "$work/apt-$label.log" 2>&1; then
+    cat "$work/apt-$label.log"
+    fail "apt in a container ($label)"
+  fi
+  if grep -E '^(W|E): ' "$work/apt-$label.log"; then
+    cat "$work/apt-$label.log"
+    fail "apt warned ($label)"
+  fi
+  cat "$work/apt-$label.log"
+}
+
+# The shell lines that point a container's apt at one source only.
+apt_source() { # <sources.list line> [auth.conf entry]
+  cat <<EOF
+mkdir -p /etc/apt/only.d
+echo '$1' > /etc/apt/only.d/forge.list
+printf 'Dir::Etc::SourceParts "/etc/apt/only.d";\nDir::Etc::SourceList "/dev/null";\n' > /etc/apt/apt.conf.d/99only
+EOF
+  if [ -n "${2:-}" ]; then
+    printf "printf '%s' > /etc/apt/auth.conf.d/forge.conf\nchmod 600 /etc/apt/auth.conf.d/forge.conf\n" "$2"
+  fi
+}
+
+step "start forge-server"
+head -c 32 /dev/urandom | base64 > "$work/root.key"
+cat > "$work/forge.toml" <<EOF
+[server]
+bind = "127.0.0.1:$port"
+public_base_url = "$base"
+[database]
+url = "$db_url"
+[s3]
+endpoint = "$s3_endpoint"
+region = "us-east-1"
+bucket = "forge-apt-e2e"
+access_key = "forge-e2e-key"
+secret_key = "forge-e2e-secret"
+force_path_style = true
+[crypto.root]
+provider = "file"
+root_key_path = "$work/root.key"
+[auth.bootstrap_admin]
+username = "admin@example.com"
+password = "$admin_password"
+[outbox]
+grace_seconds = 0
+poll_interval_seconds = 2
+EOF
+FORGE_CONFIG="$work/forge.toml" RUST_LOG=info "$server_bin" > "$work/server.log" 2>&1 &
+server_pid=$!
+for _ in $(seq 1 60); do
+  if curl -fsS "$base/healthz" >/dev/null 2>&1; then break; fi
+  sleep 1
+done
+curl -fsS "$base/readyz" >/dev/null || { cat "$work/server.log"; fail "server not ready"; }
+
+step "create repositories and an API token"
+login=$(curl -fsS -c "$work/jar" -H 'content-type: application/json' \
+  -d "{\"username\":\"admin@example.com\",\"password\":\"$admin_password\"}" "$base/auth/login")
+csrf=$(jq -r .csrf_token <<<"$login")
+admin() { # <method> <path> [json body]
+  curl -fsS -b "$work/jar" -H "x-csrf-token: $csrf" -H 'content-type: application/json' \
+    -X "$1" "$base$2" ${3:+-d "$3"}
+}
+token=$(admin POST /admin/me/tokens '{"name":"apt-e2e"}' | jq -r .token)
+auth=(-u "admin@example.com:$token")
+admin POST /admin/repositories \
+  '{"name":"apt-internal","kind":"hosted","format":"apt","options":{"distribution":"bookworm"}}' >/dev/null
+repo="$base/repository/apt-internal"
+mkdir -p "$work/client"
+# apt sends credentials over plain HTTP only to a machine written with http://.
+auth_conf="machine $base/repository/apt-internal\nlogin admin@example.com\npassword $token\n"
+
+step "hosted: upload, redeploy, path traversal"
+deb forge-hello 1.0-1 all
+deb forge-hello 1.1-1 all
+deb forge-tool 2.0-1 amd64 contrib/utils
+expect_status 401 -H "Content-Type: multipart/form-data" --data-binary "@$work/debs/forge-hello_1.0-1_all.deb" "$repo/"
+expect_status 201 "${auth[@]}" -H "Content-Type: multipart/form-data" \
+  --data-binary "@$work/debs/forge-hello_1.0-1_all.deb" "$repo/"
+expect_status 201 "${auth[@]}" --upload-file "$work/debs/forge-tool_2.0-1_amd64.deb" "$repo/"
+expect_status 409 "${auth[@]}" -H "Content-Type: multipart/form-data" \
+  --data-binary "@$work/debs/forge-hello_1.0-1_all.deb" "$repo/"
+expect_status 400 "${auth[@]}" --data-binary "not a package" "$repo/"
+for path in \
+  "dists/bookworm/../../../etc/passwd" \
+  "dists/%2e%2e/bookworm/InRelease" \
+  "pool/main/f/forge-hello/%2e%2e/forge-hello_1.0-1_all.deb" \
+  "pool/main/f%2Fforge-hello/forge-hello_1.0-1_all.deb" \
+  "pool//main/f/forge-hello/forge-hello_1.0-1_all.deb" \
+  "pool/main/f/forge-hello/..%5cforge-hello_1.0-1_all.deb"; do
+  got=$(curl -sS --path-as-is -o /dev/null -w '%{http_code}' "${auth[@]}" "$repo/$path")
+  case "$got" in 400 | 404) ;; *) fail "GET $path answered $got" ;; esac
+done
+got=$(curl -sS --path-as-is -o /dev/null -w '%{http_code}' "${auth[@]}" \
+  --upload-file "$work/debs/forge-hello_1.1-1_all.deb" "$repo/%2e%2e/x.deb")
+case "$got" in 400 | 404) ;; *) fail "PUT through %2e%2e answered $got" ;; esac
+
+step "hosted: the indexes verify with gpgv"
+curl -fsS "${auth[@]}" -o "$work/key-old.gpg" "$repo/key.gpg"
+curl -fsS "${auth[@]}" -o "$work/client/key-old.asc" "$repo/key.asc"
+curl -fsS "${auth[@]}" -o "$work/InRelease" "$repo/dists/bookworm/InRelease"
+curl -fsS "${auth[@]}" -o "$work/Release" "$repo/dists/bookworm/Release"
+curl -fsS "${auth[@]}" -o "$work/Release.gpg" "$repo/dists/bookworm/Release.gpg"
+gpgv --keyring "$work/key-old.gpg" "$work/InRelease"
+gpgv --keyring "$work/key-old.gpg" "$work/Release.gpg" "$work/Release"
+grep -q '^Acquire-By-Hash: yes$' "$work/Release" || fail "Release without Acquire-By-Hash"
+grep -q '^Components: contrib main$' "$work/Release" || fail "Release components: $(cat "$work/Release")"
+# Every file Release names is there with its digest, by name and by hash.
+awk '/^SHA256:/{on=1;next} /^[^ ]/{on=0} on{print $1, $3}' "$work/Release" | while read -r sha path; do
+  [ "$(curl -fsS "${auth[@]}" "$repo/dists/bookworm/$path" | sha256sum | cut -d' ' -f1)" = "$sha" ] \
+    || fail "$path does not match Release"
+  [ "$(curl -fsS "${auth[@]}" "$repo/dists/bookworm/$(dirname "$path")/by-hash/SHA256/$sha" | sha256sum | cut -d' ' -f1)" = "$sha" ] \
+    || fail "$path by hash does not match Release"
+done
+
+step "hosted: apt-get update, install, upgrade (debian:bookworm)"
+docker pull -q "$debian_image" >/dev/null
+hosted_source=$(apt_source "deb [signed-by=/client/key-old.asc] $repo/ bookworm main contrib" "$auth_conf")
+apt_container hosted-install "$hosted_source
+apt-get update
+apt-get install -y forge-hello forge-tool
+forge-hello | grep -qx 'forge-hello 1.0-1'
+forge-tool | grep -qx 'forge-tool 2.0-1'
+echo 'installed 1.0-1'
+while [ ! -f /client/newer ]; do sleep 1; done
+apt-get update
+apt-get install -y --only-upgrade forge-hello
+forge-hello | grep -qx 'forge-hello 1.1-1'
+echo 'upgraded to 1.1-1'" &
+container=$!
+# Upload the newer version while the container waits.
+for _ in $(seq 1 120); do
+  grep -q 'installed 1.0-1' "$work/apt-hosted-install.log" 2>/dev/null && break
+  kill -0 "$container" 2>/dev/null || break
+  sleep 1
+done
+expect_status 201 "${auth[@]}" -H "Content-Type: multipart/form-data" \
+  --data-binary "@$work/debs/forge-hello_1.1-1_all.deb" "$repo/"
+touch "$work/client/newer"
+wait "$container" || fail "the install and upgrade failed"
+grep -q 'upgraded to 1.1-1' "$work/apt-hosted-install.log" || fail "no upgrade"
+rm -f "$work/client/newer"
+
+step "key rotation: both keys sign until the old one is deleted"
+old=$(admin GET /admin/repositories/apt-internal/signing-keys | jq -r '.[0].fingerprint')
+new=$(admin POST /admin/repositories/apt-internal/signing-keys '{}' | jq -r .fingerprint)
+[ "$old" != "$new" ] || fail "no new key"
+admin GET /admin/repositories/apt-internal/signing-keys \
+  | jq -r ".[] | select(.fingerprint == \"$new\") | .public_key" | gpg --dearmor > "$work/key-new.gpg"
+curl -fsS "${auth[@]}" -o "$work/InRelease" "$repo/dists/bookworm/InRelease"
+curl -fsS "${auth[@]}" -o "$work/Release" "$repo/dists/bookworm/Release"
+curl -fsS "${auth[@]}" -o "$work/Release.gpg" "$repo/dists/bookworm/Release.gpg"
+# gpgv exits 2 when it cannot check one of the signatures (a key it does
+# not have), as a client trusting one key of the rollover sees it; apt
+# accepts the file when one signature is good.
+good() { # <gpgv args...>: how many signatures verify
+  local out
+  out=$(gpgv "$@" 2>&1 || true)
+  grep -c 'Good signature' <<<"$out" || true
+}
+for keyring in "$work/key-old.gpg" "$work/key-new.gpg"; do
+  [ "$(good --keyring "$keyring" "$work/InRelease")" = 1 ] || fail "InRelease with $keyring"
+  [ "$(good --keyring "$keyring" "$work/Release.gpg" "$work/Release")" = 1 ] \
+    || fail "Release.gpg with $keyring"
+done
+[ "$(good --keyring "$work/key-old.gpg" --keyring "$work/key-new.gpg" "$work/InRelease")" = 2 ] \
+  || fail "InRelease is not signed by both keys"
+curl -fsS "${auth[@]}" -o "$work/client/key-both.asc" "$repo/key.asc"
+apt_container rotation "$hosted_source
+apt-get update
+apt-cache policy forge-hello | grep -q 'Candidate: 1.1-1'"
+expect_status 204 -b "$work/jar" -H "x-csrf-token: $csrf" -X DELETE \
+  "$base/admin/repositories/apt-internal/signing-keys/$old"
+expect_status 409 -b "$work/jar" -H "x-csrf-token: $csrf" -X DELETE \
+  "$base/admin/repositories/apt-internal/signing-keys/$new"
+curl -fsS "${auth[@]}" -o "$work/InRelease" "$repo/dists/bookworm/InRelease"
+gpgv --keyring "$work/key-new.gpg" "$work/InRelease"
+if gpgv --keyring "$work/key-old.gpg" "$work/InRelease" 2>/dev/null; then
+  fail "the deleted key still signs"
+fi
+
+step "proxy: a mock mirror, signed with its own key"
+export GNUPGHOME="$work/gnupg"
+mkdir -m 700 "$GNUPGHOME"
+gpg --batch --passphrase '' --quick-gen-key 'Mock Mirror <mirror@example.com>' ed25519 sign never 2>/dev/null
+gpg --export > "$work/client/mirror.gpg"
+mirror="$work/mirror/debian"
+deb mirror-pkg 3.0-1 amd64
+mkdir -p "$mirror/pool/main/m/mirror-pkg" "$mirror/dists/bookworm/main/binary-amd64"
+cp "$work/debs/mirror-pkg_3.0-1_amd64.deb" "$mirror/pool/main/m/mirror-pkg/"
+(cd "$mirror" && dpkg-scanpackages --arch amd64 pool > dists/bookworm/main/binary-amd64/Packages 2>/dev/null)
+gzip -9kn "$mirror/dists/bookworm/main/binary-amd64/Packages"
+{
+  echo "Origin: Mock"
+  echo "Suite: bookworm"
+  echo "Codename: bookworm"
+  echo "Date: $(date -Ru)"
+  echo "Architectures: amd64"
+  echo "Components: main"
+  echo "Acquire-By-Hash: yes"
+  echo "SHA256:"
+  for f in main/binary-amd64/Packages main/binary-amd64/Packages.gz; do
+    sha=$(sha256sum "$mirror/dists/bookworm/$f" | cut -d' ' -f1)
+    printf ' %s %s %s\n' "$sha" "$(stat -c %s "$mirror/dists/bookworm/$f")" "$f"
+    mkdir -p "$mirror/dists/bookworm/main/binary-amd64/by-hash/SHA256"
+    cp "$mirror/dists/bookworm/$f" "$mirror/dists/bookworm/main/binary-amd64/by-hash/SHA256/$sha"
+  done
+} > "$mirror/dists/bookworm/Release"
+gpg --batch --yes --clearsign -o "$mirror/dists/bookworm/InRelease" "$mirror/dists/bookworm/Release"
+python3 -u -m http.server "$mirror_port" --bind 127.0.0.1 --directory "$work/mirror" > "$work/mirror.log" 2>&1 &
+mirror_pid=$!
+for _ in $(seq 1 30); do
+  curl -fsS "http://127.0.0.1:$mirror_port/debian/dists/bookworm/Release" >/dev/null 2>&1 && break
+  sleep 1
+done
+admin POST /admin/repositories "{\"name\":\"debian-proxy\",\"kind\":\"proxy\",\"format\":\"apt\",
+  \"remote_url\":\"http://127.0.0.1:$mirror_port/debian\",\"options\":{\"distribution\":\"bookworm\"}}" >/dev/null
+proxy="$base/repository/debian-proxy"
+cmp <(curl -fsS "${auth[@]}" "$proxy/dists/bookworm/InRelease") "$mirror/dists/bookworm/InRelease" \
+  || fail "the proxy changed InRelease"
+proxy_auth="machine $base/repository/debian-proxy\nlogin admin@example.com\npassword $token\n"
+proxy_source=$(apt_source "deb [signed-by=/client/mirror.gpg] $proxy/ bookworm main" "$proxy_auth")
+apt_container proxy-install "$proxy_source
+apt-get update
+apt-get install -y mirror-pkg
+mirror-pkg | grep -qx 'mirror-pkg 3.0-1'"
+
+step "proxy: installs again while the mirror is down"
+kill "$mirror_pid"
+wait "$mirror_pid" 2>/dev/null || true
+mirror_pid=""
+apt_container proxy-down "$proxy_source
+apt-get update
+apt-get install -y mirror-pkg
+mirror-pkg | grep -qx 'mirror-pkg 3.0-1'"
+
+step "all apt e2e checks passed"
diff --git a/.github/scripts/ci-changes.sh b/.github/scripts/ci-changes.sh
index 6dc3ff40..adf17311 100755
--- a/.github/scripts/ci-changes.sh
+++ b/.github/scripts/ci-changes.sh
@@ -42,7 +42,7 @@ CI=.github/workflows/ci.yml
 declare -A CI_JOB_GROUP=(
     [fmt]=changelog [clippy]=rust [audit]=audit [test]=rust
     [docker-platform]=image [docker]=image [kubernetes]=kubernetes [web]=web
-    [oci-e2e]=rust [raw-e2e]=rust [npm-e2e]=rust [e2e]=rust [web-e2e]=web
+    [oci-e2e]=rust [raw-e2e]=rust [apt-e2e]=rust [npm-e2e]=rust [e2e]=rust [web-e2e]=web
 )
 
 # Rust: the workspace, what its build and tests read from outside the crates
@@ -55,7 +55,7 @@ RUST=(
     web/index.html docker/forge.docker.toml
     .github/scripts/test-parallel.sh .github/scripts/test-timings-runner.sh
     .github/scripts/test-timings-summary.sh .github/scripts/oci-e2e.sh
-    .github/scripts/raw-e2e.sh .github/scripts/npm-e2e.sh
+    .github/scripts/raw-e2e.sh .github/scripts/apt-e2e.sh .github/scripts/npm-e2e.sh
 )
 # fmt's other checks: the changelog fragments, and the links of the
 # documentation site's pages (the README, docs/, the READMEs under deploy/ and
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 6d41dbd0..9460e0d6 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -586,8 +586,8 @@ jobs:
       - name: Cache cargo registry + dependency builds
         uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
         with:
-          # raw-e2e, npm-e2e, oci-e2e and web-e2e build the same debug
-          # forge-server.
+          # raw-e2e, apt-e2e, npm-e2e, oci-e2e and web-e2e build the same
+          # debug forge-server.
           shared-key: forge-server
           save-if: false
       - name: Start the S3 gateway
@@ -607,6 +607,65 @@ jobs:
           path: raw-e2e-results
           retention-days: 7
 
+  # ── apt repositories e2e (apt-get in debian:bookworm against a live server)
+  # Boots forge-server and drives apt repositories with the real apt-get in a
+  # debian:bookworm container: uploads (Nexus' raw-body POST and a PUT) of
+  # packages built with dpkg-deb, the redeploy refusal and path traversal,
+  # InRelease and Release.gpg verified with gpgv, apt-get update (no warning),
+  # install and upgrade with signed-by and auth.conf.d credentials, a signing
+  # key rotation, and a proxy of a mock mirror (signed with its own key)
+  # installing again while the mirror is down (.github/scripts/apt-e2e.sh).
+  apt-e2e:
+    name: apt-e2e
+    runs-on: ubuntu-latest
+    needs: changes
+    if: ${{ !cancelled() && needs.changes.outputs.rust != 'false' }}
+    services:
+      postgres:
+        image: mirror.gcr.io/library/postgres:18@sha256:edb0c08dc33befd0262ab3b5cf1c4f3f8cfd8b09e88c05b45adee29d6761ddb6
+        env:
+          POSTGRES_DB: forge
+          POSTGRES_USER: forge
+          POSTGRES_PASSWORD: forge
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd "pg_isready -U forge -d forge"
+          --health-interval 5s
+          --health-timeout 5s
+          --health-retries 10
+    env:
+      SQLX_OFFLINE: "true"
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Rust toolchain (rust-toolchain.toml)
+        uses: dtolnay/rust-toolchain@d124f86f28ff42855784ff3319f48ac182c248f8 # 1.99.1
+      - name: Cache cargo registry + dependency builds
+        uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
+        with:
+          # apt-e2e, raw-e2e, npm-e2e, oci-e2e and web-e2e build the same
+          # debug forge-server.
+          shared-key: forge-server
+          save-if: false
+      - name: dpkg-scanpackages (for the mock mirror)
+        run: command -v dpkg-scanpackages || (sudo apt-get update && sudo apt-get install -y dpkg-dev)
+      - name: Start the S3 gateway
+        run: |
+          docker run -d --name forge-e2e-s3 -p 7070:7070 \
+            mirror.gcr.io/versity/versitygw:v1.4.1@sha256:0400cb59f59da0f1cf9f7fd49505191abc348dfadf54509bf1988caaff4eb96f \
+            --port :7070 --access forge-e2e-key --secret forge-e2e-secret posix /tmp
+      - name: cargo build -p forge-server
+        run: cargo build -p forge-server --bin forge-server
+      - name: apt e2e with apt-get and gpgv (hosted, signing keys, proxy)
+        run: .github/scripts/apt-e2e.sh target/debug/forge-server apt-e2e-results
+      - name: Upload the server, mirror and apt logs
+        if: always()
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: apt-e2e-results
+          path: apt-e2e-results
+          retention-days: 7
+
   # ── npm registries e2e (npm, pnpm and Yarn against a live server) ─────────
   # Boots forge-server and a mock upstream registry, and drives npm
   # repositories with the real clients: npm's web login and Yarn's legacy
@@ -642,8 +701,8 @@ jobs:
       - name: Cache cargo registry + dependency builds
         uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
         with:
-          # npm-e2e, raw-e2e, oci-e2e and web-e2e build the same debug
-          # forge-server.
+          # npm-e2e, raw-e2e, apt-e2e, oci-e2e and web-e2e build the same
+          # debug forge-server.
           shared-key: forge-server
           save-if: false
       - name: Setup pnpm
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index fd797c89..bf9bcbcd 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -93,7 +93,7 @@ jobs:
       DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
       # The `name:` of every ci.yml job that runs on the default branch. The
       # required status checks in DEVELOPMENT.md (merge queue) list the same.
-      REQUIRED_JOBS: fmt clippy audit test docker kubernetes web oci-e2e raw-e2e npm-e2e e2e web-e2e
+      REQUIRED_JOBS: fmt clippy audit test docker kubernetes web oci-e2e raw-e2e apt-e2e npm-e2e e2e web-e2e
     steps:
       - name: Wait for the commit's CI run and check its jobs
         shell: bash # -eo pipefail: a failing gh call fails the step
diff --git a/.sqlx/query-1d6cf687e785d880b8bff0305e68a1378ead641fd8af96ac1d4b1ba08dc14fb6.json b/.sqlx/query-1d6cf687e785d880b8bff0305e68a1378ead641fd8af96ac1d4b1ba08dc14fb6.json
new file mode 100644
index 00000000..dfdf8650
--- /dev/null
+++ b/.sqlx/query-1d6cf687e785d880b8bff0305e68a1378ead641fd8af96ac1d4b1ba08dc14fb6.json
@@ -0,0 +1,30 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n        DELETE FROM raw_file\n        WHERE repository_id = $1\n          AND NOT (path = ANY($2))\n          AND (NOT immutable\n               OR checked_at IS NULL\n               OR checked_at < now() - make_interval(secs => $3))\n        RETURNING blob_sha256\n        ",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "blob_sha256",
+        "type_info": "Text",
+        "origin": {
+          "Table": {
+            "table": "raw_file",
+            "name": "blob_sha256"
+          }
+        }
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Int8",
+        "TextArray",
+        "Float8"
+      ]
+    },
+    "nullable": [
+      false
+    ]
+  },
+  "hash": "1d6cf687e785d880b8bff0305e68a1378ead641fd8af96ac1d4b1ba08dc14fb6"
+}
diff --git a/.sqlx/query-273a55548f16aa07d44458ec0882b1a8dc0c2d19bfe31f08a98d5375f772a07f.json b/.sqlx/query-273a55548f16aa07d44458ec0882b1a8dc0c2d19bfe31f08a98d5375f772a07f.json
new file mode 100644
index 00000000..45af6708
--- /dev/null
+++ b/.sqlx/query-273a55548f16aa07d44458ec0882b1a8dc0c2d19bfe31f08a98d5375f772a07f.json
@@ -0,0 +1,24 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n        SELECT md5(coalesce(string_agg(\n                   c.id::text || ':' || c.version || ':' || a.blob_sha256 || ':'\n                       || c.updated_at::text,\n                   ',' ORDER BY c.id), '')) AS \"digest!\"\n        FROM component c\n        JOIN asset a ON a.component_id = c.id AND a.path = $2\n        WHERE c.repository_id = $1 AND c.listed\n        ",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "digest!",
+        "type_info": "Text",
+        "origin": "Expression"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Int8",
+        "Text"
+      ]
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "273a55548f16aa07d44458ec0882b1a8dc0c2d19bfe31f08a98d5375f772a07f"
+}
diff --git a/.sqlx/query-3b1a02033a827f289b9abbe10dca767e380d05c155eae7f876cb89c0e0d94750.json b/.sqlx/query-3b1a02033a827f289b9abbe10dca767e380d05c155eae7f876cb89c0e0d94750.json
new file mode 100644
index 00000000..0b58d755
--- /dev/null
+++ b/.sqlx/query-3b1a02033a827f289b9abbe10dca767e380d05c155eae7f876cb89c0e0d94750.json
@@ -0,0 +1,38 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT id, secret_key_enc AS \"secret_key_enc!\" FROM repository_signing_key WHERE secret_key_enc IS NOT NULL",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "id",
+        "type_info": "Int8",
+        "origin": {
+          "Table": {
+            "table": "repository_signing_key",
+            "name": "id"
+          }
+        }
+      },
+      {
+        "ordinal": 1,
+        "name": "secret_key_enc!",
+        "type_info": "Bytea",
+        "origin": {
+          "Table": {
+            "table": "repository_signing_key",
+            "name": "secret_key_enc"
+          }
+        }
+      }
+    ],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": [
+      false,
+      true
+    ]
+  },
+  "hash": "3b1a02033a827f289b9abbe10dca767e380d05c155eae7f876cb89c0e0d94750"
+}
diff --git a/.sqlx/query-4ee4d8c2ff7670dd0011282b8b10fe5ba7059f3e08f6e4fec7c21fd610d95787.json b/.sqlx/query-4ee4d8c2ff7670dd0011282b8b10fe5ba7059f3e08f6e4fec7c21fd610d95787.json
new file mode 100644
index 00000000..db60d9c8
--- /dev/null
+++ b/.sqlx/query-4ee4d8c2ff7670dd0011282b8b10fe5ba7059f3e08f6e4fec7c21fd610d95787.json
@@ -0,0 +1,112 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n        SELECT id, repository_id, fingerprint, algorithm, user_id, public_key,\n               secret_key_enc, created_at\n        FROM repository_signing_key\n        WHERE repository_id = $1\n        ORDER BY created_at, id\n        ",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "id",
+        "type_info": "Int8",
+        "origin": {
+          "Table": {
+            "table": "repository_signing_key",
+            "name": "id"
+          }
+        }
+      },
+      {
+        "ordinal": 1,
+        "name": "repository_id",
+        "type_info": "Int8",
+        "origin": {
+          "Table": {
+            "table": "repository_signing_key",
+            "name": "repository_id"
+          }
+        }
+      },
+      {
+        "ordinal": 2,
+        "name": "fingerprint",
+        "type_info": "Text",
+        "origin": {
+          "Table": {
+            "table": "repository_signing_key",
+            "name": "fingerprint"
+          }
+        }
+      },
+      {
+        "ordinal": 3,
+        "name": "algorithm",
+        "type_info": "Text",
+        "origin": {
+          "Table": {
+            "table": "repository_signing_key",
+            "name": "algorithm"
+          }
+        }
+      },
+      {
+        "ordinal": 4,
+        "name": "user_id",
+        "type_info": "Text",
+        "origin": {
+          "Table": {
+            "table": "repository_signing_key",
+            "name": "user_id"
+          }
+        }
+      },
+      {
+        "ordinal": 5,
+        "name": "public_key",
+        "type_info": "Text",
+        "origin": {
+          "Table": {
+            "table": "repository_signing_key",
+            "name": "public_key"
+          }
+        }
+      },
+      {
+        "ordinal": 6,
+        "name": "secret_key_enc",
+        "type_info": "Bytea",
+        "origin": {
+          "Table": {
+            "table": "repository_signing_key",
+            "name": "secret_key_enc"
+          }
+        }
+      },
+      {
+        "ordinal": 7,
+        "name": "created_at",
+        "type_info": "Timestamptz",
+        "origin": {
+          "Table": {
+            "table": "repository_signing_key",
+            "name": "created_at"
+          }
+        }
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Int8"
+      ]
+    },
+    "nullable": [
+      false,
+      false,
+      false,
+      false,
+      false,
+      false,
+      true,
+      false
+    ]
+  },
+  "hash": "4ee4d8c2ff7670dd0011282b8b10fe5ba7059f3e08f6e4fec7c21fd610d95787"
+}
diff --git a/.sqlx/query-57d5cf84d10de51c9f83dc2983e57a82292802112810b3d84da175738969d81b.json b/.sqlx/query-614a470f4cd20e218fd1d0419bc71603025aa4611d362dd99f3c5f6f298acc1f.json
similarity index 62%
rename from .sqlx/query-57d5cf84d10de51c9f83dc2983e57a82292802112810b3d84da175738969d81b.json
rename to .sqlx/query-614a470f4cd20e218fd1d0419bc71603025aa4611d362dd99f3c5f6f298acc1f.json
index ab5ba316..0db09abf 100644
--- a/.sqlx/query-57d5cf84d10de51c9f83dc2983e57a82292802112810b3d84da175738969d81b.json
+++ b/.sqlx/query-614a470f4cd20e218fd1d0419bc71603025aa4611d362dd99f3c5f6f298acc1f.json
@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "\n                UPDATE raw_file\n                SET content_type = $2,\n                    upstream_etag = $3,\n                    upstream_last_modified = $4,\n                    checked_at = CASE WHEN $5 THEN now() ELSE checked_at END\n                WHERE id = $1\n                ",
+  "query": "\n                UPDATE raw_file\n                SET content_type = $2,\n                    upstream_etag = $3,\n                    upstream_last_modified = $4,\n                    checked_at = CASE WHEN $5 THEN now() ELSE checked_at END,\n                    immutable = $6\n                WHERE id = $1\n                ",
   "describe": {
     "columns": [],
     "parameters": {
@@ -9,10 +9,11 @@
         "Text",
         "Text",
         "Text",
+        "Bool",
         "Bool"
       ]
     },
     "nullable": []
   },
-  "hash": "57d5cf84d10de51c9f83dc2983e57a82292802112810b3d84da175738969d81b"
+  "hash": "614a470f4cd20e218fd1d0419bc71603025aa4611d362dd99f3c5f6f298acc1f"
 }
diff --git a/.sqlx/query-639f6b8e885bbe8625935b8d5300b50a45ee9dae856e075d23a8984abbb60d43.json b/.sqlx/query-639f6b8e885bbe8625935b8d5300b50a45ee9dae856e075d23a8984abbb60d43.json
new file mode 100644
index 00000000..01b8b36c
--- /dev/null
+++ b/.sqlx/query-639f6b8e885bbe8625935b8d5300b50a45ee9dae856e075d23a8984abbb60d43.json
@@ -0,0 +1,28 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT fingerprint FROM repository_index WHERE repository_id = $1",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "fingerprint",
+        "type_info": "Text",
+        "origin": {
+          "Table": {
+            "table": "repository_index",
+            "name": "fingerprint"
+          }
+        }
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Int8"
+      ]
+    },
+    "nullable": [
+      false
+    ]
+  },
+  "hash": "639f6b8e885bbe8625935b8d5300b50a45ee9dae856e075d23a8984abbb60d43"
+}
diff --git a/.sqlx/query-83f41652bbb35c3c080c900e787eb2612023fdef91698d9e2bf116a118d43c55.json b/.sqlx/query-7e22a7e6b91779a6e5a529fcc1b3b9a2a43c2f39ae867f52e6393f4f187a5723.json
similarity index 66%
rename from .sqlx/query-83f41652bbb35c3c080c900e787eb2612023fdef91698d9e2bf116a118d43c55.json
rename to .sqlx/query-7e22a7e6b91779a6e5a529fcc1b3b9a2a43c2f39ae867f52e6393f4f187a5723.json
index cb4f299b..a07d364a 100644
--- a/.sqlx/query-83f41652bbb35c3c080c900e787eb2612023fdef91698d9e2bf116a118d43c55.json
+++ b/.sqlx/query-7e22a7e6b91779a6e5a529fcc1b3b9a2a43c2f39ae867f52e6393f4f187a5723.json
@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "\n            INSERT INTO raw_file (repository_id, path, blob_sha256, size, content_type,\n                                  sha512_base64, sha1, md5, upstream_etag,\n                                  upstream_last_modified, checked_at)\n            VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10,\n                    CASE WHEN $11 THEN now() END)\n            ON CONFLICT (repository_id, path) DO NOTHING\n            RETURNING id\n            ",
+  "query": "\n            INSERT INTO raw_file (repository_id, path, blob_sha256, size, content_type,\n                                  sha512_base64, sha1, md5, upstream_etag,\n                                  upstream_last_modified, checked_at, immutable)\n            VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10,\n                    CASE WHEN $11 THEN now() END, $12)\n            ON CONFLICT (repository_id, path) DO NOTHING\n            RETURNING id\n            ",
   "describe": {
     "columns": [
       {
@@ -27,6 +27,7 @@
         "Text",
         "Text",
         "Text",
+        "Bool",
         "Bool"
       ]
     },
@@ -34,5 +35,5 @@
       false
     ]
   },
-  "hash": "83f41652bbb35c3c080c900e787eb2612023fdef91698d9e2bf116a118d43c55"
+  "hash": "7e22a7e6b91779a6e5a529fcc1b3b9a2a43c2f39ae867f52e6393f4f187a5723"
 }
diff --git a/.sqlx/query-22abc387b0e4e8f6a15b06634ca8c4361fe031cda1a2247530cdf863d234a5c3.json b/.sqlx/query-9434ba17b934138df78f5e0f94da7a04a1e81a99d0e8218c8d047d5c17be4095.json
similarity index 89%
rename from .sqlx/query-22abc387b0e4e8f6a15b06634ca8c4361fe031cda1a2247530cdf863d234a5c3.json
rename to .sqlx/query-9434ba17b934138df78f5e0f94da7a04a1e81a99d0e8218c8d047d5c17be4095.json
index 63c4c6b3..739e05da 100644
--- a/.sqlx/query-22abc387b0e4e8f6a15b06634ca8c4361fe031cda1a2247530cdf863d234a5c3.json
+++ b/.sqlx/query-9434ba17b934138df78f5e0f94da7a04a1e81a99d0e8218c8d047d5c17be4095.json
@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "\n        SELECT f.id, f.repository_id, f.path, f.blob_sha256, b.s3_key, f.size,\n               f.content_type, f.sha512_base64, f.sha1, f.md5, f.created_at,\n               f.updated_at, f.last_downloaded_at, f.upstream_etag,\n               f.upstream_last_modified, f.checked_at\n        FROM raw_file f\n        JOIN blob b ON b.sha256 = f.blob_sha256\n        WHERE f.repository_id = $1 AND f.path = $2\n        ",
+  "query": "\n        SELECT f.id, f.repository_id, f.path, f.blob_sha256, b.s3_key, f.size,\n               f.content_type, f.sha512_base64, f.sha1, f.md5, f.created_at,\n               f.updated_at, f.last_downloaded_at, f.upstream_etag,\n               f.upstream_last_modified, f.checked_at, f.immutable\n        FROM raw_file f\n        JOIN blob b ON b.sha256 = f.blob_sha256\n        WHERE f.repository_id = $1 AND f.path = $2\n        ",
   "describe": {
     "columns": [
       {
@@ -178,6 +178,17 @@
             "name": "checked_at"
           }
         }
+      },
+      {
+        "ordinal": 16,
+        "name": "immutable",
+        "type_info": "Bool",
+        "origin": {
+          "Table": {
+            "table": "raw_file",
+            "name": "immutable"
+          }
+        }
       }
     ],
     "parameters": {
@@ -202,8 +213,9 @@
       true,
       true,
       true,
-      true
+      true,
+      false
     ]
   },
-  "hash": "22abc387b0e4e8f6a15b06634ca8c4361fe031cda1a2247530cdf863d234a5c3"
+  "hash": "9434ba17b934138df78f5e0f94da7a04a1e81a99d0e8218c8d047d5c17be4095"
 }
diff --git a/.sqlx/query-970a94e7badf03a92f54e1f054cb031318564ce98d8c1d90d07463a3c08465ba.json b/.sqlx/query-970a94e7badf03a92f54e1f054cb031318564ce98d8c1d90d07463a3c08465ba.json
new file mode 100644
index 00000000..46c35a33
--- /dev/null
+++ b/.sqlx/query-970a94e7badf03a92f54e1f054cb031318564ce98d8c1d90d07463a3c08465ba.json
@@ -0,0 +1,18 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n            WITH dek AS (\n                SELECT 1 FROM encryption_key\n                WHERE layer = 'dek' AND scope = $4 AND version = $5 AND state <> 'revoked'\n                FOR SHARE\n            )\n            UPDATE repository_signing_key SET secret_key_enc = $2\n            WHERE id = $1 AND secret_key_enc = $3 AND EXISTS (SELECT 1 FROM dek)\n            ",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Int8",
+        "Bytea",
+        "Bytea",
+        "Text",
+        "Int4"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "970a94e7badf03a92f54e1f054cb031318564ce98d8c1d90d07463a3c08465ba"
+}
diff --git a/.sqlx/query-980e592028b0baa37f9d2e43e4819dba6794896e11ee86029c56e2c39efed5bb.json b/.sqlx/query-980e592028b0baa37f9d2e43e4819dba6794896e11ee86029c56e2c39efed5bb.json
new file mode 100644
index 00000000..166c5810
--- /dev/null
+++ b/.sqlx/query-980e592028b0baa37f9d2e43e4819dba6794896e11ee86029c56e2c39efed5bb.json
@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE repository_signing_key SET secret_key_enc = $2 WHERE id = $1",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Int8",
+        "Bytea"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "980e592028b0baa37f9d2e43e4819dba6794896e11ee86029c56e2c39efed5bb"
+}
diff --git a/.sqlx/query-9ad3d42a5f4e433417b0d70e17edeb0e3a4897bc8f6f4752cd2a6016a9b2d133.json b/.sqlx/query-9ad3d42a5f4e433417b0d70e17edeb0e3a4897bc8f6f4752cd2a6016a9b2d133.json
new file mode 100644
index 00000000..bccf9f1c
--- /dev/null
+++ b/.sqlx/query-9ad3d42a5f4e433417b0d70e17edeb0e3a4897bc8f6f4752cd2a6016a9b2d133.json
@@ -0,0 +1,14 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n        INSERT INTO repository_index (repository_id, fingerprint)\n        VALUES ($1, '')\n        ON CONFLICT (repository_id) DO NOTHING\n        ",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Int8"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "9ad3d42a5f4e433417b0d70e17edeb0e3a4897bc8f6f4752cd2a6016a9b2d133"
+}
diff --git a/.sqlx/query-9aff1f3427275d97cd3b03d0c2c2c9a1c697ebf1b3b815ccc181a21716d2b9b6.json b/.sqlx/query-9aff1f3427275d97cd3b03d0c2c2c9a1c697ebf1b3b815ccc181a21716d2b9b6.json
new file mode 100644
index 00000000..1959969f
--- /dev/null
+++ b/.sqlx/query-9aff1f3427275d97cd3b03d0c2c2c9a1c697ebf1b3b815ccc181a21716d2b9b6.json
@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "DELETE FROM repository_signing_key WHERE repository_id = $1 AND fingerprint = $2",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Int8",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "9aff1f3427275d97cd3b03d0c2c2c9a1c697ebf1b3b815ccc181a21716d2b9b6"
+}
diff --git a/.sqlx/query-b5ac992cdbf1cb4c70996b43c1d07e080df16a30cc40389632467e12f29693a8.json b/.sqlx/query-b5ac992cdbf1cb4c70996b43c1d07e080df16a30cc40389632467e12f29693a8.json
new file mode 100644
index 00000000..0011049f
--- /dev/null
+++ b/.sqlx/query-b5ac992cdbf1cb4c70996b43c1d07e080df16a30cc40389632467e12f29693a8.json
@@ -0,0 +1,113 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n        SELECT c.name, c.version, c.version_original, c.manifest_summary, c.created_at,\n               a.size, a.blob_sha256 AS sha256, a.sha512_base64\n        FROM component c\n        JOIN asset a ON a.component_id = c.id AND a.path = $2\n        WHERE c.repository_id = $1 AND c.listed\n        ORDER BY c.name, c.id\n        ",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "name",
+        "type_info": "Text",
+        "origin": {
+          "Table": {
+            "table": "component",
+            "name": "name"
+          }
+        }
+      },
+      {
+        "ordinal": 1,
+        "name": "version",
+        "type_info": "Text",
+        "origin": {
+          "Table": {
+            "table": "component",
+            "name": "version"
+          }
+        }
+      },
+      {
+        "ordinal": 2,
+        "name": "version_original",
+        "type_info": "Text",
+        "origin": {
+          "Table": {
+            "table": "component",
+            "name": "version_original"
+          }
+        }
+      },
+      {
+        "ordinal": 3,
+        "name": "manifest_summary",
+        "type_info": "Jsonb",
+        "origin": {
+          "Table": {
+            "table": "component",
+            "name": "manifest_summary"
+          }
+        }
+      },
+      {
+        "ordinal": 4,
+        "name": "created_at",
+        "type_info": "Timestamptz",
+        "origin": {
+          "Table": {
+            "table": "component",
+            "name": "created_at"
+          }
+        }
+      },
+      {
+        "ordinal": 5,
+        "name": "size",
+        "type_info": "Int8",
+        "origin": {
+          "Table": {
+            "table": "asset",
+            "name": "size"
+          }
+        }
+      },
+      {
+        "ordinal": 6,
+        "name": "sha256",
+        "type_info": "Text",
+        "origin": {
+          "Table": {
+            "table": "asset",
+            "name": "blob_sha256"
+          }
+        }
+      },
+      {
+        "ordinal": 7,
+        "name": "sha512_base64",
+        "type_info": "Text",
+        "origin": {
+          "Table": {
+            "table": "asset",
+            "name": "sha512_base64"
+          }
+        }
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Int8",
+        "Text"
+      ]
+    },
+    "nullable": [
+      false,
+      false,
+      false,
+      true,
+      false,
+      false,
+      false,
+      true
+    ]
+  },
+  "hash": "b5ac992cdbf1cb4c70996b43c1d07e080df16a30cc40389632467e12f29693a8"
+}
diff --git a/.sqlx/query-c6ded420e770d039677246cb5949faca8efb5fd75ff5d7b67ad8987900dc2674.json b/.sqlx/query-c6ded420e770d039677246cb5949faca8efb5fd75ff5d7b67ad8987900dc2674.json
new file mode 100644
index 00000000..421b7b05
--- /dev/null
+++ b/.sqlx/query-c6ded420e770d039677246cb5949faca8efb5fd75ff5d7b67ad8987900dc2674.json
@@ -0,0 +1,28 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n        SELECT fingerprint FROM repository_signing_key\n        WHERE repository_id = $1\n        ORDER BY id\n        FOR UPDATE\n        ",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "fingerprint",
+        "type_info": "Text",
+        "origin": {
+          "Table": {
+            "table": "repository_signing_key",
+            "name": "fingerprint"
+          }
+        }
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Int8"
+      ]
+    },
+    "nullable": [
+      false
+    ]
+  },
+  "hash": "c6ded420e770d039677246cb5949faca8efb5fd75ff5d7b67ad8987900dc2674"
+}
diff --git a/.sqlx/query-da9d18c9d644ad6e08b43a5461257a4d8b826dd348b737c3c11942efff3d4682.json b/.sqlx/query-da9d18c9d644ad6e08b43a5461257a4d8b826dd348b737c3c11942efff3d4682.json
new file mode 100644
index 00000000..0269458a
--- /dev/null
+++ b/.sqlx/query-da9d18c9d644ad6e08b43a5461257a4d8b826dd348b737c3c11942efff3d4682.json
@@ -0,0 +1,32 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n        INSERT INTO repository_signing_key\n            (repository_id, fingerprint, algorithm, user_id, public_key)\n        VALUES ($1, $2, $3, $4, $5)\n        ON CONFLICT (repository_id, fingerprint) DO NOTHING\n        RETURNING id\n        ",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "id",
+        "type_info": "Int8",
+        "origin": {
+          "Table": {
+            "table": "repository_signing_key",
+            "name": "id"
+          }
+        }
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Int8",
+        "Text",
+        "Text",
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": [
+      false
+    ]
+  },
+  "hash": "da9d18c9d644ad6e08b43a5461257a4d8b826dd348b737c3c11942efff3d4682"
+}
diff --git a/.sqlx/query-db170fd0494ce43b0069120bb594a27478e154a8596d1f40e212bf904917db5a.json b/.sqlx/query-db170fd0494ce43b0069120bb594a27478e154a8596d1f40e212bf904917db5a.json
new file mode 100644
index 00000000..d93fba24
--- /dev/null
+++ b/.sqlx/query-db170fd0494ce43b0069120bb594a27478e154a8596d1f40e212bf904917db5a.json
@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n        UPDATE repository_index SET fingerprint = $2, generated_at = now()\n        WHERE repository_id = $1\n        ",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Int8",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "db170fd0494ce43b0069120bb594a27478e154a8596d1f40e212bf904917db5a"
+}
diff --git a/.sqlx/query-e9029250004eef3621d5633a906fa5066bfdad1491e3c61bd0a4dfdc1b40b61a.json b/.sqlx/query-e9029250004eef3621d5633a906fa5066bfdad1491e3c61bd0a4dfdc1b40b61a.json
new file mode 100644
index 00000000..526d36ce
--- /dev/null
+++ b/.sqlx/query-e9029250004eef3621d5633a906fa5066bfdad1491e3c61bd0a4dfdc1b40b61a.json
@@ -0,0 +1,28 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT fingerprint FROM repository_index WHERE repository_id = $1 FOR UPDATE",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "fingerprint",
+        "type_info": "Text",
+        "origin": {
+          "Table": {
+            "table": "repository_index",
+            "name": "fingerprint"
+          }
+        }
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Int8"
+      ]
+    },
+    "nullable": [
+      false
+    ]
+  },
+  "hash": "e9029250004eef3621d5633a906fa5066bfdad1491e3c61bd0a4dfdc1b40b61a"
+}
diff --git a/.sqlx/query-f89af9953b3876e659a23f181dd9a3f8ca3ab658acab7e1727470c9816efed7c.json b/.sqlx/query-f89af9953b3876e659a23f181dd9a3f8ca3ab658acab7e1727470c9816efed7c.json
new file mode 100644
index 00000000..38a26d4a
--- /dev/null
+++ b/.sqlx/query-f89af9953b3876e659a23f181dd9a3f8ca3ab658acab7e1727470c9816efed7c.json
@@ -0,0 +1,50 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n        SELECT id, fingerprint, secret_key_enc AS \"secret_key_enc!\"\n        FROM repository_signing_key WHERE secret_key_enc IS NOT NULL\n        ORDER BY id\n        ",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "id",
+        "type_info": "Int8",
+        "origin": {
+          "Table": {
+            "table": "repository_signing_key",
+            "name": "id"
+          }
+        }
+      },
+      {
+        "ordinal": 1,
+        "name": "fingerprint",
+        "type_info": "Text",
+        "origin": {
+          "Table": {
+            "table": "repository_signing_key",
+            "name": "fingerprint"
+          }
+        }
+      },
+      {
+        "ordinal": 2,
+        "name": "secret_key_enc!",
+        "type_info": "Bytea",
+        "origin": {
+          "Table": {
+            "table": "repository_signing_key",
+            "name": "secret_key_enc"
+          }
+        }
+      }
+    ],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": [
+      false,
+      false,
+      true
+    ]
+  },
+  "hash": "f89af9953b3876e659a23f181dd9a3f8ca3ab658acab7e1727470c9816efed7c"
+}
diff --git a/.sqlx/query-6f2fe45f241984b02fa6a38441d64e9639c08f0146065d0a1589ac36596f500f.json b/.sqlx/query-fc7378cc859a92d60264d8343c125e8e7574e053537d15aec3ce04939c920acd.json
similarity index 67%
rename from .sqlx/query-6f2fe45f241984b02fa6a38441d64e9639c08f0146065d0a1589ac36596f500f.json
rename to .sqlx/query-fc7378cc859a92d60264d8343c125e8e7574e053537d15aec3ce04939c920acd.json
index dcef95e4..80bff307 100644
--- a/.sqlx/query-6f2fe45f241984b02fa6a38441d64e9639c08f0146065d0a1589ac36596f500f.json
+++ b/.sqlx/query-fc7378cc859a92d60264d8343c125e8e7574e053537d15aec3ce04939c920acd.json
@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "\n            UPDATE raw_file\n            SET blob_sha256 = $2, size = $3, content_type = $4, sha512_base64 = $5,\n                sha1 = $6, md5 = $7, upstream_etag = $8, upstream_last_modified = $9,\n                checked_at = CASE WHEN $10 THEN now() END,\n                updated_at = greatest(now(), updated_at + interval '1 microsecond')\n            WHERE id = $1\n            ",
+  "query": "\n            UPDATE raw_file\n            SET blob_sha256 = $2, size = $3, content_type = $4, sha512_base64 = $5,\n                sha1 = $6, md5 = $7, upstream_etag = $8, upstream_last_modified = $9,\n                checked_at = CASE WHEN $10 THEN now() END,\n                immutable = $11,\n                updated_at = greatest(now(), updated_at + interval '1 microsecond')\n            WHERE id = $1\n            ",
   "describe": {
     "columns": [],
     "parameters": {
@@ -14,10 +14,11 @@
         "Text",
         "Text",
         "Text",
+        "Bool",
         "Bool"
       ]
     },
     "nullable": []
   },
-  "hash": "6f2fe45f241984b02fa6a38441d64e9639c08f0146065d0a1589ac36596f500f"
+  "hash": "fc7378cc859a92d60264d8343c125e8e7574e053537d15aec3ce04939c920acd"
 }
diff --git a/Cargo.lock b/Cargo.lock
index 358a622a..c4319dcd 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -8,6 +8,17 @@ version = "2.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "320119579fcad9c21884f5c4861d16174d0e06250625266f50fe6898340abefa"
 
+[[package]]
+name = "aead"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d122413f284cf2d62fb1b7db97e02edb8cda96d769b16e443a4f6195e35662b0"
+dependencies = [
+ "bytes",
+ "crypto-common 0.1.7",
+ "generic-array",
+]
+
 [[package]]
 name = "aead"
 version = "0.6.1"
@@ -15,7 +26,18 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1973cfbc1a2daf9cf550e74e1f088c28e7f7d8c1e1418fb6c9dc5184b7e84c99"
 dependencies = [
  "crypto-common 0.2.2",
- "inout",
+ "inout 0.2.2",
+]
+
+[[package]]
+name = "aes"
+version = "0.8.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b169f7a6d4742236a0a00c541b845991d0ac43e546831af1249753ab4c3aa3a0"
+dependencies = [
+ "cfg-if",
+ "cipher 0.4.4",
+ "cpufeatures 0.2.17",
 ]
 
 [[package]]
@@ -24,27 +46,50 @@ version = "0.9.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "35f0f96ce78e38c3dc6d8948aa8163d06385be74000f3c7a95bf1eef35d3ea32"
 dependencies = [
- "cipher",
+ "cipher 0.5.2",
  "cpubits",
  "cpufeatures 0.3.1",
  "zeroize",
 ]
 
+[[package]]
+name = "aes-gcm"
+version = "0.10.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "831010a0f742e1209b3bcea8fab6a8e149051ba6099432c8cb2cc117dec3ead1"
+dependencies = [
+ "aead 0.5.2",
+ "aes 0.8.4",
+ "cipher 0.4.4",
+ "ctr 0.9.2",
+ "ghash 0.5.1",
+ "subtle",
+]
+
 [[package]]
 name = "aes-gcm"
 version = "0.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7f2b8006a0c83f52b62ba44a97b58bf76fe2f70a329e588f67f89691d93d498f"
 dependencies = [
- "aead",
- "aes",
- "cipher",
- "ctr",
+ "aead 0.6.1",
+ "aes 0.9.3",
+ "cipher 0.5.2",
+ "ctr 0.10.1",
  "ctutils",
- "ghash",
+ "ghash 0.6.0",
  "zeroize",
 ]
 
+[[package]]
+name = "aes-kw"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "69fa2b352dcefb5f7f3a5fb840e02665d311d878955380515e4fd50095dd3d8c"
+dependencies = [
+ "aes 0.8.4",
+]
+
 [[package]]
 name = "ahash"
 version = "0.8.12"
@@ -104,6 +149,19 @@ version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "03918c3dbd7701a85c6b9887732e2921175f26c350b4563841d0958c21d57e6d"
 
+[[package]]
+name = "argon2"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3c3610892ee6e0cbce8ae2700349fcf8f98adb0dbfbee85aec3c9179d29cc072"
+dependencies = [
+ "base64ct",
+ "blake2 0.10.6",
+ "cpufeatures 0.2.17",
+ "password-hash 0.5.0",
+ "zeroize",
+]
+
 [[package]]
 name = "argon2"
 version = "0.6.0"
@@ -111,9 +169,9 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "134c52ddac6d63c576bef8168db10c83c49c26444ecbc68060fef078925a901c"
 dependencies = [
  "base64ct",
- "blake2",
+ "blake2 0.11.0",
  "cpufeatures 0.3.1",
- "password-hash",
+ "password-hash 0.6.1",
 ]
 
 [[package]]
@@ -373,7 +431,7 @@ dependencies = [
  "bytes",
  "fastrand",
  "hex",
- "hmac",
+ "hmac 0.13.0",
  "http",
  "http-body",
  "lru",
@@ -474,7 +532,7 @@ dependencies = [
  "bytes",
  "form_urlencoded",
  "hex",
- "hmac",
+ "hmac 0.13.0",
  "http",
  "percent-encoding",
  "sha2 0.11.1",
@@ -507,7 +565,7 @@ dependencies = [
  "http",
  "http-body",
  "http-body-util",
- "md-5",
+ "md-5 0.11.0",
  "pin-project-lite",
  "sha1 0.11.0",
  "sha2 0.11.1",
@@ -777,6 +835,12 @@ dependencies = [
  "fastrand",
 ]
 
+[[package]]
+name = "base16ct"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4c7f02d4ea65f2c1853089ffd8d2787bdbc63de2f0d29dedbcf8ccdfa0ccd4cf"
+
 [[package]]
 name = "base64"
 version = "0.22.1"
@@ -814,6 +878,27 @@ dependencies = [
  "serde",
 ]
 
+[[package]]
+name = "bitfields"
+version = "1.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ef6e59298da389bc0649c7463856b34c6e17fe542f88939426ede4436c6b1195"
+dependencies = [
+ "bitfields-impl",
+]
+
+[[package]]
+name = "bitfields-impl"
+version = "1.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f2c044f98f86f15414668d6c8187c7e4fadab1ad2b31680f648703e0fe07c555"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+ "thiserror",
+]
+
 [[package]]
 name = "bitflags"
 version = "1.3.2"
@@ -829,6 +914,27 @@ dependencies = [
  "serde_core",
 ]
 
+[[package]]
+name = "bitvec"
+version = "1.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ddcec3d12c579d40898fe0a9a358a803c23e9c52ca3c425707f81c9436211837"
+dependencies = [
+ "funty",
+ "radium",
+ "tap",
+ "wyz",
+]
+
+[[package]]
+name = "blake2"
+version = "0.10.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "46502ad458c9a52b69d4d4d32775c788b7a1b85e8bc9d482d92250fc0e3f8efe"
+dependencies = [
+ "digest 0.10.7",
+]
+
 [[package]]
 name = "blake2"
 version = "0.11.0"
@@ -856,6 +962,25 @@ dependencies = [
  "hybrid-array",
 ]
 
+[[package]]
+name = "block-padding"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a8894febbff9f758034a5b8e12d87918f56dfc64a8e1fe757d65e29041538d93"
+dependencies = [
+ "generic-array",
+]
+
+[[package]]
+name = "blowfish"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e412e2cd0f2b2d93e02543ceae7917b3c70331573df19ee046bcbc35e45e87d7"
+dependencies = [
+ "byteorder",
+ "cipher 0.4.4",
+]
+
 [[package]]
 name = "bollard"
 version = "0.20.2"
@@ -949,6 +1074,15 @@ dependencies = [
  "serde_core",
 ]
 
+[[package]]
+name = "buffer-redux"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "431a9cc8d7efa49bc326729264537f5e60affce816c66edf434350778c9f4f54"
+dependencies = [
+ "memchr",
+]
+
 [[package]]
 name = "bumpalo"
 version = "3.20.3"
@@ -983,6 +1117,25 @@ dependencies = [
  "either",
 ]
 
+[[package]]
+name = "camellia"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3264e2574e9ef2b53ce6f536dea83a69ac0bc600b762d1523ff83fe07230ce30"
+dependencies = [
+ "byteorder",
+ "cipher 0.4.4",
+]
+
+[[package]]
+name = "cast5"
+version = "0.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "26b07d673db1ccf000e90f54b819db9e75a8348d6eb056e9b8ab53231b7a9911"
+dependencies = [
+ "cipher 0.4.4",
+]
+
 [[package]]
 name = "cc"
 version = "1.4.7"
@@ -995,6 +1148,15 @@ dependencies = [
  "shlex",
 ]
 
+[[package]]
+name = "cfb-mode"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "738b8d467867f80a71351933f70461f5b56f24d5c93e0cf216e59229c968d330"
+dependencies = [
+ "cipher 0.4.4",
+]
+
 [[package]]
 name = "cfg-if"
 version = "1.0.5"
@@ -1014,7 +1176,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "65c35e4b699c7e15ccbe7ee35c005e4fc0a278d22238a2857e6ce2dadeda1b06"
 dependencies = [
  "cfg-if",
- "cipher",
+ "cipher 0.5.2",
  "cpufeatures 0.3.1",
  "rand_core 0.10.1",
  "zeroize",
@@ -1026,9 +1188,9 @@ version = "0.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9b89e1c441e926b9c82a8d023f6e1b7ae0adcfaa7d621814e4d60789bac751cb"
 dependencies = [
- "aead",
+ "aead 0.6.1",
  "chacha20",
- "cipher",
+ "cipher 0.5.2",
  "poly1305",
  "zeroize",
 ]
@@ -1055,6 +1217,16 @@ dependencies = [
  "phf",
 ]
 
+[[package]]
+name = "cipher"
+version = "0.4.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "773f3b9af64447d2ce9850330c473515014aa235e6a783b02db81ff39e4a3dad"
+dependencies = [
+ "crypto-common 0.1.7",
+ "inout 0.1.4",
+]
+
 [[package]]
 name = "cipher"
 version = "0.5.2"
@@ -1063,7 +1235,18 @@ checksum = "e8cf2a2c93cd704877c0858356ed03480ff301ee950b43f1cbe4573b088bfa6c"
 dependencies = [
  "block-buffer 0.12.1",
  "crypto-common 0.2.2",
- "inout",
+ "inout 0.2.2",
+]
+
+[[package]]
+name = "cmac"
+version = "0.7.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8543454e3c3f5126effff9cd44d562af4e31fb8ce1cc0d3dcd8f084515dbc1aa"
+dependencies = [
+ "cipher 0.4.4",
+ "dbl",
+ "digest 0.10.7",
 ]
 
 [[package]]
@@ -1127,6 +1310,15 @@ dependencies = [
  "tiny-keccak",
 ]
 
+[[package]]
+name = "convert_case"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "633458d4ef8c78b72454de2d54fd6ab2e60f9e02be22f3c6104cdc8a4e0fceb9"
+dependencies = [
+ "unicode-segmentation",
+]
+
 [[package]]
 name = "core-foundation"
 version = "0.9.4"
@@ -1208,6 +1400,12 @@ dependencies = [
  "spin 0.10.1",
 ]
 
+[[package]]
+name = "crc24"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fd121741cf3eb82c08dd3023eb55bf2665e5f60ec20f89760cf836ae4562e6a0"
+
 [[package]]
 name = "crc32fast"
 version = "1.5.2"
@@ -1267,6 +1465,18 @@ version = "0.2.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "460fbee9c2c2f33933d720630a6a0bac33ba7053db5344fac858d4b8952d77d5"
 
+[[package]]
+name = "crypto-bigint"
+version = "0.5.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0dc92fb57ca44df6db8059111ab3af99a63d5d0f8375d9972e319a379c6bab76"
+dependencies = [
+ "generic-array",
+ "rand_core 0.6.4",
+ "subtle",
+ "zeroize",
+]
+
 [[package]]
 name = "crypto-common"
 version = "0.1.7"
@@ -1274,6 +1484,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "78c8292055d1c1df0cce5d180393dc8cce0abec0a7102adb6c7b1eef6016d60a"
 dependencies = [
  "generic-array",
+ "rand_core 0.6.4",
  "typenum",
 ]
 
@@ -1288,13 +1499,22 @@ dependencies = [
  "rand_core 0.10.1",
 ]
 
+[[package]]
+name = "ctr"
+version = "0.9.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0369ee1ad671834580515889b80f2ea915f23b8be8d0daa4bbaf2ac5c7590835"
+dependencies = [
+ "cipher 0.4.4",
+]
+
 [[package]]
 name = "ctr"
 version = "0.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "baaca1c4b237092596f64d571e9db6ce4109c4ef9742e27590f1709594461f21"
 dependencies = [
- "cipher",
+ "cipher 0.5.2",
 ]
 
 [[package]]
@@ -1306,6 +1526,50 @@ dependencies = [
  "cmov",
 ]
 
+[[package]]
+name = "curve25519-dalek"
+version = "4.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "97fb8b7c4503de7d6ae7b42ab72a5a59857b4c937ec27a3d4539dba95b5ab2be"
+dependencies = [
+ "cfg-if",
+ "cpufeatures 0.2.17",
+ "curve25519-dalek-derive",
+ "digest 0.10.7",
+ "fiat-crypto",
+ "rustc_version",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "curve25519-dalek-derive"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f46882e17999c6cc590af592290432be3bce0428cb0d5f8b6715e4dc7b383eb3"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "cx448"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b4c0cf476284b03eb6c10e78787b21c7abb7d7d43cb2f02532ba6b831ed892fa"
+dependencies = [
+ "crypto-bigint",
+ "elliptic-curve",
+ "pkcs8",
+ "rand_core 0.6.4",
+ "serdect 0.3.0",
+ "sha3",
+ "signature",
+ "subtle",
+ "zeroize",
+]
+
 [[package]]
 name = "darling"
 version = "0.20.11"
@@ -1381,6 +1645,15 @@ version = "2.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4583a4551df46e2792f82ceeac45e850d2e2d5debba0b91f102385cda5b11f06"
 
+[[package]]
+name = "dbl"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bd2735a791158376708f9347fe8faba9667589d82427ef3aed6794a8981de3d9"
+dependencies = [
+ "generic-array",
+]
+
 [[package]]
 name = "deadpool"
 version = "0.12.3"
@@ -1495,6 +1768,38 @@ dependencies = [
  "syn 2.0.119",
 ]
 
+[[package]]
+name = "derive_more"
+version = "2.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d751e9e49156b02b44f9c1815bcb94b984cdcc4396ecc32521c739452808b134"
+dependencies = [
+ "derive_more-impl",
+]
+
+[[package]]
+name = "derive_more-impl"
+version = "2.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "799a97264921d8623a957f6c3b9011f3b5492f557bbb7a5a19b7fa6d06ba8dcb"
+dependencies = [
+ "convert_case",
+ "proc-macro2",
+ "quote",
+ "rustc_version",
+ "syn 2.0.119",
+ "unicode-xid",
+]
+
+[[package]]
+name = "des"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ffdd80ce8ce993de27e9f063a444a4d53ce8e8db4c1f00cc03af5ad5a9867a1e"
+dependencies = [
+ "cipher 0.4.4",
+]
+
 [[package]]
 name = "digest"
 version = "0.10.7"
@@ -1504,6 +1809,7 @@ dependencies = [
  "block-buffer 0.10.4",
  "const-oid 0.9.6",
  "crypto-common 0.1.7",
+ "subtle",
 ]
 
 [[package]]
@@ -1546,6 +1852,22 @@ version = "0.15.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1aaf95b3e5c8f23aa320147307562d361db0ae0d51242340f558153b4eb2439b"
 
+[[package]]
+name = "dsa"
+version = "0.6.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "48bc224a9084ad760195584ce5abb3c2c34a225fa312a128ad245a6b412b7689"
+dependencies = [
+ "digest 0.10.7",
+ "num-bigint-dig",
+ "num-traits",
+ "pkcs8",
+ "rfc6979",
+ "sha2 0.10.9",
+ "signature",
+ "zeroize",
+]
+
 [[package]]
 name = "dunce"
 version = "1.0.5"
@@ -1558,6 +1880,58 @@ version = "1.0.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d0881ea181b1df73ff77ffaaf9c7544ecc11e82fba9b5f27b262a3c73a332555"
 
+[[package]]
+name = "eax"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9954fabd903b82b9d7a68f65f97dc96dd9ad368e40ccc907a7c19d53e6bfac28"
+dependencies = [
+ "aead 0.5.2",
+ "cipher 0.4.4",
+ "cmac",
+ "ctr 0.9.2",
+ "subtle",
+]
+
+[[package]]
+name = "ecdsa"
+version = "0.16.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ee27f32b5c5292967d2d4a9d7f1e0b0aed2c15daded5a60300e4abb9d8020bca"
+dependencies = [
+ "der",
+ "digest 0.10.7",
+ "elliptic-curve",
+ "rfc6979",
+ "signature",
+ "spki",
+]
+
+[[package]]
+name = "ed25519"
+version = "2.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "115531babc129696a58c64a4fef0a8bf9e9698629fb97e9e40767d235cfbcd53"
+dependencies = [
+ "pkcs8",
+ "signature",
+]
+
+[[package]]
+name = "ed25519-dalek"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "70e796c081cee67dc755e1a36a0a172b897fab85fc3f6bc48307991f64e4eca9"
+dependencies = [
+ "curve25519-dalek",
+ "ed25519",
+ "rand_core 0.6.4",
+ "serde",
+ "sha2 0.10.9",
+ "subtle",
+ "zeroize",
+]
+
 [[package]]
 name = "either"
 version = "1.18.0"
@@ -1567,6 +1941,31 @@ dependencies = [
  "serde",
 ]
 
+[[package]]
+name = "elliptic-curve"
+version = "0.13.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b5e6043086bf7973472e0c7dff2142ea0b680d30e18d9cc40f267efbf222bd47"
+dependencies = [
+ "base16ct",
+ "base64ct",
+ "crypto-bigint",
+ "digest 0.10.7",
+ "ff",
+ "generic-array",
+ "group",
+ "hkdf 0.12.4",
+ "pem-rfc7468",
+ "pkcs8",
+ "rand_core 0.6.4",
+ "sec1",
+ "serde_json",
+ "serdect 0.2.0",
+ "subtle",
+ "tap",
+ "zeroize",
+]
+
 [[package]]
 name = "email-encoding"
 version = "0.4.2"
@@ -1661,6 +2060,23 @@ dependencies = [
  "web-time",
 ]
 
+[[package]]
+name = "ff"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c0b50bfb653653f9ca9095b427bed08ab8d75a137839d9ad64eb11810d5b6393"
+dependencies = [
+ "bitvec",
+ "rand_core 0.6.4",
+ "subtle",
+]
+
+[[package]]
+name = "fiat-crypto"
+version = "0.2.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "28dea519a9695b9977216879a3ebfddf92f1c08c05d984f8996aecd6ecdc811d"
+
 [[package]]
 name = "figment"
 version = "0.10.19"
@@ -1748,7 +2164,7 @@ dependencies = [
 name = "forge-core"
 version = "2.1.0"
 dependencies = [
- "argon2",
+ "argon2 0.6.0",
  "async-trait",
  "aws-lc-rs",
  "axum",
@@ -1768,7 +2184,7 @@ dependencies = [
  "futures-util",
  "globset",
  "hex",
- "hmac",
+ "hmac 0.13.0",
  "http",
  "hyper-util",
  "ipnet",
@@ -1799,7 +2215,7 @@ dependencies = [
 name = "forge-crypto"
 version = "2.1.0"
 dependencies = [
- "aes-gcm",
+ "aes-gcm 0.11.1",
  "async-trait",
  "base64 0.23.1",
  "chacha20poly1305",
@@ -1877,6 +2293,24 @@ dependencies = [
  "zip",
 ]
 
+[[package]]
+name = "forge-format-apt"
+version = "1.0.0"
+dependencies = [
+ "base64 0.23.1",
+ "chrono",
+ "flate2",
+ "forge-plugin-api",
+ "hex",
+ "lzma-rust2",
+ "ruzstd",
+ "serde",
+ "serde_json",
+ "sha2 0.11.1",
+ "tar",
+ "url",
+]
+
 [[package]]
 name = "forge-format-docker"
 version = "1.0.0"
@@ -1955,7 +2389,7 @@ name = "forge-server"
 version = "2.1.0"
 dependencies = [
  "anyhow",
- "argon2",
+ "argon2 0.6.0",
  "async-stream",
  "async-trait",
  "axum",
@@ -1969,6 +2403,7 @@ dependencies = [
  "forge-core",
  "forge-crypto",
  "forge-db",
+ "forge-format-apt",
  "forge-format-docker",
  "forge-format-npm",
  "forge-format-nuget",
@@ -1989,7 +2424,7 @@ dependencies = [
  "jsonwebtoken",
  "lettre",
  "log",
- "md-5",
+ "md-5 0.11.0",
  "mime_guess",
  "multer",
  "opentelemetry",
@@ -1998,8 +2433,10 @@ dependencies = [
  "opentelemetry-proto",
  "opentelemetry_sdk",
  "percent-encoding",
+ "pgp",
  "prost",
  "rand 0.10.3",
+ "rand_core 0.6.4",
  "rcgen",
  "reqwest",
  "rsa",
@@ -2101,6 +2538,12 @@ version = "1.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "42703706b716c37f96a77aea830392ad231f44c9e9a67872fa5548707e11b11c"
 
+[[package]]
+name = "funty"
+version = "2.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6d5a32815ae3f33302d95fdcb2ce17862f8c65363dcfd29360480ba1001fc9c"
+
 [[package]]
 name = "futures"
 version = "0.3.34"
@@ -2208,6 +2651,7 @@ checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a"
 dependencies = [
  "typenum",
  "version_check",
+ "zeroize",
 ]
 
 [[package]]
@@ -2249,13 +2693,23 @@ dependencies = [
  "wasm-bindgen",
 ]
 
+[[package]]
+name = "ghash"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0d8a4362ccb29cb0b265253fb0a2728f592895ee6854fd9bc13f2ffda266ff1"
+dependencies = [
+ "opaque-debug",
+ "polyval 0.6.2",
+]
+
 [[package]]
 name = "ghash"
 version = "0.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2eecf2d5dc9b66b732b97707a0210906b1d30523eb773193ab777c0c84b3e8d5"
 dependencies = [
- "polyval",
+ "polyval 0.7.3",
  "zeroize",
 ]
 
@@ -2272,6 +2726,17 @@ dependencies = [
  "regex-syntax",
 ]
 
+[[package]]
+name = "group"
+version = "0.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0f9ef7462f7c099f518d754361858f86d8a07af53ba9af0fe635bbccb151a63"
+dependencies = [
+ "ff",
+ "rand_core 0.6.4",
+ "subtle",
+]
+
 [[package]]
 name = "h2"
 version = "0.4.19"
@@ -2358,13 +2823,31 @@ version = "0.4.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
 
+[[package]]
+name = "hkdf"
+version = "0.12.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7b5f8eb2ad728638ea2c7d47a21db23b7b58a72ed6a38256b8a1849f15fbbdf7"
+dependencies = [
+ "hmac 0.12.1",
+]
+
 [[package]]
 name = "hkdf"
 version = "0.13.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4aaa26c720c68b866f2c96ef5c1264b3e6f473fe5d4ce61cd44bbe913e553018"
 dependencies = [
- "hmac",
+ "hmac 0.13.0",
+]
+
+[[package]]
+name = "hmac"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6c49c37c09c17a53d937dfbb742eb3a961d65a994e6bcdcf37e7399d0cc8ab5e"
+dependencies = [
+ "digest 0.10.7",
 ]
 
 [[package]]
@@ -2669,6 +3152,15 @@ dependencies = [
  "zerovec",
 ]
 
+[[package]]
+name = "idea"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "075557004419d7f2031b8bb7f44bb43e55a83ca7b63076a8fb8fe75753836477"
+dependencies = [
+ "cipher 0.4.4",
+]
+
 [[package]]
 name = "ident_case"
 version = "1.0.1"
@@ -2725,6 +3217,15 @@ version = "0.1.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c8fae54786f62fb2918dcfae3d568594e50eb9b5c25bf04371af6fe7516452fb"
 
+[[package]]
+name = "inout"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "879f10e63c20629ecabbb64a8010319738c66a5cd0c29b02d63d272b03751d01"
+dependencies = [
+ "generic-array",
+]
+
 [[package]]
 name = "inout"
 version = "0.2.2"
@@ -2903,6 +3404,29 @@ dependencies = [
  "zeroize",
 ]
 
+[[package]]
+name = "k256"
+version = "0.13.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f6e3919bbaa2945715f0bb6d3934a173d1e9a59ac23767fbaaef277265a7411b"
+dependencies = [
+ "cfg-if",
+ "ecdsa",
+ "elliptic-curve",
+ "once_cell",
+ "sha2 0.10.9",
+ "signature",
+]
+
+[[package]]
+name = "keccak"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb26cec98cce3a3d96cbb7bced3c4b16e3d13f27ec56dbd62cbc8f39cfb9d653"
+dependencies = [
+ "cpufeatures 0.2.17",
+]
+
 [[package]]
 name = "lazy_static"
 version = "1.5.0"
@@ -3004,6 +3528,15 @@ version = "0.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4050469837a6ff301cd14c1f8f24f88549e6d548f24f64e2148eb0f72cebc51f"
 
+[[package]]
+name = "lzma-rust2"
+version = "0.24.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "490750560fa7851fbbf5d3ab1a8750f09350ed361ed8aed85b1e1e40587812ee"
+dependencies = [
+ "sha2 0.11.1",
+]
+
 [[package]]
 name = "matchers"
 version = "0.2.0"
@@ -3031,6 +3564,16 @@ dependencies = [
  "thiserror",
 ]
 
+[[package]]
+name = "md-5"
+version = "0.10.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d89e7ee0cfbedfc4da3340218492196241d89eefb6dab27de5df917a6d2e78cf"
+dependencies = [
+ "cfg-if",
+ "digest 0.10.7",
+]
+
 [[package]]
 name = "md-5"
 version = "0.11.0"
@@ -3240,6 +3783,7 @@ dependencies = [
  "num-iter",
  "num-traits",
  "rand 0.8.8",
+ "serde",
  "smallvec",
  "zeroize",
 ]
@@ -3309,6 +3853,39 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "num_enum"
+version = "0.7.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5d0bca838442ec211fa11de3a8b0e0e8f3a4522575b5c4c06ed722e005036f26"
+dependencies = [
+ "num_enum_derive",
+ "rustversion",
+]
+
+[[package]]
+name = "num_enum_derive"
+version = "0.7.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "680998035259dcfcafe653688bf2aa6d3e2dc05e98be6ab46afb089dc84f1df8"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "ocb3"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c196e0276c471c843dd5777e7543a36a298a4be942a2a688d8111cd43390dedb"
+dependencies = [
+ "aead 0.5.2",
+ "cipher 0.4.4",
+ "ctr 0.9.2",
+ "subtle",
+]
+
 [[package]]
 name = "oid-registry"
 version = "0.8.1"
@@ -3324,6 +3901,12 @@ version = "1.21.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50"
 
+[[package]]
+name = "opaque-debug"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c08d65885ee38876c4f86fa503fb49d7b507c2b62552df7c70b2fce627e06381"
+
 [[package]]
 name = "openssl-probe"
 version = "0.2.1"
@@ -3421,6 +4004,44 @@ version = "0.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1a80800c0488c3a21695ea981a54918fbb37abf04f4d0720c453632255e2ff0e"
 
+[[package]]
+name = "p256"
+version = "0.13.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c9863ad85fa8f4460f9c48cb909d38a0d689dba1f6f6988a5e3e0d31071bcd4b"
+dependencies = [
+ "ecdsa",
+ "elliptic-curve",
+ "primeorder",
+ "sha2 0.10.9",
+]
+
+[[package]]
+name = "p384"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fe42f1670a52a47d448f14b6a5c61dd78fce51856e68edaa38f7ae3a46b8d6b6"
+dependencies = [
+ "ecdsa",
+ "elliptic-curve",
+ "primeorder",
+ "sha2 0.10.9",
+]
+
+[[package]]
+name = "p521"
+version = "0.13.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0fc9e2161f1f215afdfce23677034ae137bbd45016a880c2eb3ba8eb95f085b2"
+dependencies = [
+ "base16ct",
+ "ecdsa",
+ "elliptic-curve",
+ "primeorder",
+ "rand_core 0.6.4",
+ "sha2 0.10.9",
+]
+
 [[package]]
 name = "parking"
 version = "2.2.1"
@@ -3505,6 +4126,17 @@ dependencies = [
  "syn 2.0.119",
 ]
 
+[[package]]
+name = "password-hash"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "346f04948ba92c43e8469c1ee6736c7563d71012b17d40745260fe106aac2166"
+dependencies = [
+ "base64ct",
+ "rand_core 0.6.4",
+ "subtle",
+]
+
 [[package]]
 name = "password-hash"
 version = "0.6.1"
@@ -3573,6 +4205,75 @@ version = "2.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220"
 
+[[package]]
+name = "pgp"
+version = "0.21.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ae70f4d9325a391db30d115d6191a7bb67cec856aa0bba131290f0c4e09a532a"
+dependencies = [
+ "aead 0.5.2",
+ "aes 0.8.4",
+ "aes-gcm 0.10.3",
+ "aes-kw",
+ "argon2 0.5.3",
+ "base64 0.22.1",
+ "bitfields",
+ "block-padding",
+ "blowfish",
+ "buffer-redux",
+ "byteorder",
+ "bytes",
+ "camellia",
+ "cast5",
+ "cfb-mode",
+ "cipher 0.4.4",
+ "const-oid 0.9.6",
+ "crc24",
+ "curve25519-dalek",
+ "cx448",
+ "derive_builder",
+ "derive_more",
+ "des",
+ "digest 0.10.7",
+ "dsa",
+ "eax",
+ "ecdsa",
+ "ed25519-dalek",
+ "elliptic-curve",
+ "flate2",
+ "generic-array",
+ "hex",
+ "hkdf 0.12.4",
+ "idea",
+ "k256",
+ "log",
+ "md-5 0.10.6",
+ "memchr",
+ "nom 8.0.0",
+ "num-bigint-dig",
+ "num-traits",
+ "num_enum",
+ "ocb3",
+ "p256",
+ "p384",
+ "p521",
+ "rand 0.8.8",
+ "replace_with",
+ "ripemd",
+ "rsa",
+ "sha1 0.10.7",
+ "sha1-checked",
+ "sha2 0.10.9",
+ "sha3",
+ "signature",
+ "smallvec",
+ "snafu",
+ "subtle",
+ "twofish",
+ "x25519-dalek",
+ "zeroize",
+]
+
 [[package]]
 name = "phc"
 version = "0.6.1"
@@ -3662,7 +4363,19 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6e2d0073b297041425c7c3df6eb4792d598a15323fe63346852b092eca02904c"
 dependencies = [
  "cpufeatures 0.3.1",
- "universal-hash",
+ "universal-hash 0.6.1",
+]
+
+[[package]]
+name = "polyval"
+version = "0.6.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9d1fe60d06143b2430aa532c94cfe9e29783047f06c0d7fd359a9a51b729fa25"
+dependencies = [
+ "cfg-if",
+ "cpufeatures 0.2.17",
+ "opaque-debug",
+ "universal-hash 0.5.1",
 ]
 
 [[package]]
@@ -3673,7 +4386,7 @@ checksum = "f0fa31d631f2b2cb2a544d0aa321ce847a94764d701ca2becc411138b93d49cd"
 dependencies = [
  "cpubits",
  "cpufeatures 0.3.1",
- "universal-hash",
+ "universal-hash 0.6.1",
  "zeroize",
 ]
 
@@ -3716,6 +4429,15 @@ dependencies = [
  "zerocopy",
 ]
 
+[[package]]
+name = "primeorder"
+version = "0.13.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "353e1ca18966c16d9deb1c69278edbc5f194139612772bd9537af60ac231e1e6"
+dependencies = [
+ "elliptic-curve",
+]
+
 [[package]]
 name = "proc-macro2"
 version = "1.0.107"
@@ -3863,12 +4585,19 @@ version = "6.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf"
 
+[[package]]
+name = "radium"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc33ff2d4973d518d823d61aa239014831e521c75da58e3df4840d3f47749d09"
+
 [[package]]
 name = "rand"
 version = "0.8.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e058c7de0b26af77780c769414d6257830bb240f3c38477dbc2c16e5f54d6d4c"
 dependencies = [
+ "libc",
  "rand_chacha 0.3.1",
  "rand_core 0.6.4",
 ]
@@ -4056,6 +4785,12 @@ version = "0.8.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d6f6ff9a378485b298a5286656da665ba74413d36db0979633275d2e708145d4"
 
+[[package]]
+name = "replace_with"
+version = "0.1.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "51743d3e274e2b18df81c4dc6caf8a5b8e15dbe799e0dca05c7617380094e884"
+
 [[package]]
 name = "reqwest"
 version = "0.13.5"
@@ -4099,6 +4834,16 @@ dependencies = [
  "web-sys",
 ]
 
+[[package]]
+name = "rfc6979"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8dd2a808d456c4a54e300a23e9f5a67e122c3024119acbfd73e3bf664491cb2"
+dependencies = [
+ "hmac 0.12.1",
+ "subtle",
+]
+
 [[package]]
 name = "ring"
 version = "0.17.14"
@@ -4113,6 +4858,15 @@ dependencies = [
  "windows-sys 0.52.0",
 ]
 
+[[package]]
+name = "ripemd"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bd124222d17ad93a644ed9d011a40f4fb64aa54275c08cc216524a9ea82fb09f"
+dependencies = [
+ "digest 0.10.7",
+]
+
 [[package]]
 name = "rsa"
 version = "0.9.10"
@@ -4254,6 +5008,15 @@ version = "1.0.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cf54715a573b99ac80df0bc206da022bcd442c974952c7b9720069370852e21f"
 
+[[package]]
+name = "ruzstd"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "69e4ce4a039f42bf25920b95667e4d789e98749ab11bbb8d2c2936f788421bb5"
+dependencies = [
+ "twox-hash",
+]
+
 [[package]]
 name = "ryu"
 version = "1.0.23"
@@ -4308,6 +5071,21 @@ version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
 
+[[package]]
+name = "sec1"
+version = "0.7.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3e97a565f76233a6003f9f5c54be1d9c5bdfa3eccfb189469f11ec4901c47dc"
+dependencies = [
+ "base16ct",
+ "der",
+ "generic-array",
+ "pkcs8",
+ "serdect 0.2.0",
+ "subtle",
+ "zeroize",
+]
+
 [[package]]
 name = "secrecy"
 version = "0.10.3"
@@ -4471,6 +5249,26 @@ dependencies = [
  "syn 3.0.6",
 ]
 
+[[package]]
+name = "serdect"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a84f14a19e9a014bb9f4512488d9829a68e04ecabffb0f9904cd1ace94598177"
+dependencies = [
+ "base16ct",
+ "serde",
+]
+
+[[package]]
+name = "serdect"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f42f67da2385b51a5f9652db9c93d78aeaf7610bf5ec366080b6de810604af53"
+dependencies = [
+ "base16ct",
+ "serde",
+]
+
 [[package]]
 name = "sha1"
 version = "0.10.7"
@@ -4493,6 +5291,17 @@ dependencies = [
  "digest 0.11.3",
 ]
 
+[[package]]
+name = "sha1-checked"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "89f599ac0c323ebb1c6082821a54962b839832b03984598375bff3975b804423"
+dependencies = [
+ "digest 0.10.7",
+ "sha1 0.10.7",
+ "zeroize",
+]
+
 [[package]]
 name = "sha1_smol"
 version = "1.0.1"
@@ -4521,6 +5330,16 @@ dependencies = [
  "digest 0.11.3",
 ]
 
+[[package]]
+name = "sha3"
+version = "0.10.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77fd7028345d415a4034cf8777cd4f8ab1851274233b45f84e3d955502d93874"
+dependencies = [
+ "digest 0.10.7",
+ "keccak",
+]
+
 [[package]]
 name = "sharded-slab"
 version = "0.1.7"
@@ -4611,6 +5430,27 @@ dependencies = [
  "serde",
 ]
 
+[[package]]
+name = "snafu"
+version = "0.9.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e45cb604038abb7b926b679887b3226d8d0f23874b66623625a0454be425a4b7"
+dependencies = [
+ "snafu-derive",
+]
+
+[[package]]
+name = "snafu-derive"
+version = "0.9.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "287f59010008f0d7cf5e3b03196d666c1acc46c8d3e9cf34c28a1a7157601e72"
+dependencies = [
+ "heck",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
 [[package]]
 name = "snap"
 version = "1.1.2"
@@ -4786,11 +5626,11 @@ dependencies = [
  "futures-core",
  "futures-util",
  "hex",
- "hkdf",
- "hmac",
+ "hkdf 0.13.0",
+ "hmac 0.13.0",
  "itoa",
  "log",
- "md-5",
+ "md-5 0.11.0",
  "memchr",
  "rand 0.10.3",
  "serde",
@@ -4984,6 +5824,12 @@ version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7b2093cf4c8eb1e67749a6762251bc9cd836b6fc171623bd0a9d324d37af2417"
 
+[[package]]
+name = "tap"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "55937e1799185b12863d447f42597ed69d9928686b8d88a1df17376a097d8369"
+
 [[package]]
 name = "tar"
 version = "0.4.46"
@@ -5001,7 +5847,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd"
 dependencies = [
  "fastrand",
- "getrandom 0.3.4",
+ "getrandom 0.4.3",
  "once_cell",
  "rustix",
  "windows-sys 0.61.2",
@@ -5451,6 +6297,15 @@ version = "0.2.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e421abadd41a4225275504ea4d6566923418b7f05506fbc9c0fe86ba7396114b"
 
+[[package]]
+name = "twofish"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a78e83a30223c757c3947cd144a31014ff04298d8719ae10d03c31c0448c8013"
+dependencies = [
+ "cipher 0.4.4",
+]
+
 [[package]]
 name = "twox-hash"
 version = "2.1.5"
@@ -5511,6 +6366,28 @@ version = "0.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7df058c713841ad818f1dc5d3fd88063241cc61f49f5fbea4b951e8cf5a8d71d"
 
+[[package]]
+name = "unicode-segmentation"
+version = "1.13.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c6f5d3c3b1bf09027a88a6bc961fc00497d651009560b5463668dc81b0fa87a8"
+
+[[package]]
+name = "unicode-xid"
+version = "0.2.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ebc1c04c71510c7f702b52b7c350734c9ff1295c464a03335b00bb84fc54f853"
+
+[[package]]
+name = "universal-hash"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fc1de2c688dc15305988b563c3854064043356019f97a4b46276fe734c4f07ea"
+dependencies = [
+ "crypto-common 0.1.7",
+ "subtle",
+]
+
 [[package]]
 name = "universal-hash"
 version = "0.6.1"
@@ -5991,6 +6868,27 @@ version = "0.6.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3ad82d2a33cdc9674dc7465672f271e096168fcdbe0f799d9e6db8c5892679dc"
 
+[[package]]
+name = "wyz"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "05f360fc0b24296329c78fda852a1e9ae82de9cf7b27dae4b7f62f118f77b9ed"
+dependencies = [
+ "tap",
+]
+
+[[package]]
+name = "x25519-dalek"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c7e468321c81fb07fa7f4c636c3972b9100f0346e5b6a9f2bd0603a52f7ed277"
+dependencies = [
+ "curve25519-dalek",
+ "rand_core 0.6.4",
+ "serde",
+ "zeroize",
+]
+
 [[package]]
 name = "x509-parser"
 version = "0.18.1"
diff --git a/Cargo.toml b/Cargo.toml
index 98797614..b17541dc 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -12,6 +12,7 @@ members = [
     "crates/plugin",
     "crates/server",
     "crates/e2e",
+    "crates/formats/apt",
     "crates/formats/docker",
     "crates/formats/nuget",
     "crates/formats/npm",
diff --git a/DEVELOPMENT.md b/DEVELOPMENT.md
index 4aff1d16..260681a7 100644
--- a/DEVELOPMENT.md
+++ b/DEVELOPMENT.md
@@ -656,6 +656,21 @@ cargo build -p forge-server
 .github/scripts/raw-e2e.sh target/debug/forge-server target/raw-e2e
 ```
 
+apt repositories have theirs, CI's `apt-e2e` job: the real `apt-get` in a
+`debian:bookworm` container against a live server (uploads of packages built
+with `dpkg-deb`, Nexus' raw-body `POST` and a `PUT`; the redeploy refusal and
+path traversal; `InRelease` and `Release.gpg` verified with `gpgv`;
+`apt-get update` without a warning, an install and an upgrade with
+`signed-by` and `auth.conf.d` credentials; a signing key rotation; a proxy
+of a mock mirror, signed with its own key, installing again while the mirror
+is down). It needs curl, jq, python3, docker, `dpkg-deb`,
+`dpkg-scanpackages` (dpkg-dev), gpg and gpgv, a Postgres and an S3 endpoint:
+
+```bash
+cargo build -p forge-server
+.github/scripts/apt-e2e.sh target/debug/forge-server target/apt-e2e
+```
+
 npm repositories have theirs, CI's `npm-e2e` job: the real clients against a
 live server and a mock upstream registry (npm's browser login, approved
 through the page's API, and Yarn's password login; logout; publishes with
@@ -885,7 +900,7 @@ backups, upgrades) follow [docs/deployment.md](docs/deployment.md).
 ## CI and the merge queue
 
 CI (`.github/workflows/ci.yml`) has the jobs `fmt`, `clippy`, `audit`,
-`test`, `docker`, `kubernetes`, `web`, `oci-e2e`, `raw-e2e` and `npm-e2e`, and the slow
+`test`, `docker`, `kubernetes`, `web`, `oci-e2e`, `raw-e2e`, `apt-e2e` and `npm-e2e`, and the slow
 `e2e` and `web-e2e`, which pull requests skip: those two run in the merge
 queue and on every push to `main`. It runs on pull requests that target
 `main` only; a stacked one waits (see [Stacked pull
@@ -916,7 +931,7 @@ It sorts the change into groups of paths:
 
 | Group | Paths | Jobs |
 |---|---|---|
-| Rust | `crates/`, `xtask/`, `Cargo.toml`, `Cargo.lock`, `rust-toolchain.toml`, `.cargo/` (but `audit.toml`), `migrations/`, `.sqlx/`, `fixtures/`; the files the code or its tests read from outside the crates: `web/index.html`, `docker/forge.docker.toml`; and the scripts the jobs run: `test-parallel.sh`, `test-timings-runner.sh`, `test-timings-summary.sh`, `oci-e2e.sh`, `raw-e2e.sh`, `npm-e2e.sh` | `fmt`, `clippy`, `test`, `oci-e2e`, `raw-e2e`, `npm-e2e`, `e2e`, `web-e2e` |
+| Rust | `crates/`, `xtask/`, `Cargo.toml`, `Cargo.lock`, `rust-toolchain.toml`, `.cargo/` (but `audit.toml`), `migrations/`, `.sqlx/`, `fixtures/`; the files the code or its tests read from outside the crates: `web/index.html`, `docker/forge.docker.toml`; and the scripts the jobs run: `test-parallel.sh`, `test-timings-runner.sh`, `test-timings-summary.sh`, `oci-e2e.sh`, `raw-e2e.sh`, `apt-e2e.sh`, `npm-e2e.sh` | `fmt`, `clippy`, `test`, `oci-e2e`, `raw-e2e`, `apt-e2e`, `npm-e2e`, `e2e`, `web-e2e` |
 | Changelog | `docs/changes/` | `fmt` |
 | Release | what xtask's tests read from outside `xtask/`: the version lines `cargo xtask release` sets (`web/package.json`, `deploy/kubernetes/base/kustomization.yaml`, `deploy/helm/forge/Chart.yaml`) and `release-channels.sh` | `fmt` (which runs xtask's tests) |
 | Audit | `Cargo.lock`, `.cargo/audit.toml` | `audit` |
@@ -926,7 +941,7 @@ It sorts the change into groups of paths:
 
 A change to `ci-changes.sh` counts for every group. A change to `ci.yml`
 counts for the groups whose jobs it changes (#365): `fmt` is in Changelog;
-`clippy`, `test`, `oci-e2e`, `raw-e2e`, `npm-e2e` and `e2e` in Rust; `audit`
+`clippy`, `test`, `oci-e2e`, `raw-e2e`, `apt-e2e`, `npm-e2e` and `e2e` in Rust; `audit`
 in Audit; `web` and `web-e2e` in Web; `docker` and `docker-platform` in
 Image and `kubernetes` in Kubernetes. A change outside the jobs (the triggers, the settings, the
 `changes` job) or to a job missing from `CI_JOB_GROUP` in `ci-changes.sh`
@@ -972,7 +987,7 @@ To turn it on, edit the ruleset (or branch protection rule) of `main`:
 1. Enable **Require merge queue**. Keep its **status check timeout** above
    the run time of `e2e` and `web-e2e` (60 minutes by default).
 2. Under **Require status checks to pass**, require `fmt`, `clippy`, `audit`,
-   `test`, `docker`, `kubernetes`, `web`, `oci-e2e`, `raw-e2e`, `npm-e2e`,
+   `test`, `docker`, `kubernetes`, `web`, `oci-e2e`, `raw-e2e`, `apt-e2e`, `npm-e2e`,
    `e2e` and `web-e2e` from GitHub Actions: every job of `ci.yml` but
    `changes`, the jobs the release workflow requires of the tagged commit
    (`REQUIRED_JOBS` in `.github/workflows/release.yml`). A job left out here
diff --git a/README.md b/README.md
index 83c0d412..0ecb10e0 100644
--- a/README.md
+++ b/README.md
@@ -1,7 +1,7 @@
 # Forge
 
-A self-hosted **NuGet package registry, npm registry, Docker / OCI registry
-and raw file repository** written in Rust. It speaks the NuGet **V3**
+A self-hosted **NuGet package registry, npm registry, Docker / OCI registry,
+apt repository and raw file repository** written in Rust. It speaks the NuGet **V3**
 protocol, the **npm registry** protocol (npm, pnpm, Yarn, Bun) and the **OCI Distribution Spec**
 v1.1 (Docker, Podman, containerd, crane, Helm, cosign), and supports the
 three repository types you expect from an enterprise registry (more package
@@ -27,7 +27,9 @@ registry, and groups — see **[docs/docker.md](./docs/docker.md)** — and for
 under arbitrary paths (binaries, installers, fixtures), like Nexus' raw
 repositories, with ranges, checksum sidecars and proxies of any HTTP(S)
 download URL such as GitHub release assets — see
-**[docs/raw.md](./docs/raw.md)**.
+**[docs/raw.md](./docs/raw.md)**; and for Debian and Ubuntu packages, apt
+repositories whose indexes Forge signs with keys of their own, and proxies of
+Debian and Ubuntu mirrors — see **[docs/apt.md](./docs/apt.md)**.
 
 Storage is **content-addressed (CAS)** on top of any **S3-compatible** object
 store; package metadata lives in **PostgreSQL**. Access control is **fine-grained
@@ -57,7 +59,7 @@ A Cargo workspace of small crates plus the web SPA:
 | `core` | `forge-core` | Domain logic: repo dispatch, auth chain, authz/RBAC, sessions, OIDC, retention. |
 | `plugin-api` | `forge-plugin-api` | The format-plugin contract: the `FormatPlugin` trait and its types. |
 | `plugin` | `forge-plugin` | The host side of format plugins: an installed plugin and its adapter to the repository machinery. |
-| `formats/<id>` | `forge-format-*` | Format plugins, built into the server: `docker` (the distribution-spec `/v2` API, manifests, upstream registries), `nuget`, `npm`, `raw`. |
+| `formats/<id>` | `forge-format-*` | Format plugins, built into the server: `apt`, `docker` (the distribution-spec `/v2` API, manifests, upstream registries), `nuget`, `npm`, `raw`. |
 | `server` | `forge-server` | Axum HTTP server: the format plugins' feeds under `/repository/{repo}` (except Docker at `/v2`), the file store of files formats, the image store and registry tokens of images formats, `/admin` + `/auth` REST, background workers, static SPA serving. |
 | `e2e` | `forge-e2e` | End-to-end suite (testcontainers + mock upstream/IdP). |
 | `xtask` | — | The task runner (`cargo xtask …`); replaces Make/Just. |
@@ -209,6 +211,10 @@ The guides below are also a site, with navigation and search:
 - **[DEVELOPMENT.md](./DEVELOPMENT.md)** — full local-dev guide: every
   `cargo xtask` command, configuration knobs, OIDC/Entra setup, the web UI dev
   server, tests, and Docker packaging details.
+- **[apt repositories](./docs/apt.md)** — Debian and Ubuntu packages (hosted,
+  proxy) for `apt`: `.deb` uploads, indexes signed with the repository's keys
+  and their rotation, `sources.list` and `auth.conf.d`, proxies of Debian and
+  Ubuntu mirrors.
 - **[Docker / OCI registry](./docs/docker.md)** — image repositories (hosted,
   proxy, group), naming and host-based routing, `docker login`, retention and
   garbage collection.
diff --git a/crates/core/src/format.rs b/crates/core/src/format.rs
index 692aff96..56ee8403 100644
--- a/crates/core/src/format.rs
+++ b/crates/core/src/format.rs
@@ -80,6 +80,14 @@ pub trait Format: Send + Sync {
     /// Order two **normalized** version strings.
     fn compare_versions(&self, a: &str, b: &str) -> Ordering;
 
+    /// Whether the database's prerelease filter (a `-` in the version)
+    /// applies to the format's searches. A format without prereleases (apt,
+    /// whose `-` starts the Debian revision) has every version shown where
+    /// prereleases are hidden. Retention asks [`Self::version_class`].
+    fn has_prereleases(&self) -> bool {
+        true
+    }
+
     /// Lowercase / canonicalize a package id for case-insensitive lookups.
     fn lower_id(&self, id: &str) -> String;
 
diff --git a/crates/core/src/repo/proxy.rs b/crates/core/src/repo/proxy.rs
index d42a9e0a..2ce35671 100644
--- a/crates/core/src/repo/proxy.rs
+++ b/crates/core/src/repo/proxy.rs
@@ -186,7 +186,7 @@ const UPSTREAM_SEARCH_BACKOFF: std::time::Duration = std::time::Duration::from_s
 /// answers. Ids without cached versions still ask it.
 const UPSTREAM_LISTING_BACKOFF: std::time::Duration = std::time::Duration::from_secs(60);
 /// Default metadata TTL when a proxy leaves `metadata_ttl_seconds` unset.
-const DEFAULT_METADATA_TTL_SECONDS: i64 = 600;
+pub const DEFAULT_METADATA_TTL_SECONDS: i64 = 600;
 /// Default negative-cache TTL when a proxy leaves `not_found_ttl_seconds` unset.
 pub const DEFAULT_NOT_FOUND_TTL_SECONDS: i64 = 600;
 /// How long a document the upstream publishes once and never changes
@@ -595,6 +595,7 @@ impl ProxyRepo {
         let remote = api::Remote {
             url: repo.remote_url.clone().unwrap_or_default(),
             index: index.map(PersistedIndex::index),
+            options: repo.format_options(),
         };
         let mut origins = UpstreamOrigins::new(
             &remote.url,
@@ -924,12 +925,13 @@ impl ProxyRepo {
         &self,
         repo: &Repository,
         path: &str,
-    ) -> Result<Option<String>, RepoError> {
+    ) -> Result<Option<api::FileLocation>, RepoError> {
         match self
             .converse_resolved(repo, api::UpstreamOp::File(path.to_string()))
             .await?
         {
-            api::UpstreamAnswer::File(url) => Ok(url),
+            api::UpstreamAnswer::File(url) => Ok(url.map(api::FileLocation::at)),
+            api::UpstreamAnswer::FileAt(location) => Ok(Some(location)),
             api::UpstreamAnswer::Failed(reason) => Err(RepoError::Storage(reason)),
             _ => Err(RepoError::Storage(
                 "upstream protocol answered file with something else".into(),
diff --git a/crates/db/src/index_dao.rs b/crates/db/src/index_dao.rs
new file mode 100644
index 00000000..3c889867
--- /dev/null
+++ b/crates/db/src/index_dao.rs
@@ -0,0 +1,165 @@
+//! The indexes a repository's format keeps (apt): what they are made of,
+//! and which generation a repository serves (`repository_index`). The
+//! index files themselves are `raw_file` rows of the repository.
+
+use chrono::{DateTime, Utc};
+use sqlx::{PgExecutor, Postgres, Transaction};
+
+use crate::blob_dao;
+
+/// A listed version of a repository, as an index lists it.
+#[derive(Debug, Clone)]
+pub struct IndexedVersion {
+    pub name: String,
+    pub version: String,
+    pub version_original: String,
+    pub manifest_summary: Option<serde_json::Value>,
+    pub created_at: DateTime<Utc>,
+    pub size: i64,
+    pub sha256: String,
+    pub sha512_base64: Option<String>,
+}
+
+/// Every listed version of `repository_id`, with its package (the asset at
+/// `package_path`).
+pub async fn listed_versions<'e, E>(
+    executor: E,
+    repository_id: i64,
+    package_path: &str,
+) -> sqlx::Result<Vec<IndexedVersion>>
+where
+    E: PgExecutor<'e>,
+{
+    sqlx::query_as!(
+        IndexedVersion,
+        r#"
+        SELECT c.name, c.version, c.version_original, c.manifest_summary, c.created_at,
+               a.size, a.blob_sha256 AS sha256, a.sha512_base64
+        FROM component c
+        JOIN asset a ON a.component_id = c.id AND a.path = $2
+        WHERE c.repository_id = $1 AND c.listed
+        ORDER BY c.name, c.id
+        "#,
+        repository_id,
+        package_path,
+    )
+    .fetch_all(executor)
+    .await
+}
+
+/// A digest of the listed versions of `repository_id` and their packages:
+/// it changes whenever a version is published, deleted, unlisted, relisted
+/// or replaced.
+pub async fn versions_digest<'e, E>(
+    executor: E,
+    repository_id: i64,
+    package_path: &str,
+) -> sqlx::Result<String>
+where
+    E: PgExecutor<'e>,
+{
+    let digest = sqlx::query_scalar!(
+        r#"
+        SELECT md5(coalesce(string_agg(
+                   c.id::text || ':' || c.version || ':' || a.blob_sha256 || ':'
+                       || c.updated_at::text,
+                   ',' ORDER BY c.id), '')) AS "digest!"
+        FROM component c
+        JOIN asset a ON a.component_id = c.id AND a.path = $2
+        WHERE c.repository_id = $1 AND c.listed
+        "#,
+        repository_id,
+        package_path,
+    )
+    .fetch_one(executor)
+    .await?;
+    Ok(digest)
+}
+
+/// The fingerprint of the generation `repository_id` serves, if any.
+pub async fn current<'e, E>(executor: E, repository_id: i64) -> sqlx::Result<Option<String>>
+where
+    E: PgExecutor<'e>,
+{
+    sqlx::query_scalar!(
+        "SELECT fingerprint FROM repository_index WHERE repository_id = $1",
+        repository_id,
+    )
+    .fetch_optional(executor)
+    .await
+}
+
+/// Lock the generation of `repository_id` (creating its row), returning
+/// its fingerprint (`""` before the first).
+pub async fn lock(tx: &mut Transaction<'_, Postgres>, repository_id: i64) -> sqlx::Result<String> {
+    sqlx::query!(
+        r#"
+        INSERT INTO repository_index (repository_id, fingerprint)
+        VALUES ($1, '')
+        ON CONFLICT (repository_id) DO NOTHING
+        "#,
+        repository_id,
+    )
+    .execute(&mut **tx)
+    .await?;
+    sqlx::query_scalar!(
+        "SELECT fingerprint FROM repository_index WHERE repository_id = $1 FOR UPDATE",
+        repository_id,
+    )
+    .fetch_one(&mut **tx)
+    .await
+}
+
+/// Record that `repository_id` serves the generation `fingerprint`.
+pub async fn set(
+    tx: &mut Transaction<'_, Postgres>,
+    repository_id: i64,
+    fingerprint: &str,
+) -> sqlx::Result<()> {
+    sqlx::query!(
+        r#"
+        UPDATE repository_index SET fingerprint = $2, generated_at = now()
+        WHERE repository_id = $1
+        "#,
+        repository_id,
+        fingerprint,
+    )
+    .execute(&mut **tx)
+    .await?;
+    Ok(())
+}
+
+/// Delete the files of `repository_id` that the generation of `paths` does
+/// not name: at once, except a content-addressed file (`immutable`), which
+/// goes once no generation has named it for `keep`. Releases their blob
+/// references; returns how many were deleted.
+pub async fn prune(
+    tx: &mut Transaction<'_, Postgres>,
+    repository_id: i64,
+    paths: &[String],
+    keep: chrono::Duration,
+    grace: chrono::Duration,
+) -> sqlx::Result<u64> {
+    let keep_seconds = keep.num_seconds() as f64;
+    let mut shas = sqlx::query_scalar!(
+        r#"
+        DELETE FROM raw_file
+        WHERE repository_id = $1
+          AND NOT (path = ANY($2))
+          AND (NOT immutable
+               OR checked_at IS NULL
+               OR checked_at < now() - make_interval(secs => $3))
+        RETURNING blob_sha256
+        "#,
+        repository_id,
+        paths,
+        keep_seconds,
+    )
+    .fetch_all(&mut **tx)
+    .await?;
+    shas.sort_unstable();
+    for sha in &shas {
+        blob_dao::decref_and_maybe_enqueue_delete(tx, sha, grace).await?;
+    }
+    Ok(shas.len() as u64)
+}
diff --git a/crates/db/src/lib.rs b/crates/db/src/lib.rs
index 942d5b35..6eff5d49 100644
--- a/crates/db/src/lib.rs
+++ b/crates/db/src/lib.rs
@@ -21,6 +21,7 @@ pub mod encryption_key_dao;
 pub mod external_identity_dao;
 pub mod ids;
 pub mod import_dao;
+pub mod index_dao;
 pub mod invitation_dao;
 pub mod login_network_dao;
 pub mod model;
@@ -33,6 +34,7 @@ pub mod repository_dao;
 pub mod retention_dao;
 pub mod secret_dao;
 pub mod session_dao;
+pub mod signing_key_dao;
 pub mod tag_dao;
 pub mod token_dao;
 pub mod trusted_publish_audit_dao;
diff --git a/crates/db/src/model.rs b/crates/db/src/model.rs
index 3031d59f..57f7eed6 100644
--- a/crates/db/src/model.rs
+++ b/crates/db/src/model.rs
@@ -186,6 +186,26 @@ impl Repository {
     }
 }
 
+/// `repository.config` key of [`Repository::format_options`].
+pub const FORMAT_OPTIONS_KEY: &str = "options";
+
+impl Repository {
+    /// The repository's settings of its format's own (`config.options`, a
+    /// JSON object of strings), as `(name, value)`: apt's `distribution`.
+    pub fn format_options(&self) -> Vec<(String, String)> {
+        self.config
+            .get(FORMAT_OPTIONS_KEY)
+            .and_then(|v| v.as_object())
+            .map(|options| {
+                options
+                    .iter()
+                    .filter_map(|(k, v)| Some((k.clone(), v.as_str()?.to_string())))
+                    .collect()
+            })
+            .unwrap_or_default()
+    }
+}
+
 /// `repository.format` of NuGet repositories (the column default).
 pub const NUGET_FORMAT: &str = "nuget";
 
diff --git a/crates/db/src/raw_dao.rs b/crates/db/src/raw_dao.rs
index 8a2068af..7444dad6 100644
--- a/crates/db/src/raw_dao.rs
+++ b/crates/db/src/raw_dao.rs
@@ -36,6 +36,9 @@ pub struct RawFile {
     pub upstream_etag: Option<String>,
     pub upstream_last_modified: Option<String>,
     pub checked_at: Option<DateTime<Utc>>,
+    /// The file never changes at its path: a proxy never re-validates it,
+    /// and a content-addressed index file outlives its index by a day.
+    pub immutable: bool,
 }
 
 /// The bounds of the files under directory `prefix` (`""` for the root, else
@@ -56,7 +59,7 @@ pub async fn find(pool: &PgPool, repository_id: i64, path: &str) -> sqlx::Result
         SELECT f.id, f.repository_id, f.path, f.blob_sha256, b.s3_key, f.size,
                f.content_type, f.sha512_base64, f.sha1, f.md5, f.created_at,
                f.updated_at, f.last_downloaded_at, f.upstream_etag,
-               f.upstream_last_modified, f.checked_at
+               f.upstream_last_modified, f.checked_at, f.immutable
         FROM raw_file f
         JOIN blob b ON b.sha256 = f.blob_sha256
         WHERE f.repository_id = $1 AND f.path = $2
@@ -121,6 +124,8 @@ pub struct NewRawFile<'a> {
     pub upstream_etag: Option<&'a str>,
     pub upstream_last_modified: Option<&'a str>,
     pub checked: bool,
+    /// The file never changes at its path ([`RawFile::immutable`]).
+    pub immutable: bool,
 }
 
 /// Whether [`store`] may replace a file that exists with other content.
@@ -165,9 +170,9 @@ pub async fn store(
             r#"
             INSERT INTO raw_file (repository_id, path, blob_sha256, size, content_type,
                                   sha512_base64, sha1, md5, upstream_etag,
-                                  upstream_last_modified, checked_at)
+                                  upstream_last_modified, checked_at, immutable)
             VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10,
-                    CASE WHEN $11 THEN now() END)
+                    CASE WHEN $11 THEN now() END, $12)
             ON CONFLICT (repository_id, path) DO NOTHING
             RETURNING id
             "#,
@@ -182,6 +187,7 @@ pub async fn store(
             file.upstream_etag,
             file.upstream_last_modified,
             file.checked,
+            file.immutable,
         )
         .fetch_optional(&mut **tx)
         .await?;
@@ -214,7 +220,8 @@ pub async fn store(
                 SET content_type = $2,
                     upstream_etag = $3,
                     upstream_last_modified = $4,
-                    checked_at = CASE WHEN $5 THEN now() ELSE checked_at END
+                    checked_at = CASE WHEN $5 THEN now() ELSE checked_at END,
+                    immutable = $6
                 WHERE id = $1
                 "#,
                 existing.id,
@@ -222,6 +229,7 @@ pub async fn store(
                 file.upstream_etag,
                 file.upstream_last_modified,
                 file.checked,
+                file.immutable,
             )
             .execute(&mut **tx)
             .await?;
@@ -237,6 +245,7 @@ pub async fn store(
             SET blob_sha256 = $2, size = $3, content_type = $4, sha512_base64 = $5,
                 sha1 = $6, md5 = $7, upstream_etag = $8, upstream_last_modified = $9,
                 checked_at = CASE WHEN $10 THEN now() END,
+                immutable = $11,
                 updated_at = greatest(now(), updated_at + interval '1 microsecond')
             WHERE id = $1
             "#,
@@ -250,6 +259,7 @@ pub async fn store(
             file.upstream_etag,
             file.upstream_last_modified,
             file.checked,
+            file.immutable,
         )
         .execute(&mut **tx)
         .await?;
@@ -563,7 +573,7 @@ pub async fn walk_directory(
                f.id, f.repository_id, f.path, f.blob_sha256, b.s3_key, f.size,
                f.content_type, f.sha512_base64, f.sha1, f.md5, f.created_at,
                f.updated_at, f.last_downloaded_at, f.upstream_etag,
-               f.upstream_last_modified, f.checked_at
+               f.upstream_last_modified, f.checked_at, f.immutable
         FROM walk w
         LEFT JOIN raw_file f
                ON f.repository_id = $1 AND f.path = w.path
diff --git a/crates/db/src/secret_dao.rs b/crates/db/src/secret_dao.rs
index ef9831c3..031a18d9 100644
--- a/crates/db/src/secret_dao.rs
+++ b/crates/db/src/secret_dao.rs
@@ -297,7 +297,7 @@ pub async fn get_upstream_credential(
 /// The re-sealed blob for a sweep, or `None` when `blob` is already sealed
 /// under `binding` with the active DEK. A blob that does not decrypt under
 /// `binding` is logged and skipped.
-async fn reseal_if_due(
+pub(crate) async fn reseal_if_due(
     envelope: &EnvelopeService,
     blob: &[u8],
     binding: AeadBinding<'_>,
@@ -500,6 +500,21 @@ async fn scan_referenced_dek_versions(
             }
         }
     }
+    let signing_keys = sqlx::query!(
+        r#"SELECT id, secret_key_enc AS "secret_key_enc!" FROM repository_signing_key WHERE secret_key_enc IS NOT NULL"#,
+    )
+    .fetch_all(&mut *conn)
+    .await?;
+    for row in &signing_keys {
+        match EnvelopeService::blob_dek_version(&row.secret_key_enc) {
+            Ok(version) => {
+                versions.insert(version);
+            }
+            Err(e) => {
+                tracing::warn!(signing_key_id = row.id, error = %e, "unreadable signing key envelope; skipped");
+            }
+        }
+    }
     let import_blobs = sqlx::query!(
         r#"SELECT id, password_enc AS "password_enc!" FROM repository_import WHERE password_enc IS NOT NULL"#,
     )
diff --git a/crates/db/src/signing_key_dao.rs b/crates/db/src/signing_key_dao.rs
new file mode 100644
index 00000000..7dc6d45b
--- /dev/null
+++ b/crates/db/src/signing_key_dao.rs
@@ -0,0 +1,207 @@
+//! `repository_signing_key`: the OpenPGP keys that sign a repository's
+//! indexes (apt), each secret key sealed with the secret encryption and
+//! AAD-bound to `('repository_signing_key', 'secret_key_enc', <row id>)` and
+//! the key's fingerprint, so a sealed key copied to another row (or another
+//! key's row) does not open.
+
+use chrono::{DateTime, Utc};
+use forge_crypto::envelope::AeadBinding;
+use forge_crypto::service::EnvelopeService;
+use forge_crypto::PlaintextSecret;
+use sqlx::{PgExecutor, PgPool, Postgres, Transaction};
+
+use crate::secret_dao::{reseal_if_due, SecretDbError};
+
+/// Owning table of a sealed signing key (AAD component).
+pub const TABLE: &str = "repository_signing_key";
+/// Owning column of a sealed signing key (AAD component).
+pub const COLUMN: &str = "secret_key_enc";
+
+fn binding(id: i64, fingerprint: &str) -> AeadBinding<'_> {
+    AeadBinding {
+        table: TABLE,
+        column: COLUMN,
+        row_pk: id,
+        destination: Some(fingerprint),
+    }
+}
+
+/// A key of a repository.
+#[derive(Debug, Clone)]
+pub struct SigningKeyRow {
+    pub id: i64,
+    pub repository_id: i64,
+    pub fingerprint: String,
+    pub algorithm: String,
+    pub user_id: String,
+    pub public_key: String,
+    pub secret_key_enc: Option<Vec<u8>>,
+    pub created_at: DateTime<Utc>,
+}
+
+/// What is stored of a new key.
+#[derive(Debug, Clone, Copy)]
+pub struct NewSigningKey<'a> {
+    pub fingerprint: &'a str,
+    pub algorithm: &'a str,
+    pub user_id: &'a str,
+    pub public_key: &'a str,
+}
+
+/// The keys of `repository_id`, oldest first.
+pub async fn list<'e, E>(executor: E, repository_id: i64) -> sqlx::Result<Vec<SigningKeyRow>>
+where
+    E: PgExecutor<'e>,
+{
+    sqlx::query_as!(
+        SigningKeyRow,
+        r#"
+        SELECT id, repository_id, fingerprint, algorithm, user_id, public_key,
+               secret_key_enc, created_at
+        FROM repository_signing_key
+        WHERE repository_id = $1
+        ORDER BY created_at, id
+        "#,
+        repository_id,
+    )
+    .fetch_all(executor)
+    .await
+}
+
+/// Store `key` for `repository_id` with its secret key (the armored key),
+/// sealed for the new row. `None` when the repository has the key already.
+pub async fn insert(
+    tx: &mut Transaction<'_, Postgres>,
+    envelope: &EnvelopeService,
+    repository_id: i64,
+    key: &NewSigningKey<'_>,
+    secret: &PlaintextSecret,
+) -> Result<Option<i64>, SecretDbError> {
+    let Some(id) = sqlx::query_scalar!(
+        r#"
+        INSERT INTO repository_signing_key
+            (repository_id, fingerprint, algorithm, user_id, public_key)
+        VALUES ($1, $2, $3, $4, $5)
+        ON CONFLICT (repository_id, fingerprint) DO NOTHING
+        RETURNING id
+        "#,
+        repository_id,
+        key.fingerprint,
+        key.algorithm,
+        key.user_id,
+        key.public_key,
+    )
+    .fetch_optional(&mut **tx)
+    .await?
+    else {
+        return Ok(None);
+    };
+    let sealed = envelope.seal(secret, binding(id, key.fingerprint)).await?;
+    sqlx::query!(
+        "UPDATE repository_signing_key SET secret_key_enc = $2 WHERE id = $1",
+        id,
+        &sealed,
+    )
+    .execute(&mut **tx)
+    .await?;
+    Ok(Some(id))
+}
+
+/// The secret key of `row` (the armored key it was stored with).
+pub async fn open(
+    envelope: &EnvelopeService,
+    row: &SigningKeyRow,
+) -> Result<PlaintextSecret, SecretDbError> {
+    let blob = row
+        .secret_key_enc
+        .as_deref()
+        .ok_or(SecretDbError::RepoNotFound(row.repository_id))?;
+    Ok(envelope
+        .open(blob, binding(row.id, &row.fingerprint))
+        .await?)
+}
+
+/// Delete the key `fingerprint` of `repository_id`, unless it is the
+/// repository's last. `Ok(None)`: no such key; `Ok(Some(false))`: the last
+/// key, kept.
+pub async fn delete(
+    pool: &PgPool,
+    repository_id: i64,
+    fingerprint: &str,
+) -> sqlx::Result<Option<bool>> {
+    let mut tx = crate::begin(pool).await?;
+    // Every key of the repository, locked: two deletes cannot both see a
+    // second key.
+    let keys = sqlx::query_scalar!(
+        r#"
+        SELECT fingerprint FROM repository_signing_key
+        WHERE repository_id = $1
+        ORDER BY id
+        FOR UPDATE
+        "#,
+        repository_id,
+    )
+    .fetch_all(&mut *tx)
+    .await?;
+    if !keys.iter().any(|k| k == fingerprint) {
+        return Ok(None);
+    }
+    if keys.len() < 2 {
+        return Ok(Some(false));
+    }
+    sqlx::query!(
+        "DELETE FROM repository_signing_key WHERE repository_id = $1 AND fingerprint = $2",
+        repository_id,
+        fingerprint,
+    )
+    .execute(&mut *tx)
+    .await?;
+    tx.commit().await?;
+    Ok(Some(true))
+}
+
+/// Re-seal every signing key sealed under a DEK other than the active one
+/// (the DEK-rotation sweep). Returns how many were re-sealed.
+pub async fn reseal(pool: &PgPool, envelope: &EnvelopeService) -> Result<usize, SecretDbError> {
+    let rows = sqlx::query!(
+        r#"
+        SELECT id, fingerprint, secret_key_enc AS "secret_key_enc!"
+        FROM repository_signing_key WHERE secret_key_enc IS NOT NULL
+        ORDER BY id
+        "#,
+    )
+    .fetch_all(pool)
+    .await?;
+    let mut resealed = 0;
+    for row in rows {
+        let Some(new_blob) = reseal_if_due(
+            envelope,
+            &row.secret_key_enc,
+            binding(row.id, &row.fingerprint),
+        )
+        .await?
+        else {
+            continue;
+        };
+        let res = sqlx::query!(
+            r#"
+            WITH dek AS (
+                SELECT 1 FROM encryption_key
+                WHERE layer = 'dek' AND scope = $4 AND version = $5 AND state <> 'revoked'
+                FOR SHARE
+            )
+            UPDATE repository_signing_key SET secret_key_enc = $2
+            WHERE id = $1 AND secret_key_enc = $3 AND EXISTS (SELECT 1 FROM dek)
+            "#,
+            row.id,
+            &new_blob,
+            &row.secret_key_enc,
+            envelope.scope(),
+            EnvelopeService::blob_dek_version(&new_blob)?,
+        )
+        .execute(pool)
+        .await?;
+        resealed += usize::try_from(res.rows_affected()).unwrap_or(0);
+    }
+    Ok(resealed)
+}
diff --git a/crates/db/tests/migrations.rs b/crates/db/tests/migrations.rs
index ec5cb6e4..f8205f4f 100644
--- a/crates/db/tests/migrations.rs
+++ b/crates/db/tests/migrations.rs
@@ -55,6 +55,9 @@ const EXPECTED_TABLES: &[&str] = &[
     "workload_api_key_trusted_publisher",
     // device authorization grant (RFC 8628)
     "device_authorization",
+    // signed indexes (apt)
+    "repository_signing_key",
+    "repository_index",
 ];
 
 /// The credential-forwarding provenance columns of `app_user`: (table, column).
diff --git a/crates/db/tests/raw.rs b/crates/db/tests/raw.rs
index 26f41434..de6728fc 100644
--- a/crates/db/tests/raw.rs
+++ b/crates/db/tests/raw.rs
@@ -55,6 +55,7 @@ fn file<'a>(path: &'a str, sha: &'a str) -> NewRawFile<'a> {
         upstream_etag: None,
         upstream_last_modified: None,
         checked: false,
+        immutable: false,
     }
 }
 
diff --git a/crates/formats/README.md b/crates/formats/README.md
index 708ce114..713345f1 100644
--- a/crates/formats/README.md
+++ b/crates/formats/README.md
@@ -7,6 +7,7 @@ the design, the contract and how to write one.
 
 | Plugin | Format id | What it serves |
 | --- | --- | --- |
+| [`apt`](apt) | `apt` | apt (Debian/Ubuntu) repositories at `/repository/{repo}`: `.deb` uploads, indexes signed with the repository's keys, `apt-get` installs; hosted and proxy repositories ([docs/apt.md](../../docs/apt.md)) |
 | [`docker`](docker) | `docker` | Docker / OCI registries at `/v2`: push and pull images, indexes and artifacts (Helm charts, signatures, SBOMs); hosted, proxy and group repositories ([docs/docker.md](../../docs/docker.md)) |
 | [`nuget`](nuget) | `nuget` | NuGet V3 feeds at `/repository/{repo}`: push, restore, search, unlist and relist; hosted, proxy and group repositories |
 | [`npm`](npm) | `npm` | npm registries at `/repository/{repo}` for npm, pnpm, Yarn and Bun: publish, install, dist-tags, deprecations, unpublishing, search, audits and logins; hosted, proxy and group repositories ([docs/npm.md](../../docs/npm.md)) |
@@ -21,8 +22,10 @@ A plugin directory holds:
   description, repository kinds (`Proxy` when it implements
   `upstream`), its `storage` (`Packages`, `Files` for a files format such
   as raw, or `Images` for an images format such as Docker), its asset
-  names, and how a proxy sends a token (`upstream_token`: `Bearer` for
-  npm).
+  names, how a proxy sends a token (`upstream_token`: `Bearer` for
+  npm), its options (`options`: apt's `distribution`), which versions are
+  prereleases (`prereleases`), and whether the host keeps signed indexes of
+  its hosted repositories (`indexes`: apt).
 
 The server installs it in `plugins::builtin()`
 ([`crates/server/src/plugins.rs`](../server/src/plugins.rs)), whose tests
diff --git a/crates/formats/apt/Cargo.toml b/crates/formats/apt/Cargo.toml
new file mode 100644
index 00000000..49340478
--- /dev/null
+++ b/crates/formats/apt/Cargo.toml
@@ -0,0 +1,31 @@
+[package]
+name = "forge-format-apt"
+# The plugin's own version, its descriptor's.
+version = "1.0.0"
+edition.workspace = true
+rust-version.workspace = true
+license.workspace = true
+publish.workspace = true
+description = "apt (Debian/Ubuntu) repositories for Forge, as a format plugin"
+
+[dependencies]
+forge-plugin-api = { path = "../../plugin-api" }
+
+serde = { workspace = true }
+serde_json = { workspace = true }
+chrono = { workspace = true }
+sha2 = { workspace = true }
+hex = { workspace = true }
+base64 = { workspace = true }
+url = { workspace = true }
+# A .deb is an ar archive whose control member is a tar, compressed with
+# gzip, xz or zstd (or not at all); indexes are published as gzip and xz.
+tar = { version = "0.4", default-features = false }
+flate2 = { version = "1.1", default-features = false, features = ["zlib-rs"] }
+# Pure Rust xz, both ways (Apache-2.0).
+lzma-rust2 = { version = "0.24", default-features = false, features = ["std", "encoder", "optimization", "xz"] }
+# Pure Rust zstd decoding (MIT): Ubuntu builds its packages with zstd.
+ruzstd = "0.9"
+
+[dev-dependencies]
+forge-plugin-api = { path = "../../plugin-api", features = ["testing"] }
diff --git a/crates/formats/apt/src/control.rs b/crates/formats/apt/src/control.rs
new file mode 100644
index 00000000..30bce06a
--- /dev/null
+++ b/crates/formats/apt/src/control.rs
@@ -0,0 +1,360 @@
+//! Control data: the deb822 paragraphs of a package's `control` file and of
+//! the `Packages` indexes (Debian Policy 5.1), and the names they hold.
+//!
+//! A paragraph is a list of fields, `Name: value`, each value continuing on
+//! the following lines that start with a space or a tab. Field names are
+//! compared without regard to case and appear once. A paragraph is parsed
+//! strictly and written back in one canonical spelling, so that what a
+//! package's control file says cannot add lines (or paragraphs) to an index.
+
+use std::fmt;
+
+/// The longest control file read from a package, in bytes.
+pub const MAX_CONTROL_BYTES: usize = 1024 * 1024;
+
+/// The longest package name (Debian has no limit; the host bounds ids).
+pub const MAX_NAME_BYTES: usize = 128;
+
+/// The longest architecture or component name.
+pub const MAX_WORD_BYTES: usize = 64;
+
+/// Why control data is refused.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct ControlError(pub String);
+
+impl fmt::Display for ControlError {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str(&self.0)
+    }
+}
+
+fn error<T>(message: impl Into<String>) -> Result<T, ControlError> {
+    Err(ControlError(message.into()))
+}
+
+/// One field: its name as written, and its value. A value's first line is
+/// trimmed; each following line keeps its leading space or tab and is
+/// joined with `\n`.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct Field {
+    pub name: String,
+    pub value: String,
+}
+
+/// A paragraph of fields, in the order they were written.
+#[derive(Debug, Clone, PartialEq, Eq, Default)]
+pub struct Paragraph {
+    pub fields: Vec<Field>,
+}
+
+impl Paragraph {
+    /// Parse a text holding exactly one paragraph (blank lines around it are
+    /// allowed).
+    pub fn parse_one(text: &str) -> Result<Paragraph, ControlError> {
+        let mut paragraphs = Paragraph::parse_all(text)?;
+        match paragraphs.len() {
+            1 => Ok(paragraphs.remove(0)),
+            0 => error("the control data holds no fields"),
+            _ => error("the control data holds more than one paragraph"),
+        }
+    }
+
+    /// Parse every paragraph of `text`.
+    pub fn parse_all(text: &str) -> Result<Vec<Paragraph>, ControlError> {
+        let mut paragraphs = Vec::new();
+        let mut current = Paragraph::default();
+        for (number, line) in text.split('\n').enumerate() {
+            let line = line.strip_suffix('\r').unwrap_or(line);
+            if line.chars().any(|c| c.is_control() && c != '\t') {
+                return error(format!("line {}: control characters", number + 1));
+            }
+            if line.trim().is_empty() {
+                if !current.fields.is_empty() {
+                    paragraphs.push(std::mem::take(&mut current));
+                }
+                continue;
+            }
+            if line.starts_with([' ', '\t']) {
+                let Some(field) = current.fields.last_mut() else {
+                    return error(format!(
+                        "line {}: a continuation line without a field",
+                        number + 1
+                    ));
+                };
+                field.value.push('\n');
+                field.value.push_str(line.trim_end());
+                continue;
+            }
+            let Some((name, value)) = line.split_once(':') else {
+                return error(format!("line {}: not a field (`Name: value`)", number + 1));
+            };
+            if !valid_field_name(name) {
+                return error(format!("line {}: {name:?} is not a field name", number + 1));
+            }
+            if current.get(name).is_some() {
+                return error(format!("field {name} appears twice"));
+            }
+            current.fields.push(Field {
+                name: name.to_string(),
+                value: value.trim().to_string(),
+            });
+        }
+        if !current.fields.is_empty() {
+            paragraphs.push(current);
+        }
+        Ok(paragraphs)
+    }
+
+    /// The value of field `name` (any case), if present.
+    pub fn get(&self, name: &str) -> Option<&str> {
+        self.fields
+            .iter()
+            .find(|f| f.name.eq_ignore_ascii_case(name))
+            .map(|f| f.value.as_str())
+    }
+
+    /// The first line of field `name`, if present and not empty.
+    pub fn first_line(&self, name: &str) -> Option<&str> {
+        self.get(name)
+            .map(|v| v.split('\n').next().unwrap_or(""))
+            .filter(|v| !v.is_empty())
+    }
+
+    /// Remove field `name` (any case).
+    pub fn remove(&mut self, name: &str) {
+        self.fields.retain(|f| !f.name.eq_ignore_ascii_case(name));
+    }
+
+    /// Set field `name` to a one-line `value`, replacing it where it is or
+    /// appending it.
+    pub fn set(&mut self, name: &str, value: &str) {
+        let value = value.replace(['\n', '\r'], " ");
+        match self
+            .fields
+            .iter_mut()
+            .find(|f| f.name.eq_ignore_ascii_case(name))
+        {
+            Some(field) => field.value = value,
+            None => self.fields.push(Field {
+                name: name.to_string(),
+                value,
+            }),
+        }
+    }
+
+    /// The paragraph as text, each field on its lines, ending in `\n`.
+    pub fn to_text(&self) -> String {
+        let mut out = String::new();
+        for field in &self.fields {
+            let mut lines = field.value.split('\n');
+            let first = lines.next().unwrap_or("");
+            out.push_str(&field.name);
+            out.push(':');
+            if !first.is_empty() {
+                out.push(' ');
+                out.push_str(first);
+            }
+            out.push('\n');
+            for line in lines {
+                // Parsed continuation lines start with a space or a tab and
+                // are not empty; anything else is written as a continuation.
+                if line.trim().is_empty() {
+                    out.push_str(" .");
+                } else {
+                    if !line.starts_with([' ', '\t']) {
+                        out.push(' ');
+                    }
+                    out.push_str(line);
+                }
+                out.push('\n');
+            }
+        }
+        out
+    }
+}
+
+/// Whether `name` may name a field: printable ASCII but space and `:`, not
+/// starting with `#` or `-`.
+fn valid_field_name(name: &str) -> bool {
+    !name.is_empty()
+        && name.len() <= 64
+        && !name.starts_with(['#', '-'])
+        && name.bytes().all(|b| b.is_ascii_graphic() && b != b':')
+}
+
+/// Whether `name` is a binary package name: lowercase letters, digits and
+/// `+ - .`, at least two characters, starting with a letter or a digit.
+pub fn valid_package_name(name: &str) -> bool {
+    name.len() >= 2
+        && name.len() <= MAX_NAME_BYTES
+        && name.starts_with(|c: char| c.is_ascii_lowercase() || c.is_ascii_digit())
+        && name.bytes().all(|b| {
+            b.is_ascii_lowercase() || b.is_ascii_digit() || matches!(b, b'+' | b'-' | b'.')
+        })
+}
+
+/// Whether `arch` is a binary package's architecture: `all`, or a Debian
+/// architecture name (lowercase letters, digits and `-`). `any` and
+/// `source` name none.
+pub fn valid_architecture(arch: &str) -> bool {
+    !arch.is_empty()
+        && arch.len() <= MAX_WORD_BYTES
+        && arch != "any"
+        && arch != "source"
+        && arch.starts_with(|c: char| c.is_ascii_lowercase() || c.is_ascii_digit())
+        && arch
+            .bytes()
+            .all(|b| b.is_ascii_lowercase() || b.is_ascii_digit() || b == b'-')
+}
+
+/// Whether `component` is a component name (`main`, `non-free-firmware`).
+pub fn valid_component(component: &str) -> bool {
+    !component.is_empty()
+        && component.len() <= MAX_WORD_BYTES
+        && component.starts_with(|c: char| c.is_ascii_lowercase() || c.is_ascii_digit())
+        && component.bytes().all(|b| {
+            b.is_ascii_lowercase() || b.is_ascii_digit() || matches!(b, b'-' | b'+' | b'.')
+        })
+}
+
+/// The component a package's `Section` puts it in: the part before a `/`
+/// (`contrib/net` is in `contrib`), else `main`.
+pub fn component_of(section: Option<&str>) -> Result<String, ControlError> {
+    match section.and_then(|s| s.split_once('/')) {
+        Some((component, _)) if valid_component(component) => Ok(component.to_string()),
+        Some((component, _)) => error(format!(
+            "Section names the component {component:?}, which is not a component name"
+        )),
+        None => Ok("main".to_string()),
+    }
+}
+
+/// The relations of a `Depends`-like field: each comma-separated clause,
+/// as `(package, version constraint)` of its first alternative, the
+/// alternatives kept in the name (`foo | bar`).
+pub fn relations(value: &str) -> Vec<(String, Option<String>)> {
+    value
+        .split(',')
+        .map(|clause| clause.split_whitespace().collect::<Vec<_>>().join(" "))
+        .filter(|clause| !clause.is_empty())
+        .map(|clause| {
+            if clause.contains('|') {
+                return (clause, None);
+            }
+            match clause.split_once('(') {
+                Some((name, constraint)) => (
+                    name.trim().to_string(),
+                    Some(constraint.trim_end_matches(')').trim().to_string())
+                        .filter(|c| !c.is_empty()),
+                ),
+                None => (clause, None),
+            }
+        })
+        .collect()
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    const CONTROL: &str = "Package: hello\nVersion: 2.10-3\nArchitecture: amd64\n\
+        Maintainer: Santiago Vila <sanvila@debian.org>\nInstalled-Size: 280\n\
+        Depends: libc6 (>= 2.34)\nSection: devel\nPriority: optional\n\
+        Homepage: https://www.gnu.org/software/hello/\n\
+        Description: example package based on GNU hello\n The GNU hello program produces a familiar, friendly greeting.\n .\n Seriously.\n";
+
+    #[test]
+    fn a_control_file_round_trips() {
+        let p = Paragraph::parse_one(CONTROL).unwrap();
+        assert_eq!(p.get("package"), Some("hello"));
+        assert_eq!(p.get("VERSION"), Some("2.10-3"));
+        assert_eq!(
+            p.first_line("Description"),
+            Some("example package based on GNU hello")
+        );
+        assert_eq!(p.to_text(), CONTROL);
+    }
+
+    #[test]
+    fn malformed_control_data_is_refused() {
+        for bad in [
+            " leading continuation\n",
+            "Package hello\n",
+            "Package: a\npackage: b\n",
+            "Package: a\n\nPackage: b\n",
+            "Package: a\x07\n",
+            "#Comment: x\n",
+            "-Field: x\n",
+            ": empty\n",
+            "",
+        ] {
+            assert!(Paragraph::parse_one(bad).is_err(), "{bad:?}");
+        }
+    }
+
+    #[test]
+    fn writing_cannot_inject_lines_or_paragraphs() {
+        let mut p = Paragraph::parse_one("Package: a\nDescription: x\n y\n").unwrap();
+        p.set("Filename", "pool/x\n\nPackage: evil");
+        let text = p.to_text();
+        assert_eq!(Paragraph::parse_all(&text).unwrap().len(), 1);
+        assert!(text.contains("Filename: pool/x  Package: evil\n"));
+        // Continuation lines that are not indented or empty are indented.
+        let p = Paragraph {
+            fields: vec![Field {
+                name: "Description".into(),
+                value: "short\nnot indented\n\n end".into(),
+            }],
+        };
+        assert_eq!(p.to_text(), "Description: short\n not indented\n .\n end\n");
+    }
+
+    #[test]
+    fn crlf_lines_are_read() {
+        let p = Paragraph::parse_one("Package: a\r\nVersion: 1\r\n").unwrap();
+        assert_eq!(p.get("Version"), Some("1"));
+    }
+
+    #[test]
+    fn names_are_checked() {
+        for good in ["hello", "libc6", "g++", "lib32stdc++6", "0ad", "python3.11"] {
+            assert!(valid_package_name(good), "{good}");
+        }
+        for bad in [
+            "a", "Hello", "-x", "+x", "a_b", "a b", "a/b", "a:b", "..", "",
+        ] {
+            assert!(!valid_package_name(bad), "{bad}");
+        }
+        for good in ["amd64", "all", "arm64", "hurd-i386", "ppc64el"] {
+            assert!(valid_architecture(good), "{good}");
+        }
+        for bad in ["any", "source", "AMD64", "x/y", "", "-x", "a_b"] {
+            assert!(!valid_architecture(bad), "{bad}");
+        }
+    }
+
+    #[test]
+    fn the_section_names_the_component() {
+        assert_eq!(component_of(Some("contrib/net")).unwrap(), "contrib");
+        assert_eq!(
+            component_of(Some("non-free-firmware/kernel")).unwrap(),
+            "non-free-firmware"
+        );
+        assert_eq!(component_of(Some("utils")).unwrap(), "main");
+        assert_eq!(component_of(None).unwrap(), "main");
+        assert!(component_of(Some("../x/y")).is_err());
+        assert!(component_of(Some("Main/x")).is_err());
+    }
+
+    #[test]
+    fn relations_split_into_clauses() {
+        assert_eq!(
+            relations("libc6 (>= 2.34), foo | bar,\n  baz"),
+            vec![
+                ("libc6".into(), Some(">= 2.34".into())),
+                ("foo | bar".into(), None),
+                ("baz".into(), None),
+            ]
+        );
+    }
+}
diff --git a/crates/formats/apt/src/deb.rs b/crates/formats/apt/src/deb.rs
new file mode 100644
index 00000000..85e9e534
--- /dev/null
+++ b/crates/formats/apt/src/deb.rs
@@ -0,0 +1,312 @@
+//! Reading a binary package (`.deb`, deb(5)): an `ar` archive holding
+//! `debian-binary`, then `control.tar[.gz|.xz|.zst]`, then the data. Only
+//! the `control` file of the control member is read; the data is never
+//! touched, and every member is read within bounds, so a package that
+//! inflates without end fails fast.
+
+use std::io::{self, Read, Seek, SeekFrom};
+
+use crate::control::MAX_CONTROL_BYTES;
+
+/// The largest control member read (compressed).
+pub const MAX_CONTROL_MEMBER_BYTES: u64 = 64 * 1024 * 1024;
+
+/// The most the control member may inflate to.
+pub const MAX_CONTROL_TAR_BYTES: u64 = 256 * 1024 * 1024;
+
+/// The most members looked at before the control member.
+const MAX_MEMBERS: usize = 16;
+
+const AR_MAGIC: &[u8; 8] = b"!<arch>\n";
+const AR_HEADER: usize = 60;
+
+/// Why a package was refused.
+#[derive(Debug)]
+pub enum DebError {
+    /// Not a binary package, or a damaged one: the text says why.
+    Invalid(String),
+    /// Reading the staged package failed.
+    Io(io::Error),
+}
+
+impl std::fmt::Display for DebError {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match self {
+            DebError::Invalid(m) => f.write_str(m),
+            DebError::Io(e) => write!(f, "reading the package failed: {e}"),
+        }
+    }
+}
+
+impl From<io::Error> for DebError {
+    fn from(e: io::Error) -> Self {
+        DebError::Io(e)
+    }
+}
+
+fn invalid<T>(message: impl Into<String>) -> Result<T, DebError> {
+    Err(DebError::Invalid(message.into()))
+}
+
+/// One member of the archive: its name and where its data is.
+struct Member {
+    name: String,
+    offset: u64,
+    size: u64,
+}
+
+/// Read the next member header at the reader's position (even-aligned), or
+/// `None` at the end of the archive.
+fn next_member<R: Read + Seek + ?Sized>(reader: &mut R) -> Result<Option<Member>, DebError> {
+    let mut header = [0u8; AR_HEADER];
+    let mut filled = 0;
+    while filled < AR_HEADER {
+        match reader.read(&mut header[filled..])? {
+            0 if filled == 0 => return Ok(None),
+            0 => return invalid("not a Debian package: the archive ends inside a member header"),
+            n => filled += n,
+        }
+    }
+    if &header[58..60] != b"`\n" {
+        return invalid("not a Debian package: a damaged ar member header");
+    }
+    let field = |range: std::ops::Range<usize>| {
+        std::str::from_utf8(&header[range])
+            .map(str::trim_end)
+            .unwrap_or("")
+            .to_string()
+    };
+    let name = field(0..16);
+    // GNU ar ends names with `/`.
+    let name = name.strip_suffix('/').unwrap_or(&name).to_string();
+    let Ok(size) = field(48..58).parse::<u64>() else {
+        return invalid("not a Debian package: an ar member without a size");
+    };
+    let offset = reader.stream_position()?;
+    Ok(Some(Member { name, offset, size }))
+}
+
+/// The bytes of the `control` file of the package `reader` holds.
+pub fn control_file<R: Read + Seek + ?Sized>(reader: &mut R) -> Result<Vec<u8>, DebError> {
+    reader.seek(SeekFrom::Start(0))?;
+    let mut magic = [0u8; 8];
+    if reader.read_exact(&mut magic).is_err() || &magic != AR_MAGIC {
+        return invalid("not a Debian package (.deb): no ar archive");
+    }
+    let mut seen_binary = false;
+    for _ in 0..MAX_MEMBERS {
+        let Some(member) = next_member(reader)? else {
+            break;
+        };
+        let next = member.offset + member.size + (member.size & 1);
+        match member.name.as_str() {
+            "debian-binary" => {
+                if member.size > 64 {
+                    return invalid("not a Debian package: debian-binary is too long");
+                }
+                let mut version = Vec::new();
+                Read::take(&mut *reader, member.size).read_to_end(&mut version)?;
+                if !version.starts_with(b"2.") {
+                    return invalid(format!(
+                        "unsupported package format {:?} (debian-binary)",
+                        String::from_utf8_lossy(&version).trim()
+                    ));
+                }
+                seen_binary = true;
+            }
+            // Reserved for internal use: skipped, as dpkg does.
+            name if name.starts_with('_') => {}
+            name if name == "control.tar" || name.starts_with("control.tar.") => {
+                if !seen_binary {
+                    return invalid("not a Debian package: debian-binary is not the first member");
+                }
+                if member.size > MAX_CONTROL_MEMBER_BYTES {
+                    return invalid("the package's control member is too large");
+                }
+                let compressed = Read::take(&mut *reader, member.size);
+                let tar: Box<dyn Read + '_> = match &name["control.tar".len()..] {
+                    "" => Box::new(compressed),
+                    ".gz" => Box::new(flate2::read::GzDecoder::new(compressed)),
+                    ".xz" => Box::new(lzma_rust2::XzReader::new(compressed, true)),
+                    ".zst" => {
+                        Box::new(ruzstd::decoding::StreamingDecoder::new(compressed).map_err(
+                            |e| DebError::Invalid(format!("the control member is not zstd: {e}")),
+                        )?)
+                    }
+                    other => {
+                        return invalid(format!(
+                            "the control member is compressed with an unsupported method ({other})"
+                        ))
+                    }
+                };
+                return control_in_tar(tar.take(MAX_CONTROL_TAR_BYTES));
+            }
+            other => {
+                return invalid(format!(
+                    "not a Debian package: member {other:?} comes before the control member"
+                ))
+            }
+        }
+        reader.seek(SeekFrom::Start(next))?;
+    }
+    invalid("not a Debian package: no control member")
+}
+
+/// The `control` file inside a control tarball.
+fn control_in_tar(tar: impl Read) -> Result<Vec<u8>, DebError> {
+    let mut archive = tar::Archive::new(tar);
+    let entries = archive
+        .entries()
+        .map_err(|e| DebError::Invalid(format!("the control member is not a tar archive: {e}")))?;
+    for entry in entries {
+        let mut entry = entry.map_err(|e| {
+            DebError::Invalid(format!("the control member is not a tar archive: {e}"))
+        })?;
+        let path = entry.path_bytes().into_owned();
+        let path = path.strip_prefix(b"./").unwrap_or(&path);
+        if path != b"control" {
+            continue;
+        }
+        if !entry.header().entry_type().is_file() {
+            return invalid("the package's control is not a file");
+        }
+        if entry.size() > MAX_CONTROL_BYTES as u64 {
+            return invalid("the package's control file is too large");
+        }
+        let mut control = Vec::new();
+        entry
+            .by_ref()
+            .take(MAX_CONTROL_BYTES as u64)
+            .read_to_end(&mut control)
+            .map_err(|e| DebError::Invalid(format!("the control file could not be read: {e}")))?;
+        return Ok(control);
+    }
+    invalid("the package has no control file")
+}
+
+#[cfg(test)]
+pub(crate) mod tests {
+    use super::*;
+    use std::io::{Cursor, Write};
+
+    /// A `.deb` of `control`, its control member compressed by `method`
+    /// (`""`, `gz`, `xz`), with a small data member.
+    pub(crate) fn deb(control: &str, method: &str) -> Vec<u8> {
+        let mut tar = tar::Builder::new(Vec::new());
+        let mut header = tar::Header::new_gnu();
+        header.set_size(control.len() as u64);
+        header.set_mode(0o644);
+        header.set_cksum();
+        tar.append_data(&mut header, "./control", control.as_bytes())
+            .unwrap();
+        let tar = tar.into_inner().unwrap();
+        let (name, member) = match method {
+            "" => ("control.tar".to_string(), tar),
+            "gz" => {
+                let mut gz =
+                    flate2::write::GzEncoder::new(Vec::new(), flate2::Compression::default());
+                gz.write_all(&tar).unwrap();
+                ("control.tar.gz".to_string(), gz.finish().unwrap())
+            }
+            "xz" => {
+                let mut xz =
+                    lzma_rust2::XzWriter::new(Vec::new(), lzma_rust2::XzOptions::with_preset(6))
+                        .unwrap();
+                xz.write_all(&tar).unwrap();
+                ("control.tar.xz".to_string(), xz.finish().unwrap())
+            }
+            other => panic!("{other}"),
+        };
+        ar(&[
+            ("debian-binary", b"2.0\n".to_vec()),
+            (&name, member),
+            ("data.tar", vec![0u8; 1024]),
+        ])
+    }
+
+    pub(crate) fn ar(members: &[(&str, Vec<u8>)]) -> Vec<u8> {
+        let mut out = AR_MAGIC.to_vec();
+        for (name, data) in members {
+            out.extend_from_slice(
+                format!(
+                    "{:<16}{:<12}{:<6}{:<6}{:<8}{:<10}`\n",
+                    name,
+                    0,
+                    0,
+                    0,
+                    100644,
+                    data.len()
+                )
+                .as_bytes(),
+            );
+            out.extend_from_slice(data);
+            if data.len() % 2 == 1 {
+                out.push(b'\n');
+            }
+        }
+        out
+    }
+
+    const CONTROL: &str = "Package: hello\nVersion: 1.0-1\nArchitecture: amd64\nDescription: hi\n";
+
+    #[test]
+    fn reads_the_control_file_of_every_compression() {
+        for method in ["", "gz", "xz"] {
+            let deb = deb(CONTROL, method);
+            assert_eq!(
+                control_file(&mut Cursor::new(deb)).unwrap(),
+                CONTROL.as_bytes(),
+                "{method}"
+            );
+        }
+    }
+
+    #[test]
+    fn refuses_what_is_not_a_package() {
+        for bad in [
+            b"not an archive".to_vec(),
+            ar(&[("debian-binary", b"2.0\n".to_vec())]),
+            ar(&[
+                ("debian-binary", b"3.0\n".to_vec()),
+                ("control.tar", vec![]),
+            ]),
+            ar(&[("data.tar", vec![0; 10]), ("control.tar", vec![])]),
+            ar(&[("control.tar", vec![])]),
+            ar(&[
+                ("debian-binary", b"2.0\n".to_vec()),
+                ("control.tar.bz2", vec![1]),
+            ]),
+            ar(&[
+                ("debian-binary", b"2.0\n".to_vec()),
+                ("control.tar.gz", vec![1, 2, 3]),
+            ]),
+            // A truncated header.
+            b"!<arch>\ndebian-binary   ".to_vec(),
+        ] {
+            assert!(
+                matches!(
+                    control_file(&mut Cursor::new(&bad)),
+                    Err(DebError::Invalid(_))
+                ),
+                "{:?}",
+                String::from_utf8_lossy(&bad)
+            );
+        }
+    }
+
+    #[test]
+    fn a_control_tar_without_control_is_refused() {
+        let mut tar = tar::Builder::new(Vec::new());
+        let mut header = tar::Header::new_gnu();
+        header.set_size(3);
+        header.set_cksum();
+        tar.append_data(&mut header, "./md5sums", &b"abc"[..])
+            .unwrap();
+        let deb = ar(&[
+            ("debian-binary", b"2.0\n".to_vec()),
+            ("control.tar", tar.into_inner().unwrap()),
+        ]);
+        let err = control_file(&mut Cursor::new(deb)).unwrap_err();
+        assert!(err.to_string().contains("no control file"), "{err}");
+    }
+}
diff --git a/crates/formats/apt/src/index.rs b/crates/formats/apt/src/index.rs
new file mode 100644
index 00000000..7a1f0632
--- /dev/null
+++ b/crates/formats/apt/src/index.rs
@@ -0,0 +1,468 @@
+//! A hosted repository's indexes: what `apt-get update` reads.
+//!
+//! For each component and architecture, `Packages` lists every version
+//! with its control data, where it is in the pool, its size and SHA-256
+//! (also as `Packages.gz` and `Packages.xz`). Architecture `all` packages
+//! are listed under every architecture of their component, and under
+//! `binary-all`. `Release` names every index file with its size and
+//! SHA-256, and says `Acquire-By-Hash: yes`: every index file is also
+//! published under `by-hash/SHA256/<sha256>`, so a client that read one
+//! `Release` finds the `Packages` it names even once a newer index
+//! replaced it. The host signs `Release` as `InRelease` (cleartext) and
+//! `Release.gpg` (detached), and publishes the keys as `key.asc` and
+//! `key.gpg`.
+//!
+//! Everything but `Release`'s `Date` is a function of the packages: the
+//! same packages give the same `Packages`, byte for byte.
+
+use std::collections::{BTreeMap, BTreeSet};
+use std::io::Write;
+
+use forge_plugin_api::{
+    FormatError, IndexFile, IndexInput, IndexedPackage, SignatureKind, SignedCopy,
+};
+use sha2::{Digest, Sha256};
+
+use crate::control::Paragraph;
+use crate::layout::{self, KEY_ASC, KEY_GPG};
+use crate::manifest::Summary;
+
+/// Fields of a package's control data that an index sets itself.
+const INDEX_FIELDS: &[&str] = &[
+    "Filename", "Size", "MD5sum", "SHA1", "SHA256", "SHA512", "Status",
+];
+
+/// What a repository's `Release` says about it.
+#[derive(Debug, Clone)]
+pub struct ReleaseInfo<'a> {
+    pub distribution: &'a str,
+    /// The repository's name (`Label`).
+    pub label: &'a str,
+}
+
+/// One package's entry, ready to be listed.
+struct Entry {
+    component: String,
+    architecture: String,
+    stanza: String,
+}
+
+fn entry(package: &IndexedPackage) -> Result<Entry, FormatError> {
+    let summary = package
+        .summary
+        .as_deref()
+        .and_then(Summary::parse)
+        .ok_or_else(|| {
+            FormatError::Internal(format!(
+                "{} {} has no control data stored",
+                package.id, package.version
+            ))
+        })?;
+    let mut paragraph = Paragraph::parse_one(&summary.control)
+        .map_err(|e| FormatError::Internal(format!("{} {}: {e}", package.id, package.version)))?;
+    for field in INDEX_FIELDS {
+        paragraph.remove(field);
+    }
+    let filename = layout::pool_path(
+        &summary.component,
+        &summary.package,
+        &package.version,
+        &summary.architecture,
+    );
+    paragraph.set("Filename", &filename);
+    paragraph.set("Size", &package.size.to_string());
+    paragraph.set("SHA256", &package.sha256);
+    Ok(Entry {
+        component: summary.component,
+        architecture: summary.architecture,
+        stanza: paragraph.to_text(),
+    })
+}
+
+/// The index files of `input` (see the module's documentation).
+pub fn render(info: &ReleaseInfo<'_>, input: &IndexInput) -> Result<Vec<IndexFile>, FormatError> {
+    let entries = input
+        .packages
+        .iter()
+        .map(entry)
+        .collect::<Result<Vec<_>, _>>()?;
+
+    // Components and architectures: those of the packages; `main` and
+    // `all` when there are none.
+    let mut components: BTreeSet<String> = entries.iter().map(|e| e.component.clone()).collect();
+    if components.is_empty() {
+        components.insert("main".into());
+    }
+    let concrete: BTreeSet<String> = entries
+        .iter()
+        .filter(|e| e.architecture != "all")
+        .map(|e| e.architecture.clone())
+        .collect();
+    let mut architectures = concrete.clone();
+    let has_all = entries.iter().any(|e| e.architecture == "all");
+    if has_all || architectures.is_empty() {
+        architectures.insert("all".into());
+    }
+
+    // Packages of each component and architecture, in input order (by id,
+    // then version).
+    let mut lists: BTreeMap<(String, String), String> = BTreeMap::new();
+    for component in &components {
+        for arch in &architectures {
+            lists.insert((component.clone(), arch.clone()), String::new());
+        }
+    }
+    for e in &entries {
+        let targets: Vec<&String> = if e.architecture == "all" {
+            architectures.iter().collect()
+        } else {
+            vec![&e.architecture]
+        };
+        for arch in targets {
+            let list = lists
+                .get_mut(&(e.component.clone(), arch.clone()))
+                .expect("every component and architecture has a list");
+            if !list.is_empty() {
+                list.push('\n');
+            }
+            list.push_str(&e.stanza);
+        }
+    }
+
+    let base = format!("dists/{}", info.distribution);
+    let mut files = Vec::new();
+    // (path below dists/<distribution>/, size, sha256), for Release.
+    let mut listed: Vec<(String, usize, String)> = Vec::new();
+    for ((component, arch), packages) in &lists {
+        let dir = format!("{component}/binary-{arch}");
+        let plain = packages.as_bytes().to_vec();
+        let gz = gzip(&plain)?;
+        let xz = xz(&plain)?;
+        for (name, content, content_type) in [
+            ("Packages", plain, "text/plain; charset=utf-8"),
+            ("Packages.gz", gz, "application/gzip"),
+            ("Packages.xz", xz, "application/x-xz"),
+        ] {
+            let sha256 = hex::encode(Sha256::digest(&content));
+            listed.push((format!("{dir}/{name}"), content.len(), sha256.clone()));
+            files.push(IndexFile {
+                path: format!("{base}/{dir}/by-hash/SHA256/{sha256}"),
+                content: content.clone(),
+                content_type: content_type.into(),
+                immutable: true,
+                signed: Vec::new(),
+            });
+            files.push(IndexFile {
+                path: format!("{base}/{dir}/{name}"),
+                content,
+                content_type: content_type.into(),
+                immutable: false,
+                signed: Vec::new(),
+            });
+        }
+    }
+
+    let release = release(
+        info,
+        input,
+        &components,
+        &architectures,
+        &concrete,
+        has_all,
+        &listed,
+    )?;
+    files.push(IndexFile {
+        path: format!("{base}/Release"),
+        content: release.into_bytes(),
+        content_type: "text/plain; charset=utf-8".into(),
+        immutable: false,
+        signed: vec![
+            SignedCopy {
+                path: format!("{base}/InRelease"),
+                signature: SignatureKind::Cleartext,
+            },
+            SignedCopy {
+                path: format!("{base}/Release.gpg"),
+                signature: SignatureKind::Detached,
+            },
+        ],
+    });
+    files.push(IndexFile {
+        path: KEY_ASC.into(),
+        content: input.keyring_armored.clone().into_bytes(),
+        content_type: "application/pgp-keys".into(),
+        immutable: false,
+        signed: Vec::new(),
+    });
+    files.push(IndexFile {
+        path: KEY_GPG.into(),
+        content: input.keyring.clone(),
+        content_type: "application/pgp-keys".into(),
+        immutable: false,
+        signed: Vec::new(),
+    });
+    Ok(files)
+}
+
+/// The `Release` file.
+fn release(
+    info: &ReleaseInfo<'_>,
+    input: &IndexInput,
+    components: &BTreeSet<String>,
+    architectures: &BTreeSet<String>,
+    concrete: &BTreeSet<String>,
+    has_all: bool,
+    listed: &[(String, usize, String)],
+) -> Result<String, FormatError> {
+    let date = chrono::DateTime::parse_from_rfc3339(&input.generated)
+        .map_err(|e| FormatError::Internal(format!("generated {:?}: {e}", input.generated)))?
+        .with_timezone(&chrono::Utc);
+    let join = |set: &BTreeSet<String>| set.iter().cloned().collect::<Vec<_>>().join(" ");
+    let mut out = String::new();
+    let label = one_line(info.label);
+    out.push_str("Origin: Forge\n");
+    out.push_str(&format!("Label: {label}\n"));
+    out.push_str(&format!("Suite: {}\n", info.distribution));
+    out.push_str(&format!("Codename: {}\n", info.distribution));
+    out.push_str(&format!(
+        "Date: {}\n",
+        date.format("%a, %d %b %Y %H:%M:%S UTC")
+    ));
+    out.push_str(&format!("Architectures: {}\n", join(architectures)));
+    out.push_str(&format!("Components: {}\n", join(components)));
+    out.push_str(&format!("Description: {label}\n"));
+    if has_all && !concrete.is_empty() {
+        // `all` packages are in every architecture's Packages too.
+        out.push_str("No-Support-for-Architecture-all: Packages\n");
+    }
+    out.push_str("Acquire-By-Hash: yes\n");
+    out.push_str("SHA256:\n");
+    let width = listed
+        .iter()
+        .map(|(_, size, _)| size.to_string().len())
+        .max()
+        .unwrap_or(1);
+    for (path, size, sha256) in listed {
+        out.push_str(&format!(" {sha256} {size:>width$} {path}\n"));
+    }
+    Ok(out)
+}
+
+fn one_line(text: &str) -> String {
+    text.chars()
+        .map(|c| if c.is_control() { ' ' } else { c })
+        .collect()
+}
+
+fn gzip(data: &[u8]) -> Result<Vec<u8>, FormatError> {
+    let mut gz = flate2::GzBuilder::new()
+        .mtime(0)
+        .write(Vec::new(), flate2::Compression::best());
+    gz.write_all(data)
+        .and_then(|()| gz.finish())
+        .map_err(|e| FormatError::Internal(format!("gzip: {e}")))
+}
+
+fn xz(data: &[u8]) -> Result<Vec<u8>, FormatError> {
+    let fail = |e: std::io::Error| FormatError::Internal(format!("xz: {e}"));
+    let mut xz = lzma_rust2::XzWriter::new(Vec::new(), lzma_rust2::XzOptions::with_preset(6))
+        .map_err(fail)?;
+    xz.write_all(data).map_err(fail)?;
+    xz.finish().map_err(fail)
+}
+
+#[cfg(test)]
+mod tests {
+    use std::io::Read;
+
+    use super::*;
+    use crate::manifest;
+
+    fn package(control: &str, size: u64) -> IndexedPackage {
+        let summary = manifest::summarize(control.as_bytes()).unwrap();
+        let paragraph = Paragraph::parse_one(control).unwrap();
+        let name = paragraph.get("Package").unwrap();
+        let arch = paragraph.get("Architecture").unwrap();
+        IndexedPackage {
+            id: format!("{name}:{arch}"),
+            version: paragraph.get("Version").unwrap().to_string(),
+            version_original: paragraph.get("Version").unwrap().to_string(),
+            summary: Some(summary),
+            size,
+            sha256: "ab".repeat(32),
+            sha512: None,
+            published: None,
+        }
+    }
+
+    fn input(packages: Vec<IndexedPackage>) -> IndexInput {
+        IndexInput {
+            packages,
+            generated: "2026-10-31T12:00:00Z".into(),
+            keyring: vec![1, 2, 3],
+            keyring_armored: "-----BEGIN PGP PUBLIC KEY BLOCK-----\n".into(),
+        }
+    }
+
+    fn file<'a>(files: &'a [IndexFile], path: &str) -> &'a IndexFile {
+        files
+            .iter()
+            .find(|f| f.path == path)
+            .unwrap_or_else(|| panic!("no {path}"))
+    }
+
+    const INFO: ReleaseInfo<'static> = ReleaseInfo {
+        distribution: "bookworm",
+        label: "apt-internal",
+    };
+
+    #[test]
+    fn packages_list_every_version_under_its_component_and_architecture() {
+        let files = render(
+            &INFO,
+            &input(vec![
+                package(
+                    "Package: hello\nVersion: 1.0-1\nArchitecture: amd64\nSection: utils\nSize: 1\nDescription: hi\n there\n",
+                    100,
+                ),
+                package(
+                    "Package: hello\nVersion: 1.1-1\nArchitecture: arm64\nDescription: hi\n",
+                    200,
+                ),
+                package(
+                    "Package: tool\nVersion: 2:3.0\nArchitecture: all\nSection: contrib/net\nDescription: t\n",
+                    300,
+                ),
+            ]),
+        )
+        .unwrap();
+        let amd64 = String::from_utf8(
+            file(&files, "dists/bookworm/main/binary-amd64/Packages")
+                .content
+                .clone(),
+        )
+        .unwrap();
+        assert_eq!(
+            amd64,
+            format!(
+                "Package: hello\nVersion: 1.0-1\nArchitecture: amd64\nSection: utils\nDescription: hi\n there\n\
+                 Filename: pool/main/h/hello/hello_1.0-1_amd64.deb\nSize: 100\nSHA256: {}\n",
+                "ab".repeat(32)
+            )
+        );
+        let contrib = String::from_utf8(
+            file(&files, "dists/bookworm/contrib/binary-arm64/Packages")
+                .content
+                .clone(),
+        )
+        .unwrap();
+        assert!(contrib.contains("Filename: pool/contrib/t/tool/tool_2:3.0_all.deb\n"));
+        assert!(!file(&files, "dists/bookworm/contrib/binary-all/Packages")
+            .content
+            .is_empty());
+        let release =
+            String::from_utf8(file(&files, "dists/bookworm/Release").content.clone()).unwrap();
+        assert!(
+            release.contains("Suite: bookworm\nCodename: bookworm\n"),
+            "{release}"
+        );
+        assert!(
+            release.contains("Date: Sat, 31 Oct 2026 12:00:00 UTC\n"),
+            "{release}"
+        );
+        assert!(
+            release.contains("Architectures: all amd64 arm64\n"),
+            "{release}"
+        );
+        assert!(release.contains("Components: contrib main\n"), "{release}");
+        assert!(release.contains("Acquire-By-Hash: yes\n"), "{release}");
+        assert!(release.contains("No-Support-for-Architecture-all: Packages\n"));
+        // Every listed file is there under its name and by its hash, with
+        // the hash and size Release gives it.
+        let entries: Vec<&str> = release.split("SHA256:\n").nth(1).unwrap().lines().collect();
+        assert_eq!(entries.len(), 2 * 3 * 3);
+        for line in entries {
+            let parts: Vec<&str> = line.split_whitespace().collect();
+            let (sha, size, path) = (parts[0], parts[1], parts[2]);
+            let named = file(&files, &format!("dists/bookworm/{path}"));
+            assert_eq!(named.content.len().to_string(), size);
+            assert_eq!(hex::encode(Sha256::digest(&named.content)), sha);
+            let dir = path.rsplit_once('/').unwrap().0;
+            let by_hash = file(
+                &files,
+                &format!("dists/bookworm/{dir}/by-hash/SHA256/{sha}"),
+            );
+            assert!(by_hash.immutable);
+            assert_eq!(by_hash.content, named.content);
+        }
+        let signed = &file(&files, "dists/bookworm/Release").signed;
+        assert_eq!(signed.len(), 2);
+        assert_eq!(file(&files, "key.gpg").content, vec![1, 2, 3]);
+    }
+
+    #[test]
+    fn compressed_copies_hold_the_same_list() {
+        let files = render(
+            &INFO,
+            &input(vec![package(
+                "Package: hello\nVersion: 1.0\nArchitecture: amd64\nDescription: hi\n",
+                1,
+            )]),
+        )
+        .unwrap();
+        let plain = &file(&files, "dists/bookworm/main/binary-amd64/Packages").content;
+        let mut gz = Vec::new();
+        flate2::read::GzDecoder::new(
+            &file(&files, "dists/bookworm/main/binary-amd64/Packages.gz").content[..],
+        )
+        .read_to_end(&mut gz)
+        .unwrap();
+        assert_eq!(&gz, plain);
+        let mut xz = Vec::new();
+        lzma_rust2::XzReader::new(
+            &file(&files, "dists/bookworm/main/binary-amd64/Packages.xz").content[..],
+            true,
+        )
+        .read_to_end(&mut xz)
+        .unwrap();
+        assert_eq!(&xz, plain);
+    }
+
+    #[test]
+    fn an_empty_repository_has_an_empty_index() {
+        let files = render(&INFO, &input(Vec::new())).unwrap();
+        assert!(file(&files, "dists/bookworm/main/binary-all/Packages")
+            .content
+            .is_empty());
+        let release =
+            String::from_utf8(file(&files, "dists/bookworm/Release").content.clone()).unwrap();
+        assert!(
+            release.contains("Architectures: all\nComponents: main\n"),
+            "{release}"
+        );
+    }
+
+    #[test]
+    fn the_same_packages_give_the_same_files() {
+        let one = render(
+            &INFO,
+            &input(vec![package(
+                "Package: a1\nVersion: 1\nArchitecture: amd64\n",
+                1,
+            )]),
+        )
+        .unwrap();
+        let mut later = input(vec![package(
+            "Package: a1\nVersion: 1\nArchitecture: amd64\n",
+            1,
+        )]);
+        later.generated = "2027-01-01T00:00:00Z".into();
+        let two = render(&INFO, &later).unwrap();
+        for (a, b) in one.iter().zip(&two) {
+            assert_eq!(a.path, b.path);
+            if !a.path.ends_with("/Release") {
+                assert_eq!(a.content, b.content, "{}", a.path);
+            }
+        }
+    }
+}
diff --git a/crates/formats/apt/src/layout.rs b/crates/formats/apt/src/layout.rs
new file mode 100644
index 00000000..6b864b00
--- /dev/null
+++ b/crates/formats/apt/src/layout.rs
@@ -0,0 +1,334 @@
+//! Where things are in a repository, as apt asks for them:
+//!
+//! * `dists/<distribution>/InRelease`, `Release`, `Release.gpg`;
+//! * `dists/<distribution>/<component>/binary-<arch>/Packages` (`.gz`,
+//!   `.xz`), and their `by-hash/SHA256/<sha256>` copies;
+//! * `pool/<component>/<prefix>/<name>/<name>_<version>_<arch>.deb`, the
+//!   prefix being the name's first letter (`lib` and the next letter for a
+//!   `lib` name), the version the normalized one (an epoch keeps its `:`);
+//! * `key.asc` and `key.gpg`, the repository's signing keys (hosted).
+//!
+//! Request paths are parsed with [`forge_plugin_api::files`]: a path that
+//! needs normalizing (`..`, `//`, an encoded `/`, a backslash) is refused,
+//! never resolved.
+
+use forge_plugin_api::files::{self, PathError};
+
+use crate::control::{valid_architecture, valid_component, valid_package_name};
+use crate::version;
+
+/// The armored public keys of a hosted repository.
+pub const KEY_ASC: &str = "key.asc";
+/// The same keys, as a binary keyring (`signed-by=` takes either).
+pub const KEY_GPG: &str = "key.gpg";
+
+/// What a request path names.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum Target {
+    /// The repository's URL itself (`/` or nothing).
+    Root,
+    /// A file directly below the root (an upload's name, `key.asc`).
+    TopFile(String),
+    /// A file under `dists/<distribution>/`: `path` is the whole path,
+    /// `rest` what follows the distribution.
+    Dists {
+        path: String,
+        distribution: String,
+        rest: String,
+    },
+    /// A file under `pool/`.
+    Pool(PoolPath),
+    /// Anything else (a directory, another top-level directory).
+    Other(String),
+}
+
+/// A file under `pool/`: `pool/<component>/<prefix>/<directory>/<file>`.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct PoolPath {
+    pub path: String,
+    pub component: String,
+    pub prefix: String,
+    pub directory: String,
+    pub file: String,
+}
+
+/// A binary package's file name, `<name>_<version>_<arch>.deb`.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct DebName {
+    pub name: String,
+    pub version: String,
+    pub architecture: String,
+}
+
+/// Parse a request path (still percent-encoded, with or without its leading
+/// `/`).
+pub fn parse(encoded: &str) -> Result<Target, PathError> {
+    let encoded = encoded.strip_prefix('/').unwrap_or(encoded);
+    match files::parse_request(encoded)? {
+        files::Target::Directory(dir) if dir.is_empty() => Ok(Target::Root),
+        files::Target::Directory(dir) => Ok(Target::Other(dir)),
+        files::Target::File(path) => Ok(classify(path)),
+    }
+}
+
+fn classify(path: String) -> Target {
+    let segments: Vec<&str> = path.split('/').collect();
+    match segments.as_slice() {
+        [file] => Target::TopFile((*file).to_string()),
+        ["dists", distribution, rest @ ..] if !rest.is_empty() => Target::Dists {
+            distribution: (*distribution).to_string(),
+            rest: rest.join("/"),
+            path: path.clone(),
+        },
+        ["pool", component, prefix, directory, file] => Target::Pool(PoolPath {
+            component: (*component).to_string(),
+            prefix: (*prefix).to_string(),
+            directory: (*directory).to_string(),
+            file: (*file).to_string(),
+            path: path.clone(),
+        }),
+        _ => Target::Other(path),
+    }
+}
+
+/// The pool directory prefix of a package name: `libf` for `libfoo`, `h`
+/// for `hello`.
+pub fn prefix(name: &str) -> &str {
+    if name.len() > 3 && name.starts_with("lib") {
+        &name[..4]
+    } else {
+        &name[..name.len().min(1)]
+    }
+}
+
+/// The path of a hosted package's file.
+pub fn pool_path(component: &str, name: &str, version: &str, architecture: &str) -> String {
+    format!(
+        "pool/{component}/{}/{name}/{name}_{version}_{architecture}.deb",
+        prefix(name)
+    )
+}
+
+/// The package id of a binary package: `<name>:<architecture>`, Debian's
+/// spelling of a package of one architecture (`hello:amd64`).
+pub fn package_id(name: &str, architecture: &str) -> String {
+    format!("{name}:{architecture}")
+}
+
+/// Split a package id into its name and architecture.
+pub fn split_id(id: &str) -> Option<(&str, &str)> {
+    let (name, arch) = id.split_once(':')?;
+    (valid_package_name(name) && valid_architecture(arch)).then_some((name, arch))
+}
+
+/// Parse `<name>_<version>_<arch>.deb` (`.udeb` and `.ddeb` too).
+pub fn deb_name(file: &str) -> Option<DebName> {
+    let stem = file
+        .strip_suffix(".deb")
+        .or_else(|| file.strip_suffix(".udeb"))
+        .or_else(|| file.strip_suffix(".ddeb"))?;
+    let mut parts = stem.split('_');
+    let (name, version, architecture) = (parts.next()?, parts.next()?, parts.next()?);
+    if parts.next().is_some()
+        || !valid_package_name(name)
+        || !valid_architecture(architecture)
+        || version::Version::parse(version).is_err()
+    {
+        return None;
+    }
+    Some(DebName {
+        name: name.to_string(),
+        version: version.to_string(),
+        architecture: architecture.to_string(),
+    })
+}
+
+/// The package a pool path's file belongs to, for package selectors: a
+/// binary package's id (`hello:amd64`), else the source package the
+/// directory is named after (`hello:source`).
+pub fn pool_package(pool: &PoolPath) -> Option<String> {
+    if let Some(deb) = deb_name(&pool.file) {
+        return Some(package_id(&deb.name, &deb.architecture));
+    }
+    valid_package_name(&pool.directory).then(|| format!("{}:source", pool.directory))
+}
+
+/// Whether `distribution` may name a distribution: letters, digits and
+/// `.`, `_`, `-`, `+`, `~`.
+pub fn valid_distribution(distribution: &str) -> bool {
+    !distribution.is_empty()
+        && distribution.len() <= 64
+        && distribution != "."
+        && distribution != ".."
+        && distribution
+            .bytes()
+            .all(|b| b.is_ascii_alphanumeric() || matches!(b, b'.' | b'_' | b'-' | b'+' | b'~'))
+}
+
+/// Whether `rest` (below `dists/<distribution>/`) is a content-addressed
+/// copy, `…/by-hash/<algorithm>/<hex>`: it never changes.
+pub fn is_by_hash(rest: &str) -> bool {
+    let mut segments = rest.rsplit('/');
+    let (Some(hash), Some(algorithm), Some(by_hash)) =
+        (segments.next(), segments.next(), segments.next())
+    else {
+        return false;
+    };
+    by_hash == "by-hash"
+        && matches!(algorithm, "MD5Sum" | "SHA1" | "SHA256" | "SHA512")
+        && !hash.is_empty()
+        && hash.bytes().all(|b| b.is_ascii_hexdigit())
+}
+
+/// The SHA-256 a `by-hash/SHA256/<hex>` path names.
+pub fn by_hash_sha256(rest: &str) -> Option<String> {
+    let hash = rest
+        .strip_prefix("by-hash/SHA256/")
+        .or_else(|| rest.rsplit_once("/by-hash/SHA256/").map(|(_, hash)| hash))?;
+    (hash.len() == 64 && hash.bytes().all(|b| b.is_ascii_hexdigit()))
+        .then(|| hash.to_ascii_lowercase())
+}
+
+/// Whether a pool path is where a hosted package of `component` and `name`
+/// lives (its prefix and directory).
+pub fn pool_matches(pool: &PoolPath, component: &str, name: &str) -> bool {
+    valid_component(&pool.component)
+        && pool.component == component
+        && pool.prefix == prefix(name)
+        && pool.directory == name
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn paths_name_their_parts() {
+        assert_eq!(parse("").unwrap(), Target::Root);
+        assert_eq!(parse("/").unwrap(), Target::Root);
+        assert_eq!(
+            parse("/key.asc").unwrap(),
+            Target::TopFile("key.asc".into())
+        );
+        assert_eq!(
+            parse("/dists/bookworm/InRelease").unwrap(),
+            Target::Dists {
+                path: "dists/bookworm/InRelease".into(),
+                distribution: "bookworm".into(),
+                rest: "InRelease".into(),
+            }
+        );
+        assert_eq!(
+            parse("/pool/main/h/hello/hello_1%3a2.0-1_amd64.deb").unwrap(),
+            Target::Pool(PoolPath {
+                path: "pool/main/h/hello/hello_1:2.0-1_amd64.deb".into(),
+                component: "main".into(),
+                prefix: "h".into(),
+                directory: "hello".into(),
+                file: "hello_1:2.0-1_amd64.deb".into(),
+            })
+        );
+        assert_eq!(parse("/dists/").unwrap(), Target::Other("dists/".into()));
+        assert_eq!(parse("/dists/x").unwrap(), Target::Other("dists/x".into()));
+    }
+
+    #[test]
+    fn traversal_is_refused() {
+        for bad in [
+            "/../etc/passwd",
+            "/dists/../../x",
+            "/pool/main/h/hello/..",
+            "/pool/main/%2e%2e/x/y",
+            "/pool/main/h/hello%2Fx/y.deb",
+            "/dists//InRelease",
+            "/pool\\main",
+            "/dists/a/%00",
+        ] {
+            assert!(parse(bad).is_err(), "{bad}");
+        }
+    }
+
+    #[test]
+    fn pool_paths_follow_debian() {
+        assert_eq!(
+            pool_path("main", "hello", "2.10-3", "amd64"),
+            "pool/main/h/hello/hello_2.10-3_amd64.deb"
+        );
+        assert_eq!(
+            pool_path("contrib", "libfoo1", "1:1.0", "arm64"),
+            "pool/contrib/libf/libfoo1/libfoo1_1:1.0_arm64.deb"
+        );
+        assert_eq!(prefix("lib"), "l");
+        assert_eq!(prefix("libc6"), "libc");
+    }
+
+    #[test]
+    fn deb_names_are_parsed_strictly() {
+        assert_eq!(
+            deb_name("hello_2.10-3_amd64.deb"),
+            Some(DebName {
+                name: "hello".into(),
+                version: "2.10-3".into(),
+                architecture: "amd64".into()
+            })
+        );
+        assert_eq!(deb_name("hello_1:2.0_all.deb").unwrap().version, "1:2.0");
+        for bad in [
+            "hello_2.10-3.deb",
+            "hello_2.10-3_amd64_x.deb",
+            "Hello_1.0_amd64.deb",
+            "hello_x_amd64.deb",
+            "hello_1.0_amd64.rpm",
+            "hello_1.0_any.deb",
+        ] {
+            assert_eq!(deb_name(bad), None, "{bad}");
+        }
+    }
+
+    #[test]
+    fn pool_files_belong_to_packages() {
+        let Target::Pool(pool) = parse("/pool/main/h/hello/hello_1.0_amd64.deb").unwrap() else {
+            panic!()
+        };
+        assert_eq!(pool_package(&pool).as_deref(), Some("hello:amd64"));
+        assert!(pool_matches(&pool, "main", "hello"));
+        assert!(!pool_matches(&pool, "contrib", "hello"));
+        let Target::Pool(pool) = parse("/pool/main/h/hello/hello_1.0.orig.tar.gz").unwrap() else {
+            panic!()
+        };
+        assert_eq!(pool_package(&pool).as_deref(), Some("hello:source"));
+        assert_eq!(split_id("hello:amd64"), Some(("hello", "amd64")));
+        assert_eq!(split_id("hello"), None);
+    }
+
+    #[test]
+    fn by_hash_paths_are_recognized() {
+        let hash = "a".repeat(64);
+        assert!(is_by_hash(&format!(
+            "main/binary-amd64/by-hash/SHA256/{hash}"
+        )));
+        assert_eq!(
+            by_hash_sha256(&format!("main/binary-amd64/by-hash/SHA256/{hash}")),
+            Some(hash.clone())
+        );
+        assert!(!is_by_hash("main/binary-amd64/Packages"));
+        assert!(!is_by_hash("by-hash/SHA256/xyz"));
+        assert_eq!(by_hash_sha256("main/by-hash/SHA256/abc"), None);
+    }
+
+    #[test]
+    fn distributions_are_names() {
+        for good in [
+            "bookworm",
+            "bookworm-security",
+            "stable",
+            "jammy-updates",
+            "v1.2",
+        ] {
+            assert!(valid_distribution(good), "{good}");
+        }
+        for bad in ["", "..", "a/b", "a b", "x%y"] {
+            assert!(!valid_distribution(bad), "{bad}");
+        }
+    }
+}
diff --git a/crates/formats/apt/src/lib.rs b/crates/formats/apt/src/lib.rs
new file mode 100644
index 00000000..668afdba
--- /dev/null
+++ b/crates/formats/apt/src/lib.rs
@@ -0,0 +1,347 @@
+//! apt (Debian/Ubuntu) repositories for Forge, as a built-in format plugin:
+//! what `apt-get` reads under `/repository/<repository>/`, and the uploads
+//! of `.deb` packages, like Nexus' apt-hosted and apt-proxy repositories.
+//!
+//! [`Apt`] implements [`FormatPlugin`]:
+//!
+//! * **Identity.** A package is one architecture of a binary package: its
+//!   id is `<name>:<architecture>` (`hello:amd64`), its version the Debian
+//!   version, ordered by dpkg's rules ([`version`]).
+//! * **Uploads** (hosted): `POST /` with the package as the body (Nexus'
+//!   `curl --data-binary @pkg.deb`) or as a form's file, or `PUT
+//!   /<file>.deb`. The package's `control` file ([`deb`], [`manifest`])
+//!   says what it is; its `Section` names the component (`contrib/net` is
+//!   in `contrib`, anything else in `main`).
+//! * **Indexes** (hosted): the host keeps them, made by [`index`] from the
+//!   repository's packages, signed with the repository's keys, and replaced
+//!   all at once when the packages change. One distribution per repository,
+//!   its `distribution` option.
+//! * **Downloads** from `pool/` ([`layout`]), and `DELETE` of a pool file.
+//! * **Proxies** ([`proxy`]) serve their upstream's files as they are.
+
+pub mod control;
+pub mod deb;
+pub mod index;
+pub mod layout;
+pub mod manifest;
+pub mod proxy;
+pub mod version;
+
+use std::cmp::Ordering;
+
+use forge_plugin_api::{
+    Action, Answer, Assets, ChangeRequest, Descriptor, FetchResult, FormatError, FormatOption,
+    FormatPlugin, IndexFile, IndexInput, Loaded, PackageRef, PackageSource, ParsedPackage,
+    Prereleases, PublishRequest, Query, Remote, Repository, RepositoryKind, Request, Response,
+    Storage, Upload, UpstreamAnswer, UpstreamOp, UpstreamStep, UpstreamToken, VersionClass,
+};
+
+use crate::layout::{PoolPath, Target, KEY_ASC, KEY_GPG};
+use crate::manifest::{Control, Summary};
+
+/// The option naming a repository's distribution.
+pub const DISTRIBUTION: &str = "distribution";
+
+/// What apt says about itself: its format id, name and version.
+pub const DESCRIPTOR: Descriptor = Descriptor {
+    id: "apt",
+    name: "apt (Debian/Ubuntu)",
+    version: env!("CARGO_PKG_VERSION"),
+    description: "apt repositories for Debian and Ubuntu: upload .deb packages, signed indexes, \
+                  installs and upgrades with apt-get; proxies of Debian and Ubuntu mirrors.",
+    kinds: &[RepositoryKind::Hosted, RepositoryKind::Proxy],
+    storage: Storage::Packages,
+    assets: Assets {
+        package: "package.deb",
+        package_type: "application/vnd.debian.binary-package",
+        manifest: "control",
+        manifest_type: "text/plain; charset=utf-8",
+    },
+    upstream_token: UpstreamToken::None,
+    options: &[FormatOption {
+        name: DISTRIBUTION,
+        label: "Distribution",
+        description: "The distribution clients name in sources.list (bookworm, jammy): a hosted \
+                      repository publishes its packages as this distribution, a proxy serves \
+                      this one of its upstream's.",
+        kinds: &[RepositoryKind::Hosted, RepositoryKind::Proxy],
+        required: true,
+        example: "bookworm",
+    }],
+    // A `-` starts the Debian revision (`1.0-1`), it marks no prerelease.
+    prereleases: Prereleases::None,
+    indexes: true,
+};
+
+/// The apt format.
+#[derive(Debug, Clone, Copy, Default)]
+pub struct Apt;
+
+impl FormatPlugin for Apt {
+    fn descriptor(&self) -> &'static Descriptor {
+        &DESCRIPTOR
+    }
+
+    fn canonical_id(&self, id: &str) -> String {
+        id.to_ascii_lowercase()
+    }
+
+    fn validate_id(&self, id: &str) -> Result<(), FormatError> {
+        match layout::split_id(id) {
+            Some(_) => Ok(()),
+            None => Err(FormatError::InvalidId(format!(
+                "{id:?} is not <package>:<architecture>"
+            ))),
+        }
+    }
+
+    fn normalize_version(&self, version: &str) -> Result<String, FormatError> {
+        version::normalize(version).map_err(|e| FormatError::InvalidVersion(e.to_string()))
+    }
+
+    fn compare_versions(&self, a: &str, b: &str) -> Ordering {
+        version::compare(a, b)
+    }
+
+    // Every version is a release: a `-` starts the Debian revision. (A
+    // package id is `<name>:<architecture>`, so retention's keep-N counts
+    // per architecture without a partition of its own.)
+    fn version_class(&self, _version: &str) -> VersionClass {
+        VersionClass::Release
+    }
+
+    fn parse_package(&self, package: &mut dyn PackageSource) -> Result<ParsedPackage, FormatError> {
+        let bytes = deb::control_file(package).map_err(|e| match e {
+            deb::DebError::Invalid(m) => FormatError::InvalidPackage(m),
+            deb::DebError::Io(e) => FormatError::Internal(format!("read the package: {e}")),
+        })?;
+        let control = Control::parse(&bytes)?;
+        let id = layout::package_id(&control.name, &control.architecture);
+        Ok(ParsedPackage {
+            original_id: id.clone(),
+            id,
+            version: self.normalize_version(&control.version)?,
+            version_original: control.version.clone(),
+            listed: true,
+            dependencies: control.dependencies(),
+            manifest: bytes,
+        })
+    }
+
+    fn manifest_summary(&self, manifest: &[u8]) -> Option<String> {
+        manifest::summarize(manifest)
+    }
+
+    fn check_option(
+        &self,
+        _kind: RepositoryKind,
+        name: &str,
+        value: &str,
+    ) -> Result<String, FormatError> {
+        let value = value.trim();
+        match name {
+            DISTRIBUTION if layout::valid_distribution(value) => Ok(value.to_string()),
+            DISTRIBUTION => Err(FormatError::InvalidId(format!(
+                "{value:?} is not a distribution name (letters, digits, '.', '_', '-', '+', '~')"
+            ))),
+            other => Err(FormatError::InvalidId(format!(
+                "apt has no option {other:?}"
+            ))),
+        }
+    }
+
+    fn index(&self, repo: &Repository, input: &IndexInput) -> Result<Vec<IndexFile>, FormatError> {
+        let distribution = repo
+            .option(DISTRIBUTION)
+            .ok_or_else(|| FormatError::Internal("the repository has no distribution".into()))?;
+        index::render(
+            &index::ReleaseInfo {
+                distribution,
+                label: &repo.name,
+            },
+            input,
+        )
+    }
+
+    fn file_package(&self, path: &str) -> Option<String> {
+        match layout::parse(path) {
+            Ok(Target::Pool(pool)) => layout::pool_package(&pool),
+            _ => None,
+        }
+    }
+
+    fn handle(&self, repo: &Repository, req: &Request) -> Action {
+        let target = match layout::parse(&req.path) {
+            Ok(target) => target,
+            Err(e) => return text(400, &e.to_string()),
+        };
+        let hosted = repo.kind == RepositoryKind::Hosted;
+        match (req.method.as_str(), target) {
+            ("GET" | "HEAD", Target::Root) => Action::Respond(about(repo)),
+            ("GET" | "HEAD", Target::TopFile(file))
+                if hosted && (file == KEY_ASC || file == KEY_GPG) =>
+            {
+                Action::Load(vec![Query::Index(file)])
+            }
+            (
+                "GET" | "HEAD",
+                Target::Dists {
+                    path,
+                    distribution,
+                    rest,
+                },
+            ) => {
+                if Some(distribution.as_str()) != repo.option(DISTRIBUTION) {
+                    return not_found(&format!(
+                        "this repository serves distribution {}, not {distribution}",
+                        repo.option(DISTRIBUTION).unwrap_or("(none)")
+                    ));
+                }
+                Action::Load(vec![match repo.kind {
+                    RepositoryKind::Hosted if layout::is_by_hash(&rest) => Query::File(path),
+                    RepositoryKind::Hosted => Query::Index(path),
+                    _ => Query::FetchFile(path),
+                }])
+            }
+            ("GET" | "HEAD", Target::Pool(pool)) if hosted => match pool_ref(&pool) {
+                Some(target) => Action::Load(vec![Query::Package(target)]),
+                None => not_found("not found"),
+            },
+            ("GET" | "HEAD", Target::Pool(pool)) => Action::Load(vec![Query::FetchFile(pool.path)]),
+            ("GET" | "HEAD", _) => not_found("not found"),
+            ("PUT" | "POST", _) if !hosted => {
+                text(405, "packages are uploaded to hosted repositories")
+            }
+            ("PUT", Target::TopFile(file)) if file.ends_with(".deb") => publish(Upload::Body),
+            ("PUT", Target::Root) => publish(Upload::Body),
+            ("PUT", _) => text(
+                400,
+                "PUT a package to the repository's URL or to /<file>.deb directly below it",
+            ),
+            ("POST", Target::Root) => {
+                // A form (`curl -F package=@pkg.deb`), or the package as the
+                // body, whatever the content type says (Nexus' `curl -H
+                // "Content-Type: multipart/form-data" --data-binary @pkg.deb`
+                // sends no form).
+                let form = req.header("content-type").is_some_and(|ct| {
+                    ct.to_ascii_lowercase().starts_with("multipart/form-data")
+                        && ct.contains("boundary=")
+                });
+                publish(if form {
+                    Upload::FirstPart
+                } else {
+                    Upload::Body
+                })
+            }
+            ("POST", _) => text(400, "POST a package to the repository's URL"),
+            ("DELETE", Target::Pool(pool)) if hosted => match pool_ref(&pool) {
+                Some(target) => Action::Delete(ChangeRequest {
+                    target,
+                    done: Response::empty(204),
+                }),
+                None => not_found("not found"),
+            },
+            ("DELETE", _) => text(400, "DELETE a package's pool file"),
+            _ => Action::Respond(
+                Response::text(405, "method not allowed")
+                    .with_header("allow", "GET, HEAD, PUT, POST, DELETE"),
+            ),
+        }
+    }
+
+    fn render(&self, _repo: &Repository, req: &Request, data: &[Loaded]) -> Action {
+        let Some(loaded) = data.last() else {
+            return text(500, "apt: the host rendered a request without data");
+        };
+        match (&loaded.query, &loaded.answer) {
+            (
+                Query::Index(path) | Query::File(path) | Query::FetchFile(path),
+                Answer::File(Some(_)),
+            ) => Action::ServeFile(path.clone()),
+            (Query::Index(_) | Query::File(_) | Query::FetchFile(_), Answer::File(None)) => {
+                not_found("not found")
+            }
+            (Query::Package(target), Answer::Package(Some(info))) => {
+                let summary = info.summary.as_deref().and_then(Summary::parse);
+                let at_its_path = match (layout::parse(&req.path), summary) {
+                    (Ok(Target::Pool(pool)), Some(summary)) => {
+                        layout::pool_matches(&pool, &summary.component, &summary.package)
+                    }
+                    _ => false,
+                };
+                if at_its_path {
+                    Action::Download(target.clone())
+                } else {
+                    not_found("not found")
+                }
+            }
+            (Query::Package(_), Answer::Package(None)) => not_found("not found"),
+            _ => text(500, "apt: the host rendered data it was not asked for"),
+        }
+    }
+
+    fn upstream(
+        &self,
+        remote: &Remote,
+        op: &UpstreamOp,
+        fetched: &[FetchResult],
+    ) -> Result<UpstreamStep, FormatError> {
+        Ok(match op {
+            // Nothing to resolve: a file's URL is the remote's and its path.
+            UpstreamOp::Index => UpstreamStep::Done(UpstreamAnswer::Index("{}".into())),
+            UpstreamOp::File(path) => proxy::file(remote, path, fetched),
+            _ => UpstreamStep::Done(UpstreamAnswer::Failed(
+                "apt proxies serve their upstream's files".into(),
+            )),
+        })
+    }
+}
+
+/// The version a pool path names, at the path a hosted package of it has.
+fn pool_ref(pool: &PoolPath) -> Option<PackageRef> {
+    let deb = layout::deb_name(&pool.file)?;
+    if !pool.file.ends_with(".deb") {
+        return None;
+    }
+    Some(PackageRef {
+        id: layout::package_id(&deb.name, &deb.architecture),
+        version: version::normalize(&deb.version).ok()?,
+    })
+}
+
+fn publish(upload: Upload) -> Action {
+    Action::Publish(PublishRequest {
+        upload,
+        id: None,
+        done: Response::text(201, "uploaded\n"),
+    })
+}
+
+fn text(status: u16, message: &str) -> Action {
+    Action::Respond(Response::text(status, message))
+}
+
+fn not_found(message: &str) -> Action {
+    text(404, message)
+}
+
+/// The repository's URL itself: how to use it.
+fn about(repo: &Repository) -> Response {
+    let distribution = repo.option(DISTRIBUTION).unwrap_or("<distribution>");
+    let base = &repo.base_url;
+    let body = match repo.kind {
+        RepositoryKind::Hosted => format!(
+            "apt repository {name} (distribution {distribution})\n\n\
+             curl -fsSL {base}/{KEY_ASC} | sudo tee /etc/apt/keyrings/{name}.asc >/dev/null\n\
+             echo 'deb [signed-by=/etc/apt/keyrings/{name}.asc] {base}/ {distribution} main' \
+             | sudo tee /etc/apt/sources.list.d/{name}.list\n",
+            name = repo.name
+        ),
+        _ => format!(
+            "apt proxy {name} (distribution {distribution})\n\n\
+             deb {base}/ {distribution} main\n",
+            name = repo.name
+        ),
+    };
+    Response::text(200, &body)
+}
diff --git a/crates/formats/apt/src/manifest.rs b/crates/formats/apt/src/manifest.rs
new file mode 100644
index 00000000..09357b0f
--- /dev/null
+++ b/crates/formats/apt/src/manifest.rs
@@ -0,0 +1,249 @@
+//! A package's control file: what a publish reads from it, and the summary
+//! stored with the version, which holds everything the indexes list of it
+//! (so that making an index reads no package and no manifest) and what the
+//! web UI shows.
+
+use forge_plugin_api::{Dependency, DependencyGroup, FormatError};
+use serde::{Deserialize, Serialize};
+
+use crate::control::{self, Paragraph};
+use crate::version;
+
+/// What the indexes and the web UI read of a version (the stored manifest
+/// summary, a JSON object).
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct Summary {
+    pub package: String,
+    pub architecture: String,
+    pub component: String,
+    /// The control data as the indexes list it, without the fields an index
+    /// sets itself (`Filename`, `Size`, the digests).
+    pub control: String,
+    /// The synopsis and the extended description, as text.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub description: Option<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub section: Option<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub maintainer: Option<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub homepage: Option<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub source: Option<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub installed_size: Option<String>,
+    /// `Depends` and `Pre-Depends`, in the shape the web UI reads
+    /// (`[{target, dependencies: [{id, range}]}]`).
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub dependency_groups: Vec<serde_json::Value>,
+}
+
+impl Summary {
+    /// Read a stored summary.
+    pub fn parse(json: &str) -> Option<Summary> {
+        serde_json::from_str(json).ok()
+    }
+}
+
+/// What a package's control file says about it.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct Control {
+    pub name: String,
+    pub version: String,
+    pub architecture: String,
+    pub component: String,
+    pub paragraph: Paragraph,
+}
+
+impl Control {
+    /// Read and check a control file.
+    pub fn parse(bytes: &[u8]) -> Result<Control, FormatError> {
+        let text = std::str::from_utf8(bytes)
+            .map_err(|_| FormatError::MalformedManifest("the control file is not UTF-8".into()))?;
+        let paragraph = Paragraph::parse_one(text)
+            .map_err(|e| FormatError::MalformedManifest(format!("control file: {e}")))?;
+        let field = |name: &str| {
+            paragraph
+                .first_line(name)
+                .map(str::to_string)
+                .ok_or_else(|| {
+                    FormatError::MalformedManifest(format!("the control file has no {name} field"))
+                })
+        };
+        let name = field("Package")?;
+        if !control::valid_package_name(&name) {
+            return Err(FormatError::InvalidId(format!(
+                "{name:?} is not a package name (lowercase letters, digits, '+', '-' and '.')"
+            )));
+        }
+        let version = field("Version")?;
+        version::Version::parse(&version)
+            .map_err(|e| FormatError::InvalidVersion(e.to_string()))?;
+        let architecture = field("Architecture")?;
+        if !control::valid_architecture(&architecture) {
+            return Err(FormatError::MalformedManifest(format!(
+                "{architecture:?} is not an architecture"
+            )));
+        }
+        let component = control::component_of(paragraph.first_line("Section"))
+            .map_err(|e| FormatError::MalformedManifest(e.to_string()))?;
+        Ok(Control {
+            name,
+            version,
+            architecture,
+            component,
+            paragraph,
+        })
+    }
+
+    /// The dependencies the web UI shows: `Pre-Depends`, then `Depends`.
+    pub fn dependencies(&self) -> Vec<DependencyGroup> {
+        let mut dependencies = Vec::new();
+        for field in ["Pre-Depends", "Depends"] {
+            if let Some(value) = self.paragraph.get(field) {
+                dependencies.extend(
+                    control::relations(value)
+                        .into_iter()
+                        .map(|(id, range)| Dependency { id, range }),
+                );
+            }
+        }
+        if dependencies.is_empty() {
+            Vec::new()
+        } else {
+            vec![DependencyGroup {
+                target: None,
+                dependencies,
+            }]
+        }
+    }
+
+    /// The description as text: the synopsis, then the extended
+    /// description without its indentation (` .` lines are blank).
+    pub fn description(&self) -> Option<String> {
+        let value = self.paragraph.get("Description")?;
+        let mut lines = value.split('\n');
+        let mut out = lines.next().unwrap_or("").trim().to_string();
+        let mut extended = Vec::new();
+        for line in lines {
+            let line = line.strip_prefix(' ').unwrap_or(line);
+            extended.push(if line.trim() == "." {
+                ""
+            } else {
+                line.trim_end()
+            });
+        }
+        if !extended.is_empty() {
+            out.push_str("\n\n");
+            out.push_str(&extended.join("\n"));
+        }
+        Some(out).filter(|d| !d.trim().is_empty())
+    }
+
+    /// The summary stored with the version.
+    pub fn summary(&self) -> Summary {
+        let mut listed = self.paragraph.clone();
+        for field in [
+            "Filename", "Size", "MD5sum", "SHA1", "SHA256", "SHA512", "Status",
+        ] {
+            listed.remove(field);
+        }
+        let text = |name: &str| self.paragraph.first_line(name).map(str::to_string);
+        Summary {
+            package: self.name.clone(),
+            architecture: self.architecture.clone(),
+            component: self.component.clone(),
+            control: listed.to_text(),
+            description: self.description(),
+            section: text("Section"),
+            maintainer: text("Maintainer"),
+            homepage: text("Homepage"),
+            source: text("Source"),
+            installed_size: text("Installed-Size"),
+            dependency_groups: self
+                .dependencies()
+                .into_iter()
+                .map(|group| {
+                    serde_json::json!({
+                        "target": group.target,
+                        "dependencies": group.dependencies.iter().map(|d| serde_json::json!({
+                            "id": d.id,
+                            "range": d.range,
+                        })).collect::<Vec<_>>(),
+                    })
+                })
+                .collect(),
+        }
+    }
+}
+
+/// The JSON summary of a control file (the manifest stored at publish).
+pub fn summarize(manifest: &[u8]) -> Option<String> {
+    let control = Control::parse(manifest).ok()?;
+    serde_json::to_string(&control.summary()).ok()
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn a_control_file_is_read_and_summarized() {
+        let control = Control::parse(
+            b"Package: hello\nVersion: 2.10-3\nArchitecture: amd64\nSection: contrib/utils\n\
+              Depends: libc6 (>= 2.34)\nPre-Depends: dpkg\nSHA256: forged\n\
+              Description: greet\n Prints a greeting.\n .\n Really.\n",
+        )
+        .unwrap();
+        assert_eq!(
+            (
+                control.name.as_str(),
+                control.version.as_str(),
+                control.architecture.as_str()
+            ),
+            ("hello", "2.10-3", "amd64")
+        );
+        assert_eq!(control.component, "contrib");
+        let summary = control.summary();
+        assert_eq!(
+            summary.description.as_deref(),
+            Some("greet\n\nPrints a greeting.\n\nReally.")
+        );
+        assert!(!summary.control.contains("SHA256"));
+        assert_eq!(
+            summary.dependency_groups[0]["dependencies"][0],
+            serde_json::json!({"id": "dpkg", "range": null})
+        );
+        let json = serde_json::to_string(&summary).unwrap();
+        assert_eq!(Summary::parse(&json).unwrap(), summary);
+    }
+
+    #[test]
+    fn a_control_file_needs_its_identity() {
+        for (bad, why) in [
+            (&b"Version: 1\nArchitecture: amd64\n"[..], "no Package"),
+            (b"Package: hello\nArchitecture: amd64\n", "no Version"),
+            (b"Package: hello\nVersion: 1\n", "no Architecture"),
+            (
+                b"Package: Hello\nVersion: 1\nArchitecture: amd64\n",
+                "not a package name",
+            ),
+            (
+                b"Package: hello\nVersion: x\nArchitecture: amd64\n",
+                "upstream",
+            ),
+            (
+                b"Package: hello\nVersion: 1\nArchitecture: any\n",
+                "not an architecture",
+            ),
+            (
+                b"Package: hello\nVersion: 1\nArchitecture: amd64\nSection: ../x/y\n",
+                "component",
+            ),
+            (b"\xff\xfe", "UTF-8"),
+        ] {
+            let err = Control::parse(bad).unwrap_err().to_string();
+            assert!(err.contains(why), "{err} should say {why}");
+        }
+    }
+}
diff --git a/crates/formats/apt/src/proxy.rs b/crates/formats/apt/src/proxy.rs
new file mode 100644
index 00000000..6fc1b6e5
--- /dev/null
+++ b/crates/formats/apt/src/proxy.rs
@@ -0,0 +1,284 @@
+//! Proxies of an apt repository (a Debian or Ubuntu mirror): every file is
+//! the upstream's, at `<remote_url>/<path>`, served as it is, so clients
+//! verify the upstream's signatures with the upstream's keys.
+//!
+//! * `dists/<distribution>/…` (the distribution the proxy is for): the
+//!   indexes, re-validated once the repository's metadata TTL has passed;
+//!   their `by-hash` copies never change.
+//! * `pool/…`: packages, which never change at their path. Before a
+//!   package is cached the host checks it against the size and SHA-256 the
+//!   upstream's `Packages` index of its component and architecture gives it
+//!   (`Packages.gz`, else `.xz`, else the plain one), when there is such an
+//!   index and it lists the file.
+
+use std::io::{BufRead, BufReader, Read};
+
+use forge_plugin_api::{
+    Fetch, FetchResult, Fetched, FileLocation, Freshness, Remote, UpstreamAnswer, UpstreamStep,
+};
+
+use crate::layout::{self, Target};
+
+/// The most an index may inflate to while it is searched.
+const MAX_INDEX_BYTES: u64 = 1024 * 1024 * 1024;
+
+/// The upstream URL of `path`: `remote_url` (as a directory) with the path's
+/// segments appended, each percent-encoded.
+pub fn upstream_url(remote_url: &str, path: &str) -> Option<String> {
+    let mut url = url::Url::parse(remote_url).ok()?;
+    if !matches!(url.scheme(), "http" | "https") {
+        return None;
+    }
+    {
+        let mut segments = url.path_segments_mut().ok()?;
+        segments.pop_if_empty();
+        for segment in path.split('/') {
+            segments.push(segment);
+        }
+    }
+    Some(url.into())
+}
+
+/// The answer to the upstream operation `file(path)`, round by round.
+pub fn file(remote: &Remote, path: &str, fetched: &[FetchResult]) -> UpstreamStep {
+    let Some(url) = upstream_url(&remote.url, path) else {
+        return UpstreamStep::Done(UpstreamAnswer::File(None));
+    };
+    let mut location = FileLocation::at(url);
+    match layout::parse(path) {
+        Ok(Target::Dists { rest, .. }) => {
+            location.immutable = layout::is_by_hash(&rest);
+            location.sha256 = layout::by_hash_sha256(&rest);
+        }
+        Ok(Target::Pool(pool)) => {
+            location.immutable = true;
+            if let (Some(deb), Some(distribution)) =
+                (layout::deb_name(&pool.file), remote.option("distribution"))
+            {
+                let dir = format!(
+                    "dists/{distribution}/{}/binary-{}",
+                    pool.component, deb.architecture
+                );
+                match listed(remote, &dir, path, fetched) {
+                    Lookup::Fetch(fetch) => return UpstreamStep::Fetch(vec![fetch]),
+                    Lookup::Found { size, sha256 } => {
+                        location.size = size;
+                        location.sha256 = sha256;
+                    }
+                    Lookup::Unknown => {}
+                }
+            }
+        }
+        // The plugin asks for nothing else.
+        _ => return UpstreamStep::Done(UpstreamAnswer::File(None)),
+    }
+    UpstreamStep::Done(UpstreamAnswer::FileAt(location))
+}
+
+enum Lookup {
+    Fetch(Fetch),
+    Found {
+        size: Option<u64>,
+        sha256: Option<String>,
+    },
+    Unknown,
+}
+
+/// What the `Packages` index in `dir` says of the file at `path`: the next
+/// index to fetch, the file's size and digest, or nothing (no index, or the
+/// index does not list the file).
+fn listed(remote: &Remote, dir: &str, path: &str, fetched: &[FetchResult]) -> Lookup {
+    for name in ["Packages.gz", "Packages.xz", "Packages"] {
+        let Some(url) = upstream_url(&remote.url, &format!("{dir}/{name}")) else {
+            return Lookup::Unknown;
+        };
+        match fetched.iter().find(|f| f.fetch.url == url) {
+            None => return Lookup::Fetch(Fetch::new(url, Freshness::Metadata)),
+            Some(FetchResult {
+                outcome: Fetched::Found(body),
+                ..
+            }) => {
+                return match find(body, path) {
+                    Some((size, sha256)) => Lookup::Found { size, sha256 },
+                    None => Lookup::Unknown,
+                }
+            }
+            // Not there: the next compression.
+            Some(FetchResult {
+                outcome: Fetched::NotFound,
+                ..
+            }) => {}
+            // Unavailable or too large: unverified, as apt verifies.
+            Some(_) => return Lookup::Unknown,
+        }
+    }
+    Lookup::Unknown
+}
+
+/// The size and SHA-256 an index (gzip, xz or plain, as its first bytes
+/// say) gives the file at `path`, read as a stream.
+pub fn find(index: &[u8], path: &str) -> Option<(Option<u64>, Option<String>)> {
+    let reader: Box<dyn Read + '_> = if index.starts_with(&[0x1f, 0x8b]) {
+        Box::new(flate2::read::MultiGzDecoder::new(index))
+    } else if index.starts_with(&[0xfd, b'7', b'z', b'X', b'Z', 0x00]) {
+        Box::new(lzma_rust2::XzReader::new(index, true))
+    } else {
+        Box::new(index)
+    };
+    let reader = BufReader::new(reader.take(MAX_INDEX_BYTES));
+    let (mut filename, mut size, mut sha256) = (None::<String>, None, None);
+    for line in reader.split(b'\n') {
+        let line = line.ok()?;
+        let line = line.strip_suffix(b"\r").unwrap_or(&line);
+        if line.iter().all(u8::is_ascii_whitespace) {
+            if filename.as_deref() == Some(path) {
+                return Some((size, sha256));
+            }
+            (filename, size, sha256) = (None, None, None);
+            continue;
+        }
+        let Some((name, value)) = std::str::from_utf8(line)
+            .ok()
+            .and_then(|line| line.split_once(':'))
+        else {
+            continue;
+        };
+        let value = value.trim();
+        if name.eq_ignore_ascii_case("Filename") {
+            filename = Some(value.to_string());
+        } else if name.eq_ignore_ascii_case("Size") {
+            size = value.parse().ok();
+        } else if name.eq_ignore_ascii_case("SHA256") {
+            sha256 = (value.len() == 64 && value.bytes().all(|b| b.is_ascii_hexdigit()))
+                .then(|| value.to_ascii_lowercase());
+        }
+    }
+    (filename.as_deref() == Some(path)).then_some((size, sha256))
+}
+
+#[cfg(test)]
+mod tests {
+    use std::io::Write;
+
+    use super::*;
+
+    const INDEX: &str =
+        "Package: a\nFilename: pool/main/a/a/a_1_amd64.deb\nSize: 10\nSHA256: AAAA\n\n\
+        Package: hello\nVersion: 1.0\nFilename: pool/main/h/hello/hello_1.0_amd64.deb\nSize: 42\n\
+        SHA256: 0123456789abcdef0123456789abcdef0123456789abcdef0123456789ABCDEF\n";
+
+    #[test]
+    fn indexes_are_searched_in_every_compression() {
+        let mut gz = flate2::write::GzEncoder::new(Vec::new(), flate2::Compression::default());
+        gz.write_all(INDEX.as_bytes()).unwrap();
+        let gz = gz.finish().unwrap();
+        let mut xz =
+            lzma_rust2::XzWriter::new(Vec::new(), lzma_rust2::XzOptions::with_preset(1)).unwrap();
+        xz.write_all(INDEX.as_bytes()).unwrap();
+        let xz = xz.finish().unwrap();
+        for index in [INDEX.as_bytes().to_vec(), gz, xz] {
+            assert_eq!(
+                find(&index, "pool/main/h/hello/hello_1.0_amd64.deb"),
+                Some((
+                    Some(42),
+                    Some("0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef".into())
+                ))
+            );
+            // A malformed digest is no digest.
+            assert_eq!(
+                find(&index, "pool/main/a/a/a_1_amd64.deb"),
+                Some((Some(10), None))
+            );
+            assert_eq!(find(&index, "pool/main/x/x/x_1_amd64.deb"), None);
+        }
+    }
+
+    fn remote() -> Remote {
+        let mut remote = Remote::new("http://deb.example.test/debian");
+        remote
+            .options
+            .push(("distribution".into(), "bookworm".into()));
+        remote
+    }
+
+    #[test]
+    fn index_files_are_the_upstreams() {
+        let UpstreamStep::Done(UpstreamAnswer::FileAt(at)) =
+            file(&remote(), "dists/bookworm/InRelease", &[])
+        else {
+            panic!()
+        };
+        assert_eq!(
+            at.url,
+            "http://deb.example.test/debian/dists/bookworm/InRelease"
+        );
+        assert!(!at.immutable);
+        let hash = "c".repeat(64);
+        let UpstreamStep::Done(UpstreamAnswer::FileAt(at)) = file(
+            &remote(),
+            &format!("dists/bookworm/main/binary-amd64/by-hash/SHA256/{hash}"),
+            &[],
+        ) else {
+            panic!()
+        };
+        assert!(at.immutable);
+        assert_eq!(at.sha256, Some(hash));
+    }
+
+    #[test]
+    fn packages_are_checked_against_the_index() {
+        let path = "pool/main/h/hello/hello_1.0_amd64.deb";
+        let UpstreamStep::Fetch(fetches) = file(&remote(), path, &[]) else {
+            panic!()
+        };
+        assert_eq!(
+            fetches[0].url,
+            "http://deb.example.test/debian/dists/bookworm/main/binary-amd64/Packages.gz"
+        );
+        let result = |url: &str, outcome| FetchResult {
+            fetch: Fetch::new(url, Freshness::Metadata),
+            outcome,
+            status: None,
+            headers: Vec::new(),
+        };
+        // No .gz: the .xz is next, then the plain index.
+        let gz = result(&fetches[0].url, Fetched::NotFound);
+        let UpstreamStep::Fetch(next) = file(&remote(), path, std::slice::from_ref(&gz)) else {
+            panic!()
+        };
+        assert!(next[0].url.ends_with("/Packages.xz"));
+        let xz = result(&next[0].url, Fetched::NotFound);
+        let UpstreamStep::Fetch(next) = file(&remote(), path, &[gz.clone(), xz.clone()]) else {
+            panic!()
+        };
+        assert!(next[0].url.ends_with("/Packages"));
+        let plain = result(&next[0].url, Fetched::Found(INDEX.as_bytes().to_vec()));
+        let UpstreamStep::Done(UpstreamAnswer::FileAt(at)) =
+            file(&remote(), path, &[gz, xz, plain])
+        else {
+            panic!()
+        };
+        assert!(at.immutable);
+        assert_eq!(at.size, Some(42));
+        assert!(at.sha256.is_some());
+        // An index that is down leaves the package to apt's own check.
+        let down = result(&fetches[0].url, Fetched::Failed("503".into()));
+        let UpstreamStep::Done(UpstreamAnswer::FileAt(at)) = file(&remote(), path, &[down]) else {
+            panic!()
+        };
+        assert_eq!((at.size, at.sha256), (None, None));
+    }
+
+    #[test]
+    fn urls_append_encoded_segments() {
+        assert_eq!(
+            upstream_url(
+                "http://up.test/debian/",
+                "pool/main/h/hello/hello_1:2.0_amd64.deb"
+            )
+            .unwrap(),
+            "http://up.test/debian/pool/main/h/hello/hello_1:2.0_amd64.deb"
+        );
+        assert_eq!(upstream_url("ftp://up.test/", "x"), None);
+    }
+}
diff --git a/crates/formats/apt/src/version.rs b/crates/formats/apt/src/version.rs
new file mode 100644
index 00000000..9782bb6c
--- /dev/null
+++ b/crates/formats/apt/src/version.rs
@@ -0,0 +1,338 @@
+//! Debian package versions: `[epoch:]upstream_version[-debian_revision]`,
+//! ordered as dpkg orders them (Debian Policy 5.6.12, dpkg's `verrevcmp`).
+//!
+//! * The epoch is a number; without one it is 0.
+//! * The upstream version starts with a digit and holds letters, digits and
+//!   `.`, `+`, `~`, and `-` when there is a revision (the revision is what
+//!   follows the last `-`).
+//! * The revision holds letters, digits and `.`, `+`, `~`.
+//!
+//! Comparing two versions compares the epochs as numbers, then the upstream
+//! versions, then the revisions: each alternates runs of non-digits, compared
+//! character by character (`~` before the end of the string, before
+//! everything else; letters before the other characters), and runs of
+//! digits, compared as numbers. So `1.0~rc1` < `1.0` < `1.0+b1` < `1.0a`,
+//! and `1.0-1` < `1.0-10`.
+
+use std::cmp::Ordering;
+use std::fmt;
+
+/// The longest version accepted, in bytes (the host bounds them at 256).
+pub const MAX_VERSION_BYTES: usize = 128;
+
+/// A version, split into its parts.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct Version<'a> {
+    pub epoch: u32,
+    pub upstream: &'a str,
+    /// Empty when the version has no revision.
+    pub revision: &'a str,
+}
+
+/// Why a version is refused.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct VersionError(pub String);
+
+impl fmt::Display for VersionError {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str(&self.0)
+    }
+}
+
+impl<'a> Version<'a> {
+    /// Parse a version as a control file writes it.
+    pub fn parse(version: &'a str) -> Result<Self, VersionError> {
+        let fail = |why: &str| Err(VersionError(format!("{version:?}: {why}")));
+        if version.is_empty() {
+            return fail("empty");
+        }
+        if version.len() > MAX_VERSION_BYTES {
+            return fail("longer than 128 bytes");
+        }
+        let (epoch, rest) = match version.split_once(':') {
+            Some((epoch, rest)) => {
+                if epoch.is_empty() || !epoch.bytes().all(|b| b.is_ascii_digit()) {
+                    return fail("the epoch is not a number");
+                }
+                match epoch.parse::<u32>() {
+                    Ok(epoch) => (epoch, rest),
+                    Err(_) => return fail("the epoch is too large"),
+                }
+            }
+            None => (0, version),
+        };
+        let (upstream, revision) = match rest.rsplit_once('-') {
+            Some((upstream, revision)) => {
+                if revision.is_empty() {
+                    return fail("the revision after the last '-' is empty");
+                }
+                (upstream, revision)
+            }
+            None => (rest, ""),
+        };
+        if !upstream.starts_with(|c: char| c.is_ascii_digit()) {
+            return fail("the upstream version does not start with a digit");
+        }
+        let upstream_ok = upstream
+            .bytes()
+            .all(|b| b.is_ascii_alphanumeric() || matches!(b, b'.' | b'+' | b'~' | b'-'));
+        if !upstream_ok {
+            return fail(
+                "the upstream version holds characters other than letters, digits and . + ~ -",
+            );
+        }
+        let revision_ok = revision
+            .bytes()
+            .all(|b| b.is_ascii_alphanumeric() || matches!(b, b'.' | b'+' | b'~'));
+        if !revision_ok {
+            return fail("the revision holds characters other than letters, digits and . + ~");
+        }
+        Ok(Version {
+            epoch,
+            upstream,
+            revision,
+        })
+    }
+
+    /// The version without its epoch, as Debian names files
+    /// (`hello_2.10-3_amd64.deb`).
+    pub fn without_epoch(&self) -> String {
+        if self.revision.is_empty() {
+            self.upstream.to_string()
+        } else {
+            format!("{}-{}", self.upstream, self.revision)
+        }
+    }
+}
+
+/// The normalized form of `version`, its identity in a repository: the
+/// version as written, without an explicit epoch of 0 (`0:1.0` is `1.0`).
+pub fn normalize(version: &str) -> Result<String, VersionError> {
+    let parsed = Version::parse(version)?;
+    Ok(if parsed.epoch == 0 {
+        parsed.without_epoch()
+    } else {
+        format!("{}:{}", parsed.epoch, parsed.without_epoch())
+    })
+}
+
+/// dpkg's order of two versions. A version that does not parse sorts
+/// before every version that does, and such versions by their bytes.
+pub fn compare(a: &str, b: &str) -> Ordering {
+    match (Version::parse(a), Version::parse(b)) {
+        (Ok(a), Ok(b)) => a
+            .epoch
+            .cmp(&b.epoch)
+            .then_with(|| verrevcmp(a.upstream, b.upstream))
+            .then_with(|| verrevcmp(a.revision, b.revision)),
+        (Ok(_), Err(_)) => Ordering::Greater,
+        (Err(_), Ok(_)) => Ordering::Less,
+        (Err(_), Err(_)) => a.cmp(b),
+    }
+}
+
+/// The weight of a non-digit character in a version (`0` past its end):
+/// `~` sorts before everything, even the end, letters before the rest.
+fn order(c: Option<u8>) -> i32 {
+    match c {
+        None => 0,
+        Some(c) if c.is_ascii_digit() => 0,
+        Some(c) if c.is_ascii_alphabetic() => i32::from(c),
+        Some(b'~') => -1,
+        Some(c) => i32::from(c) + 256,
+    }
+}
+
+/// dpkg's `verrevcmp`: compare an upstream version or a revision.
+fn verrevcmp(a: &str, b: &str) -> Ordering {
+    let (a, b) = (a.as_bytes(), b.as_bytes());
+    let (mut i, mut j) = (0, 0);
+    let digit = |s: &[u8], k: usize| s.get(k).is_some_and(u8::is_ascii_digit);
+    while i < a.len() || j < b.len() {
+        // A run of non-digits, character by character.
+        while (i < a.len() && !digit(a, i)) || (j < b.len() && !digit(b, j)) {
+            let (ac, bc) = (order(a.get(i).copied()), order(b.get(j).copied()));
+            if ac != bc {
+                return ac.cmp(&bc);
+            }
+            i += 1;
+            j += 1;
+        }
+        // A run of digits, as a number.
+        while a.get(i) == Some(&b'0') {
+            i += 1;
+        }
+        while b.get(j) == Some(&b'0') {
+            j += 1;
+        }
+        let mut first_diff = Ordering::Equal;
+        while digit(a, i) && digit(b, j) {
+            if first_diff == Ordering::Equal {
+                first_diff = a[i].cmp(&b[j]);
+            }
+            i += 1;
+            j += 1;
+        }
+        if digit(a, i) {
+            return Ordering::Greater;
+        }
+        if digit(b, j) {
+            return Ordering::Less;
+        }
+        if first_diff != Ordering::Equal {
+            return first_diff;
+        }
+    }
+    Ordering::Equal
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn lt(a: &str, b: &str) {
+        assert_eq!(compare(a, b), Ordering::Less, "{a} < {b}");
+        assert_eq!(compare(b, a), Ordering::Greater, "{b} > {a}");
+    }
+
+    fn eq(a: &str, b: &str) {
+        assert_eq!(compare(a, b), Ordering::Equal, "{a} = {b}");
+    }
+
+    #[test]
+    fn epochs_come_first() {
+        lt("1.0", "1:0.1");
+        lt("1:2.0", "2:1.0");
+        lt("9:9.9", "10:0.1");
+        eq("0:1.0", "1.0");
+        lt("1.0-9", "1:1.0-1");
+    }
+
+    #[test]
+    fn tilde_sorts_before_everything() {
+        lt("1.0~rc1", "1.0");
+        lt("1.0~~", "1.0~");
+        lt("1.0~~a", "1.0~");
+        lt("1.0~rc1", "1.0~rc2");
+        lt("1.0~beta", "1.0~rc");
+        lt("2.0~1", "2.0-1");
+        lt("1.0-1~bpo1", "1.0-1");
+        lt("1.0", "1.0+b1");
+        lt("1.0", "1.0.1");
+    }
+
+    #[test]
+    fn letters_sort_before_other_characters() {
+        lt("1.0a", "1.0+");
+        lt("1.0a", "1.0.");
+        lt("1.0+", "1.0.");
+        lt("1.0", "1.0a");
+        lt("1.0A", "1.0a");
+    }
+
+    #[test]
+    fn digits_compare_as_numbers() {
+        lt("1.2", "1.10");
+        lt("1.0-1", "1.0-10");
+        lt("1.0-2", "1.0-10");
+        lt("2.9", "2.10");
+        eq("1.00", "1.0");
+        eq("1.01", "1.1");
+        lt("1.0", "1.0-1");
+        eq("1.0", "1.0-0");
+    }
+
+    #[test]
+    fn revisions_come_after_the_upstream_version() {
+        lt("1.0-1", "1.0-2");
+        lt("1.0-1", "1.1-1");
+        lt("1.0-1ubuntu1", "1.0-1ubuntu2");
+        lt("1.0-1", "1.0-1ubuntu1");
+        lt("2.10-2", "2.10-3");
+        // The revision is what follows the last hyphen.
+        let v = Version::parse("1.0-beta-2").unwrap();
+        assert_eq!((v.upstream, v.revision), ("1.0-beta", "2"));
+    }
+
+    #[test]
+    fn a_sorted_list_matches_dpkg() {
+        let mut versions = vec![
+            "1.0-1",
+            "1:0.9",
+            "1.0~rc1-1",
+            "1.0",
+            "1.0+dfsg-1",
+            "0.9.9",
+            "1.0-1.1",
+            "1.0-1~bpo11+1",
+            "2.0~~",
+            "2.0~",
+            "2.0",
+        ];
+        versions.sort_by(|a, b| compare(a, b));
+        assert_eq!(
+            versions,
+            vec![
+                "0.9.9",
+                "1.0~rc1-1",
+                "1.0",
+                "1.0-1~bpo11+1",
+                "1.0-1",
+                "1.0-1.1",
+                "1.0+dfsg-1",
+                "2.0~~",
+                "2.0~",
+                "2.0",
+                "1:0.9",
+            ]
+        );
+    }
+
+    #[test]
+    fn versions_are_validated() {
+        for bad in [
+            "",
+            "a1.0",
+            ":1.0",
+            "x:1.0",
+            "1.0-",
+            "1.0_1",
+            "1.0 1",
+            "1.0/1",
+            "-1",
+            "1:",
+            "1.0-a_b",
+            "99999999999:1.0",
+            "1.0-1:2",
+        ] {
+            assert!(Version::parse(bad).is_err(), "{bad:?}");
+        }
+        for good in [
+            "1",
+            "1.0",
+            "1:1.0",
+            "1.0-1",
+            "1.0~rc1+dfsg-0ubuntu1~22.04.1",
+            "2:1.2.3-4.5",
+        ] {
+            assert!(Version::parse(good).is_ok(), "{good:?}");
+        }
+        assert!(Version::parse(&"1".repeat(MAX_VERSION_BYTES + 1)).is_err());
+    }
+
+    #[test]
+    fn normalizing_drops_a_zero_epoch_only() {
+        assert_eq!(normalize("0:1.0-1").unwrap(), "1.0-1");
+        assert_eq!(normalize("1.0-1").unwrap(), "1.0-1");
+        assert_eq!(normalize("2:1.0").unwrap(), "2:1.0");
+        assert_eq!(normalize("00:1.0").unwrap(), "1.0");
+        assert_eq!(normalize("02:1.0").unwrap(), "2:1.0");
+        assert!(normalize("bad").is_err());
+    }
+
+    #[test]
+    fn unparsable_versions_sort_first() {
+        lt("not a version", "0");
+        lt("a", "b");
+    }
+}
diff --git a/crates/formats/docker/src/lib.rs b/crates/formats/docker/src/lib.rs
index 5313cd92..19ffa2a3 100644
--- a/crates/formats/docker/src/lib.rs
+++ b/crates/formats/docker/src/lib.rs
@@ -60,6 +60,9 @@ pub const DESCRIPTOR: Descriptor = Descriptor {
     assets: Assets::DEFAULT,
     // The host's image store answers an upstream's Bearer challenge itself.
     upstream_token: UpstreamToken::None,
+    options: &[],
+    prereleases: forge_plugin_api::Prereleases::Dash,
+    indexes: false,
 };
 
 /// The Docker / OCI format.
diff --git a/crates/formats/docker/src/upstream.rs b/crates/formats/docker/src/upstream.rs
index 7d283b2c..7d7c9780 100644
--- a/crates/formats/docker/src/upstream.rs
+++ b/crates/formats/docker/src/upstream.rs
@@ -431,6 +431,7 @@ mod tests {
         Remote {
             url: url.into(),
             index: None,
+            options: Vec::new(),
         }
     }
 
diff --git a/crates/formats/npm/examples/packument_memory.rs b/crates/formats/npm/examples/packument_memory.rs
index f98f8724..b0bf59fd 100644
--- a/crates/formats/npm/examples/packument_memory.rs
+++ b/crates/formats/npm/examples/packument_memory.rs
@@ -91,6 +91,7 @@ fn remote() -> Remote {
     Remote {
         url: "https://registry.npmjs.org".into(),
         index: Some("{}".into()),
+        options: Vec::new(),
     }
 }
 
diff --git a/crates/formats/npm/src/lib.rs b/crates/formats/npm/src/lib.rs
index ea3668ef..3f798bb8 100644
--- a/crates/formats/npm/src/lib.rs
+++ b/crates/formats/npm/src/lib.rs
@@ -66,6 +66,9 @@ pub const DESCRIPTOR: Descriptor = Descriptor {
     // A proxy given only a password (a registry token) sends it as a Bearer
     // token, as npm clients do with `_authToken`.
     upstream_token: UpstreamToken::Bearer,
+    options: &[],
+    prereleases: forge_plugin_api::Prereleases::Dash,
+    indexes: false,
 };
 
 /// What the plugin reads of a request, beyond the package the repository's
diff --git a/crates/formats/npm/src/proxy.rs b/crates/formats/npm/src/proxy.rs
index badb493d..8c422a11 100644
--- a/crates/formats/npm/src/proxy.rs
+++ b/crates/formats/npm/src/proxy.rs
@@ -438,6 +438,7 @@ mod tests {
         Remote {
             url: "https://registry.example.com/".into(),
             index: Some("{}".into()),
+            options: Vec::new(),
         }
     }
 
diff --git a/crates/formats/npm/tests/protocol.rs b/crates/formats/npm/tests/protocol.rs
index 995db7ee..8aafff81 100644
--- a/crates/formats/npm/tests/protocol.rs
+++ b/crates/formats/npm/tests/protocol.rs
@@ -27,6 +27,7 @@ fn repo(kind: RepositoryKind) -> Repository {
         kind,
         base_url: BASE.into(),
         inline: false,
+        options: Vec::new(),
     }
 }
 
diff --git a/crates/formats/nuget/src/lib.rs b/crates/formats/nuget/src/lib.rs
index 1c681aae..fa068507 100644
--- a/crates/formats/nuget/src/lib.rs
+++ b/crates/formats/nuget/src/lib.rs
@@ -57,6 +57,9 @@ pub const DESCRIPTOR: Descriptor = Descriptor {
         manifest_type: "application/xml",
     },
     upstream_token: UpstreamToken::None,
+    options: &[],
+    prereleases: forge_plugin_api::Prereleases::Dash,
+    indexes: false,
 };
 
 /// The NuGet format, with the zip-bomb limits applied while parsing packages.
diff --git a/crates/formats/nuget/tests/protocol.rs b/crates/formats/nuget/tests/protocol.rs
index b7461e71..8304fd24 100644
--- a/crates/formats/nuget/tests/protocol.rs
+++ b/crates/formats/nuget/tests/protocol.rs
@@ -24,6 +24,7 @@ fn repo(kind: RepositoryKind) -> Repository {
         kind,
         base_url: format!("{BASE}/repository/main"),
         inline: false,
+        options: Vec::new(),
     }
 }
 
diff --git a/crates/formats/nuget/tests/upstream.rs b/crates/formats/nuget/tests/upstream.rs
index b71afa16..6015ad53 100644
--- a/crates/formats/nuget/tests/upstream.rs
+++ b/crates/formats/nuget/tests/upstream.rs
@@ -28,6 +28,7 @@ fn remote(resources: &Resources) -> Remote {
     Remote {
         url: FEED.into(),
         index: Some(serde_json::to_string(resources).unwrap()),
+        options: Vec::new(),
     }
 }
 
@@ -73,6 +74,7 @@ fn the_index_is_the_service_indexs_resources() {
     let unresolved = Remote {
         url: FEED.into(),
         index: None,
+        options: Vec::new(),
     };
     let done = run(
         &unresolved,
diff --git a/crates/formats/raw/src/lib.rs b/crates/formats/raw/src/lib.rs
index ac414d68..5dfcd6c6 100644
--- a/crates/formats/raw/src/lib.rs
+++ b/crates/formats/raw/src/lib.rs
@@ -53,6 +53,9 @@ pub const DESCRIPTOR: Descriptor = Descriptor {
     storage: Storage::Files,
     assets: Assets::DEFAULT,
     upstream_token: UpstreamToken::None,
+    options: &[],
+    prereleases: forge_plugin_api::Prereleases::Dash,
+    indexes: false,
 };
 
 /// The raw format.
diff --git a/crates/formats/raw/src/listing.rs b/crates/formats/raw/src/listing.rs
index 82ee6f3f..158cec12 100644
--- a/crates/formats/raw/src/listing.rs
+++ b/crates/formats/raw/src/listing.rs
@@ -351,6 +351,7 @@ mod tests {
             kind: RepositoryKind::Hosted,
             base_url: "https://forge.example.com/repository/bin".into(),
             inline: false,
+            options: Vec::new(),
         }
     }
 
diff --git a/crates/formats/raw/src/sidecar.rs b/crates/formats/raw/src/sidecar.rs
index 2f30784e..b4b18f47 100644
--- a/crates/formats/raw/src/sidecar.rs
+++ b/crates/formats/raw/src/sidecar.rs
@@ -196,6 +196,7 @@ mod tests {
             kind: RepositoryKind::Hosted,
             base_url: "https://forge.example.com/repository/r".into(),
             inline: false,
+            options: Vec::new(),
         };
         assert_eq!(
             content_disposition(&repo, "a/b.txt"),
diff --git a/crates/plugin-api/src/lib.rs b/crates/plugin-api/src/lib.rs
index 705ab7fc..5f13c6a0 100644
--- a/crates/plugin-api/src/lib.rs
+++ b/crates/plugin-api/src/lib.rs
@@ -280,6 +280,51 @@ pub trait FormatPlugin: Send + Sync + 'static {
         Err(ImageError::NotAnEndpoint)
     }
 
+    /// The value a repository of `kind` keeps for option `name`
+    /// ([`Descriptor::options`]) when an administrator sets it to `value`,
+    /// or why it is refused (shown to the administrator). The host has
+    /// checked that the format has the option and that `kind` takes it. The
+    /// default takes the value trimmed: one line of at most 256 bytes, not
+    /// empty.
+    fn check_option(
+        &self,
+        kind: RepositoryKind,
+        name: &str,
+        value: &str,
+    ) -> Result<String, FormatError> {
+        let _ = (kind, name);
+        let value = value.trim();
+        if value.is_empty() || value.len() > 256 || value.chars().any(char::is_control) {
+            return Err(FormatError::InvalidId(
+                "an option is one line of at most 256 bytes".into(),
+            ));
+        }
+        Ok(value.to_string())
+    }
+
+    /// Formats with [`Descriptor::indexes`]: the files of a repository's
+    /// indexes, made of its packages ([`IndexInput`]). The host calls it
+    /// when a client asks for an index ([`Query::Index`]) and the
+    /// repository's packages, options or signing keys changed since the
+    /// last one; it signs the copies each file names
+    /// ([`IndexFile::signed`]) with every signing key of the repository,
+    /// and replaces the previous index with all the files at once. Must be
+    /// deterministic but for [`IndexInput::generated`]. The default makes
+    /// none.
+    fn index(&self, repo: &Repository, input: &IndexInput) -> Result<Vec<IndexFile>, FormatError> {
+        let _ = (repo, input);
+        Err(FormatError::Internal("this format keeps no indexes".into()))
+    }
+
+    /// A package format: the package (canonical id) the file the host keeps
+    /// at `path` belongs to, which package selectors decide on (a proxy's
+    /// copy of a package); `None` for a file of no package (an index), which
+    /// every reader of the repository may read. The default: none.
+    fn file_package(&self, path: &str) -> Option<String> {
+        let _ = path;
+        None
+    }
+
     /// Images formats: the response to a request the host refused, or to
     /// what failed while it served it outside a query ([`ImageError`]).
     /// The host adds its own headers (a Bearer challenge). The default is
diff --git a/crates/plugin-api/src/testing.rs b/crates/plugin-api/src/testing.rs
index c251faac..ddd2a758 100644
--- a/crates/plugin-api/src/testing.rs
+++ b/crates/plugin-api/src/testing.rs
@@ -37,6 +37,7 @@ pub fn repository(kind: RepositoryKind) -> Repository {
         kind,
         base_url: "https://forge.example.com/repository/repo".into(),
         inline: false,
+        options: Vec::new(),
     }
 }
 
diff --git a/crates/plugin-api/src/types.rs b/crates/plugin-api/src/types.rs
index 1589a2e5..19115425 100644
--- a/crates/plugin-api/src/types.rs
+++ b/crates/plugin-api/src/types.rs
@@ -115,7 +115,7 @@ impl RepositoryKind {
 /// `'static` value next to its `impl FormatPlugin`.
 ///
 /// ```no_run
-/// use forge_plugin_api::{Assets, Descriptor, RepositoryKind, Storage, UpstreamToken};
+/// use forge_plugin_api::{Assets, Descriptor, Prereleases, RepositoryKind, Storage, UpstreamToken};
 ///
 /// pub const DESCRIPTOR: Descriptor = Descriptor {
 ///     id: "example",
@@ -126,6 +126,9 @@ impl RepositoryKind {
 ///     storage: Storage::Packages,
 ///     assets: Assets::DEFAULT,
 ///     upstream_token: UpstreamToken::None,
+///     options: &[],
+///     prereleases: Prereleases::Dash,
+///     indexes: false,
 /// };
 /// ```
 ///
@@ -152,6 +155,56 @@ pub struct Descriptor {
     pub assets: Assets,
     /// What a proxy given a password and no username does with it.
     pub upstream_token: UpstreamToken,
+    /// Settings of the format's own that its repositories carry (apt's
+    /// distribution), each name once.
+    pub options: &'static [FormatOption],
+    /// Which versions the host's search filter takes for prereleases (hidden
+    /// unless a search asks for them). Retention asks
+    /// [`FormatPlugin::version_class`].
+    ///
+    /// [`FormatPlugin::version_class`]: crate::FormatPlugin::version_class
+    pub prereleases: Prereleases,
+    /// The host keeps signed indexes of the format's hosted repositories
+    /// ([`FormatPlugin::index`]), and an OpenPGP key per repository to sign
+    /// them with (apt). A package format only.
+    ///
+    /// [`FormatPlugin::index`]: crate::FormatPlugin::index
+    pub indexes: bool,
+}
+
+/// Which versions of a format are prereleases ([`Descriptor::prereleases`]).
+#[derive(Debug, Clone, Copy, Default, PartialEq, Eq)]
+pub enum Prereleases {
+    /// A normalized version with a `-` (SemVer's prerelease label: NuGet,
+    /// npm).
+    #[default]
+    Dash,
+    /// None: every version is a release (apt, where a `-` starts the
+    /// Debian revision).
+    None,
+}
+
+/// A setting of the format's own that a repository carries
+/// ([`Descriptor::options`]): a line of text an administrator sets when
+/// creating or editing the repository, checked by
+/// [`FormatPlugin::check_option`] and handed to the plugin with every
+/// request ([`Repository::options`]).
+///
+/// [`FormatPlugin::check_option`]: crate::FormatPlugin::check_option
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct FormatOption {
+    /// 1–32 lowercase letters, digits and `_`, starting with a letter.
+    pub name: &'static str,
+    /// What a form calls it.
+    pub label: &'static str,
+    /// One line on what it does.
+    pub description: &'static str,
+    /// The repository kinds that take it.
+    pub kinds: &'static [RepositoryKind],
+    /// Whether every repository of those kinds sets it.
+    pub required: bool,
+    /// An example value, for forms.
+    pub example: &'static str,
 }
 
 /// What a proxy given a password and no username sends its upstream
@@ -244,6 +297,22 @@ pub struct Repository {
     /// [`Action::ServeFile`] serves them. Always `false` for a package
     /// format.
     pub inline: bool,
+    /// The repository's settings of the format's own
+    /// ([`Descriptor::options`]), as [`FormatPlugin::check_option`] made
+    /// them: `(name, value)`, the ones it sets only.
+    ///
+    /// [`FormatPlugin::check_option`]: crate::FormatPlugin::check_option
+    pub options: Vec<(String, String)>,
+}
+
+impl Repository {
+    /// The value of option `name`, if the repository sets it.
+    pub fn option(&self, name: &str) -> Option<&str> {
+        self.options
+            .iter()
+            .find(|(k, _)| k == name)
+            .map(|(_, v)| v.as_str())
+    }
 }
 
 /// An HTTP request from a package client.
@@ -581,7 +650,10 @@ pub struct StoredFile {
 ///
 /// A package format asks for packages ([`Query::Versions`] …
 /// [`Query::Search`]), a files format for files ([`Query::File`] …
-/// [`Query::Remove`]): a query of the other kind fails the request.
+/// [`Query::Remove`]): a query of the other kind fails the request. A
+/// package format may read the files the host keeps for its repositories
+/// too ([`Query::File`], [`Query::FetchFile`], [`Query::Index`]): a hosted
+/// repository's indexes, a proxy's copies of its upstream's files.
 /// [`Query::Form`], [`Query::Store`] and [`Query::Remove`] change the
 /// repository: each is asked alone in its round, at most once per request
 /// for `Form` and `Store`, and only by a request authorized for them (write
@@ -637,6 +709,13 @@ pub enum Query {
     Store(Vec<NewFile>),
     /// Delete the file at a path.
     Remove(String),
+    /// A file of the repository's indexes (a format with
+    /// [`Descriptor::indexes`]), answered as [`Query::File`] once the host
+    /// has brought the indexes up to date with the repository's packages
+    /// and signing keys ([`FormatPlugin::index`]).
+    ///
+    /// [`FormatPlugin::index`]: crate::FormatPlugin::index
+    Index(String),
     /// What an images format asks of the image store ([`crate::images`]).
     Image(ImageQuery),
 }
@@ -667,8 +746,17 @@ impl Query {
                 | Query::Form
                 | Query::Store(_)
                 | Query::Remove(_)
+                | Query::Index(_)
         )
     }
+
+    /// Whether a package format may ask it: a package query, or reading a
+    /// file the host keeps for the repository.
+    pub fn is_for_packages(&self) -> bool {
+        !self.is_images()
+            && (!self.is_files()
+                || matches!(self, Query::File(_) | Query::FetchFile(_) | Query::Index(_)))
+    }
 }
 
 /// A name for one version of a package (npm's dist-tags: `latest`, `next`).
@@ -744,7 +832,8 @@ pub enum Answer {
     Search(SearchResult),
     /// The answer to [`Query::Tags`], by name.
     Tags(Vec<Tag>),
-    /// The answer to [`Query::File`] and to [`Query::FetchFile`].
+    /// The answer to [`Query::File`], [`Query::FetchFile`] and
+    /// [`Query::Index`].
     File(Option<FileInfo>),
     /// `None`: the directory does not exist (a directory other than the root
     /// without an entry the caller may see, asked for without `after`).
@@ -1023,6 +1112,27 @@ pub struct Remote {
     /// What [`UpstreamOp::Index`] answered for it (a JSON object of the
     /// plugin's own making); `None` while the index is being resolved.
     pub index: Option<String>,
+    /// The proxy repository's options ([`Repository::options`]).
+    pub options: Vec<(String, String)>,
+}
+
+impl Remote {
+    /// A remote at `url`, without an index or options.
+    pub fn new(url: impl Into<String>) -> Self {
+        Remote {
+            url: url.into(),
+            index: None,
+            options: Vec::new(),
+        }
+    }
+
+    /// The value of option `name`, if the repository sets it.
+    pub fn option(&self, name: &str) -> Option<&str> {
+        self.options
+            .iter()
+            .find(|(k, _)| k == name)
+            .map(|(_, v)| v.as_str())
+    }
 }
 
 /// What the host wants to know about the upstream.
@@ -1272,6 +1382,8 @@ pub enum UpstreamAnswer {
     /// The file's URL, on an origin a [`Fetch`] may reach; `None`: the
     /// upstream cannot have the path.
     File(Option<String>),
+    /// [`UpstreamAnswer::File`] with what the plugin knows of the file.
+    FileAt(FileLocation),
     /// The answer to [`UpstreamOp::ImageName`].
     ImageName(String),
     /// The answer to [`UpstreamOp::ImageManifest`] and
@@ -1290,6 +1402,108 @@ pub enum UpstreamAnswer {
     Failed(String),
 }
 
+/// Where an upstream keeps a file ([`UpstreamAnswer::FileAt`]), and what the
+/// plugin knows of it.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct FileLocation {
+    /// On an origin a [`Fetch`] may reach.
+    pub url: String,
+    /// The file never changes at its path (a package, a content-addressed
+    /// copy): the host keeps its copy without re-validating it.
+    pub immutable: bool,
+    /// The size the upstream's index gives the file: the host caches no
+    /// content of another size, and answers 502.
+    pub size: Option<u64>,
+    /// The SHA-256 (lowercase hex) the upstream's index gives the file:
+    /// the host caches no content of another digest, and answers 502.
+    pub sha256: Option<String>,
+}
+
+impl FileLocation {
+    /// A file at `url` the plugin knows nothing more of.
+    pub fn at(url: impl Into<String>) -> Self {
+        FileLocation {
+            url: url.into(),
+            immutable: false,
+            size: None,
+            sha256: None,
+        }
+    }
+}
+
+/// What a repository's indexes are made of ([`FormatPlugin::index`]).
+///
+/// [`FormatPlugin::index`]: crate::FormatPlugin::index
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct IndexInput {
+    /// Every listed version the repository holds (a group's: of its
+    /// members, the first member by priority for a version two hold), by
+    /// id, then version ascending.
+    pub packages: Vec<IndexedPackage>,
+    /// When the index is made: RFC 3339 in UTC.
+    pub generated: String,
+    /// The public keys that sign the index, as a binary OpenPGP keyring.
+    pub keyring: Vec<u8>,
+    /// The same keys, ASCII-armored in one block.
+    pub keyring_armored: String,
+}
+
+/// One version of an [`IndexInput`].
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct IndexedPackage {
+    /// Canonical.
+    pub id: String,
+    /// Normalized.
+    pub version: String,
+    pub version_original: String,
+    /// What [`FormatPlugin::manifest_summary`] returned at publish.
+    ///
+    /// [`FormatPlugin::manifest_summary`]: crate::FormatPlugin::manifest_summary
+    pub summary: Option<String>,
+    /// The package's size in bytes.
+    pub size: u64,
+    /// The package's SHA-256, lowercase hex.
+    pub sha256: String,
+    /// The package's SHA-512, base64.
+    pub sha512: Option<String>,
+    /// RFC 3339 in UTC.
+    pub published: Option<String>,
+}
+
+/// A file of a repository's indexes.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct IndexFile {
+    /// A path as [`crate::files`] requires.
+    pub path: String,
+    pub content: Vec<u8>,
+    /// `type/subtype`.
+    pub content_type: String,
+    /// Content-addressed (apt's `by-hash` copies): kept for a day after a
+    /// newer index stops naming it, for a client that read the older one.
+    /// Every other file of an older index is gone once a newer one is made.
+    pub immutable: bool,
+    /// The copies of this file the host signs with the repository's keys.
+    pub signed: Vec<SignedCopy>,
+}
+
+/// A signed copy of an [`IndexFile`], at its own path.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct SignedCopy {
+    pub path: String,
+    pub signature: SignatureKind,
+}
+
+/// How a [`SignedCopy`] is signed: with every signing key of the
+/// repository, so that a client trusting any one of them accepts it.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum SignatureKind {
+    /// The file inside an OpenPGP cleartext signature (apt's `InRelease`).
+    Cleartext,
+    /// An ASCII-armored detached OpenPGP signature of the file (apt's
+    /// `Release.gpg`).
+    Detached,
+}
+
 /// What a round of [`FormatPlugin::upstream`] produced.
 ///
 /// [`FormatPlugin::upstream`]: crate::FormatPlugin::upstream
diff --git a/crates/plugin/src/descriptor.rs b/crates/plugin/src/descriptor.rs
index 7ee52656..be3769f1 100644
--- a/crates/plugin/src/descriptor.rs
+++ b/crates/plugin/src/descriptor.rs
@@ -48,9 +48,45 @@ pub fn check_one(descriptor: &Descriptor) -> Result<(), String> {
     if let Some(kind) = twice {
         return Err(format!("format {id:?}: kind {kind:?} is listed twice"));
     }
+    if descriptor.indexes && descriptor.storage != Storage::Packages {
+        return Err(format!(
+            "format {id:?}: only a package format keeps indexes"
+        ));
+    }
+    validate_options(descriptor).map_err(|e| format!("format {id:?}: {e}"))?;
     validate_assets(&descriptor.assets).map_err(|e| format!("format {id:?}: {e}"))
 }
 
+/// Options have names of 1–32 lowercase letters, digits and `_` (starting
+/// with a letter), each once, and kinds the format serves.
+fn validate_options(descriptor: &Descriptor) -> Result<(), String> {
+    for (i, option) in descriptor.options.iter().enumerate() {
+        let name = option.name;
+        let well_formed = (1..=32).contains(&name.len())
+            && name.starts_with(|c: char| c.is_ascii_lowercase())
+            && name
+                .chars()
+                .all(|c| c.is_ascii_lowercase() || c.is_ascii_digit() || c == '_');
+        if !well_formed {
+            return Err(format!(
+                "option {name:?} must be 1-32 lowercase letters, digits or '_', starting with a letter"
+            ));
+        }
+        if descriptor.options[..i].iter().any(|o| o.name == name) {
+            return Err(format!("option {name:?} is listed twice"));
+        }
+        if option.kinds.is_empty() || option.kinds.iter().any(|k| !descriptor.kinds.contains(k)) {
+            return Err(format!(
+                "option {name:?} must name kinds of repositories the format serves"
+            ));
+        }
+        if option.label.trim().is_empty() {
+            return Err(format!("option {name:?} needs a label"));
+        }
+    }
+    Ok(())
+}
+
 /// A format id: 2–32 characters of lowercase ASCII letters, digits and `-`,
 /// starting with a letter, and not one of the reserved names.
 pub fn validate_id(id: &str) -> Result<(), String> {
@@ -122,6 +158,9 @@ mod tests {
         storage: Storage::Packages,
         assets: Assets::DEFAULT,
         upstream_token: UpstreamToken::None,
+        options: &[],
+        prereleases: forge_plugin_api::Prereleases::Dash,
+        indexes: false,
     };
 
     #[test]
@@ -157,6 +196,54 @@ mod tests {
         assert!(check(&[&unnamed]).is_err());
     }
 
+    #[test]
+    fn checks_options_and_indexes() {
+        use forge_plugin_api::FormatOption;
+        const OPTION: FormatOption = FormatOption {
+            name: "distribution",
+            label: "Distribution",
+            description: "",
+            kinds: &[RepositoryKind::Hosted],
+            required: true,
+            example: "bookworm",
+        };
+        let good = Descriptor {
+            options: &[OPTION],
+            indexes: true,
+            ..GOOD
+        };
+        assert_eq!(check(&[&good]), Ok(()));
+        for options in [
+            &[OPTION, OPTION][..],
+            &[FormatOption {
+                name: "Dist",
+                ..OPTION
+            }][..],
+            &[FormatOption { name: "", ..OPTION }][..],
+            &[FormatOption {
+                kinds: &[RepositoryKind::Proxy],
+                ..OPTION
+            }][..],
+            &[FormatOption {
+                kinds: &[],
+                ..OPTION
+            }][..],
+            &[FormatOption {
+                label: "",
+                ..OPTION
+            }][..],
+        ] {
+            let bad = Descriptor { options, ..GOOD };
+            assert!(check(&[&bad]).is_err(), "{options:?} accepted");
+        }
+        let files_with_indexes = Descriptor {
+            storage: Storage::Files,
+            indexes: true,
+            ..GOOD
+        };
+        assert!(check(&[&files_with_indexes]).is_err());
+    }
+
     #[test]
     fn refuses_two_formats_with_one_id() {
         let twin = Descriptor {
diff --git a/crates/plugin/src/format.rs b/crates/plugin/src/format.rs
index fca741d7..70828a7d 100644
--- a/crates/plugin/src/format.rs
+++ b/crates/plugin/src/format.rs
@@ -298,6 +298,10 @@ impl Format for PluginFormat {
         self.plugin.compare_versions(a, b)
     }
 
+    fn has_prereleases(&self) -> bool {
+        self.plugin.descriptor().prereleases != api::Prereleases::None
+    }
+
     fn lower_id(&self, id: &str) -> String {
         self.plugin.canonical_id(id)
     }
@@ -377,6 +381,9 @@ mod tests {
         storage: Storage::Packages,
         assets: Assets::DEFAULT,
         upstream_token: UpstreamToken::None,
+        options: &[],
+        prereleases: forge_plugin_api::Prereleases::Dash,
+        indexes: false,
     };
 
     impl FormatPlugin for Unlimited {
diff --git a/crates/server/Cargo.toml b/crates/server/Cargo.toml
index 1e4bdea0..b40bf757 100644
--- a/crates/server/Cargo.toml
+++ b/crates/server/Cargo.toml
@@ -25,6 +25,7 @@ forge-telemetry = { path = "../telemetry" }
 forge-traffic = { path = "../traffic" }
 # The built-in format plugins (crates/formats/docker, crates/formats/nuget,
 # crates/formats/npm, crates/formats/raw), linked in.
+forge-format-apt = { path = "../formats/apt" }
 forge-format-docker = { path = "../formats/docker" }
 forge-format-nuget = { path = "../formats/nuget" }
 forge-format-npm = { path = "../formats/npm" }
@@ -95,6 +96,12 @@ bytes = "1"
 uuid = { workspace = true }
 # Registry token signing key generation.
 rand = { workspace = true }
+# OpenPGP keys that sign apt repositories' indexes (rPGP, MIT/Apache-2.0;
+# Forge is also offered under the envisia license). Its default `bzip2`
+# feature (compressed messages) is not needed to sign. rPGP draws its
+# randomness through rand_core 0.6.
+pgp = { version = "0.21", default-features = false }
+rand_core_06 = { package = "rand_core", version = "0.6", features = ["getrandom"] }
 # Registry Bearer tokens (HS256), the same crate the OIDC verifier uses.
 jsonwebtoken = { workspace = true }
 # Outgoing email (invitations): SMTP submission.
diff --git a/crates/server/src/admin/crypto.rs b/crates/server/src/admin/crypto.rs
index d838fb8d..a6e91024 100644
--- a/crates/server/src/admin/crypto.rs
+++ b/crates/server/src/admin/crypto.rs
@@ -169,6 +169,10 @@ async fn rotate_locked(
                 Ok(n) => resealed += n,
                 Err(e) => return crypto_error(e),
             }
+            match forge_db::signing_key_dao::reseal(&state.pool, envelope).await {
+                Ok(n) => resealed += n,
+                Err(e) => return crypto_error(e),
+            }
             match secret_dao::reseal_import_passwords(&state.pool, envelope).await {
                 Ok(n) => resealed += n,
                 Err(e) => return crypto_error(e),
diff --git a/crates/server/src/admin/formats.rs b/crates/server/src/admin/formats.rs
index da32a3b0..092f7f72 100644
--- a/crates/server/src/admin/formats.rs
+++ b/crates/server/src/admin/formats.rs
@@ -1,5 +1,6 @@
 //! `GET /admin/formats` — the package formats this server can create
-//! repositories of: the format plugins (Docker / OCI, NuGet, raw files),
+//! repositories of: the format plugins (Docker / OCI, NuGet, npm, raw files,
+//! apt),
 //! each as its descriptor describes it.
 
 use axum::extract::State;
@@ -33,6 +34,25 @@ pub struct FormatView {
     /// The largest upload limit a repository may be given (what a push can
     /// stage); `None` when it is unbounded.
     pub max_upload_bytes_limit: Option<u64>,
+    /// The settings of the format's own its repositories carry
+    /// (`options` of a repository).
+    pub options: Vec<OptionView>,
+    /// Its hosted repositories keep indexes signed with keys of their own
+    /// (`/admin/repositories/{name}/signing-keys`): apt.
+    pub signed_indexes: bool,
+}
+
+/// A setting of a format's own.
+#[derive(Debug, Serialize)]
+pub struct OptionView {
+    pub name: &'static str,
+    pub label: &'static str,
+    pub description: &'static str,
+    /// The repository kinds that take it.
+    pub kinds: Vec<&'static str>,
+    /// Whether every repository of those kinds sets it.
+    pub required: bool,
+    pub example: &'static str,
 }
 
 /// `GET /admin/formats`: NuGet first, then the images formats (Docker),
@@ -51,6 +71,19 @@ pub async fn list(State(state): State<AppState>) -> Response {
             description: Some(descriptor.description.to_string()),
             default_max_upload_bytes: state.config.default_upload_limit(descriptor.storage),
             max_upload_bytes_limit: ceiling,
+            options: descriptor
+                .options
+                .iter()
+                .map(|option| OptionView {
+                    name: option.name,
+                    label: option.label,
+                    description: option.description,
+                    kinds: option.kinds.iter().map(|k| k.as_str()).collect(),
+                    required: option.required,
+                    example: option.example,
+                })
+                .collect(),
+            signed_indexes: descriptor.indexes,
         }
     };
     let mut plugins: Vec<_> = state.formats.plugins().collect();
diff --git a/crates/server/src/admin/mod.rs b/crates/server/src/admin/mod.rs
index b0c24ebb..625d865f 100644
--- a/crates/server/src/admin/mod.rs
+++ b/crates/server/src/admin/mod.rs
@@ -72,6 +72,7 @@ pub mod repositories;
 pub mod retention;
 pub mod roles;
 pub mod settings;
+pub mod signing_keys;
 pub mod token_scope;
 pub mod tokens;
 pub mod traffic;
@@ -230,6 +231,14 @@ pub fn admin_router(state: AppState) -> Router<AppState> {
             "/repositories/{name}/proxy-cache/invalidate",
             axum::routing::post(proxy_cache::invalidate),
         )
+        .route(
+            "/repositories/{name}/signing-keys",
+            get(signing_keys::list).post(signing_keys::add),
+        )
+        .route(
+            "/repositories/{name}/signing-keys/{fingerprint}",
+            axum::routing::delete(signing_keys::delete),
+        )
         .route(
             "/repositories/{name}/imports",
             get(imports::list).post(imports::create),
diff --git a/crates/server/src/admin/proxy_cache.rs b/crates/server/src/admin/proxy_cache.rs
index 0558bdb2..8b805d18 100644
--- a/crates/server/src/admin/proxy_cache.rs
+++ b/crates/server/src/admin/proxy_cache.rs
@@ -19,7 +19,9 @@
 //!   service index) due for a refresh. The previous index stays the fallback
 //!   while the upstream is unreachable;
 //! * a docker proxy's cached tags are re-validated on their next pull;
-//! * a raw proxy's cached files are re-validated on their next download.
+//! * a raw proxy's cached files are re-validated on their next download, and
+//!   so are the upstream's indexes an apt proxy keeps (its packages and
+//!   `by-hash` copies never change).
 //!
 //! What stays: downloaded packages, blobs and digest-addressed manifests
 //! (removing those is retention's job), the versions the upstream listed and
@@ -61,7 +63,7 @@ pub struct Invalidated {
     pub not_found_cleared: u64,
     /// Tags due for re-validation (docker proxies).
     pub tags_expired: u64,
-    /// Cached files due for re-validation (raw proxies only).
+    /// Cached files due for re-validation (raw proxies, and apt's indexes).
     #[serde(skip_serializing_if = "Option::is_none")]
     pub files_expired: Option<u64>,
 }
@@ -178,6 +180,12 @@ async fn forget(
             proxy_dao::clear_not_found(&mut tx, repo.id, package).await?;
         if package.is_none() {
             proxy_dao::expire_upstream_index(&mut tx, repo.id).await?;
+            // The upstream's files a package format's proxy keeps (apt's
+            // indexes); the ones that never change stay as they are.
+            let expired = raw_dao::expire_checks(&mut *tx, repo.id, "").await?;
+            if expired > 0 {
+                invalidated.files_expired = Some(expired);
+            }
         }
     }
     if !repository_dao::touch_repository(&mut *tx, repo.id).await? {
diff --git a/crates/server/src/admin/repositories.rs b/crates/server/src/admin/repositories.rs
index 1848af8a..8503c477 100644
--- a/crates/server/src/admin/repositories.rs
+++ b/crates/server/src/admin/repositories.rs
@@ -14,7 +14,7 @@
 //! `/repositories/{name}`), so they are validated on create and rename (see
 //! [`validate_repo_name`]).
 
-use std::collections::HashMap;
+use std::collections::{BTreeMap, HashMap};
 
 use axum::extract::{Path, State};
 use axum::http::StatusCode;
@@ -23,9 +23,9 @@ use forge_core::format::Format;
 use forge_core::net::ssrf::validate_url;
 use forge_db::model::{
     DeploymentPolicy, RepoKind, Repository, CONTENT_DISPOSITION_KEY, DEPLOYMENT_POLICY_KEY,
-    DOCKER_HOST_KEY, IMMUTABLE_TAGS_KEY, LATEST_MUTABLE_KEY, MAX_AGE_SECONDS_KEY,
-    MAX_UPLOAD_BYTES_KEY, NUGET_FORMAT, PREFER_HOSTED_KEY, RESERVED_PREFIXES_KEY,
-    WRITABLE_MEMBER_ID_KEY,
+    DOCKER_HOST_KEY, FORMAT_OPTIONS_KEY, IMMUTABLE_TAGS_KEY, LATEST_MUTABLE_KEY,
+    MAX_AGE_SECONDS_KEY, MAX_UPLOAD_BYTES_KEY, NUGET_FORMAT, PREFER_HOSTED_KEY,
+    RESERVED_PREFIXES_KEY, WRITABLE_MEMBER_ID_KEY,
 };
 use forge_db::repository_dao::{self, NewRepository, RepositoryUpdate};
 use forge_db::{component_dao, oci_dao, raw_dao};
@@ -85,6 +85,9 @@ pub struct RepoView {
     /// What the repository holds: `packages`, `files` (a files format: raw)
     /// or `images` (Docker).
     pub storage: &'static str,
+    /// The settings of its format's own (`GET /admin/formats` lists them):
+    /// apt's `distribution`.
+    pub options: BTreeMap<String, String>,
 }
 
 impl RepoView {
@@ -127,6 +130,7 @@ impl RepoView {
             max_age_seconds: (stores_files && r.kind() == RepoKind::Proxy)
                 .then(|| r.max_age_seconds()),
             storage: storage.as_str(),
+            options: r.format_options().into_iter().collect(),
         }
     }
 }
@@ -207,6 +211,10 @@ pub struct CreateRepo {
     /// never). Absent: a day.
     #[serde(default)]
     pub max_age_seconds: Option<u64>,
+    /// Settings of the format's own, by name (`GET /admin/formats` lists
+    /// each format's): apt's `distribution`, which apt repositories need.
+    #[serde(default)]
+    pub options: Option<BTreeMap<String, String>>,
 }
 
 /// Update-repository request body (`PUT /admin/repositories/{name}`).
@@ -282,6 +290,10 @@ pub struct UpdateRepo {
     /// Raw proxy only; `null` clears it (a day).
     #[serde(default, deserialize_with = "double_option")]
     pub max_age_seconds: Option<Option<u64>>,
+    /// Settings of the format's own: each one given is set, `null` clears
+    /// one that is not required; the others are kept.
+    #[serde(default)]
+    pub options: Option<BTreeMap<String, Option<String>>>,
 }
 
 /// Update response: the [`RepoView`] plus whether this update dropped the
@@ -639,6 +651,11 @@ pub async fn create(State(state): State<AppState>, Json(body): Json<CreateRepo>)
     if images && body.package_delay_seconds != 0 {
         return bad_request("package_delay_seconds is not supported for docker repositories");
     }
+    if keeps_signed_indexes(&state, &body.format) && body.package_delay_seconds != 0 {
+        return bad_request(
+            "package_delay_seconds is not supported for apt repositories: a proxy passes its upstream's signed indexes on as they are",
+        );
+    }
     if images && body.allow_redeploy {
         return bad_request(
             "allow_redeploy is a NuGet option; docker tags move unless immutable_tags is set",
@@ -736,6 +753,21 @@ pub async fn create(State(state): State<AppState>, Json(body): Json<CreateRepo>)
             config[RESERVED_PREFIXES_KEY] = json!(prefixes);
         }
     }
+    let given = body
+        .options
+        .clone()
+        .map(|options| options.into_iter().map(|(k, v)| (k, Some(v))).collect());
+    match format_options(
+        &state,
+        &body.format,
+        parsed_kind,
+        &serde_json::Map::new(),
+        given,
+    ) {
+        Ok(options) if options.is_empty() => {}
+        Ok(options) => config[FORMAT_OPTIONS_KEY] = serde_json::Value::Object(options),
+        Err(resp) => return resp,
+    }
 
     // The row is created first (the AAD binds the sealed password to the row
     // id, which does not exist before the INSERT) and the password is sealed
@@ -789,6 +821,13 @@ pub async fn create(State(state): State<AppState>, Json(body): Json<CreateRepo>)
     if let Err(e) = tx.commit().await {
         return db_error(e);
     }
+    // A repository that keeps signed indexes (apt) gets its first key now,
+    // so that its key is there to download before its first index.
+    if crate::indexes::keeps_indexes(&state, &repo) {
+        if let Err(e) = crate::indexes::keys(&state, &repo).await {
+            tracing::error!(repo = %repo.name, error = %e, "the repository's signing key could not be made; it is made with its first index");
+        }
+    }
     // Re-fetched so the view reflects the sealed secret.
     let repo = if sealed {
         match repository_dao::find_repository_by_id(&state.pool, repo.id).await {
@@ -805,6 +844,81 @@ pub async fn create(State(state): State<AppState>, Json(body): Json<CreateRepo>)
     }
 }
 
+/// Whether `format` keeps signed indexes (apt): its proxies pass their
+/// upstream's indexes on, so they have no package delay.
+fn keeps_signed_indexes(state: &AppState, format: &str) -> bool {
+    state
+        .formats
+        .plugin(format)
+        .is_some_and(|plugin| plugin.descriptor().indexes)
+}
+
+/// The settings of a format's own of a repository of `format` and `kind`
+/// (`config.options`): `given` checked by the format's plugin and merged into
+/// `existing` (a `None` value clears one), every option the kind requires
+/// set. Returns the options to store.
+#[allow(clippy::result_large_err)]
+fn format_options(
+    state: &AppState,
+    format: &str,
+    kind: RepoKind,
+    existing: &serde_json::Map<String, serde_json::Value>,
+    given: Option<BTreeMap<String, Option<String>>>,
+) -> Result<serde_json::Map<String, serde_json::Value>, Response> {
+    let plugin = state.formats.plugin(format);
+    let declared = plugin
+        .as_ref()
+        .map(|p| p.descriptor().options)
+        .unwrap_or(&[]);
+    let api_kind = match kind {
+        RepoKind::Hosted => forge_plugin::api::RepositoryKind::Hosted,
+        RepoKind::Proxy => forge_plugin::api::RepositoryKind::Proxy,
+        RepoKind::Group => forge_plugin::api::RepositoryKind::Group,
+    };
+    let mut options = existing.clone();
+    for (name, value) in given.unwrap_or_default() {
+        let Some(option) = declared.iter().find(|o| o.name == name) else {
+            return Err(bad_request(format!(
+                "format {format} has no option {name:?}"
+            )));
+        };
+        if !option.kinds.contains(&api_kind) {
+            return Err(bad_request(format!(
+                "option {name:?} is not valid for {} repositories",
+                kind.as_str()
+            )));
+        }
+        match value {
+            None => {
+                options.remove(&name);
+            }
+            Some(value) => {
+                let implementation = plugin.as_ref().map(|p| p.implementation().clone());
+                let checked = match implementation {
+                    Some(plugin) => plugin.check_option(api_kind, &name, &value),
+                    None => Ok(value),
+                };
+                match checked {
+                    Ok(value) => {
+                        options.insert(name, serde_json::Value::String(value));
+                    }
+                    Err(e) => return Err(bad_request(format!("{}: {e}", option.label))),
+                }
+            }
+        }
+    }
+    for option in declared {
+        if option.required && option.kinds.contains(&api_kind) && !options.contains_key(option.name)
+        {
+            return Err(bad_request(format!(
+                "{} repositories need the option {:?} ({}), e.g. {:?}",
+                format, option.name, option.label, option.example
+            )));
+        }
+    }
+    Ok(options)
+}
+
 /// The docker options of a create or update request (`None`: not sent;
 /// `Some(None)`: cleared).
 struct DockerOptions {
@@ -1131,6 +1245,13 @@ pub async fn update(
     if images && body.package_delay_seconds.is_some_and(|d| d != 0) {
         return bad_request("package_delay_seconds is not supported for docker repositories");
     }
+    if keeps_signed_indexes(&state, &existing.format)
+        && body.package_delay_seconds.is_some_and(|d| d != 0)
+    {
+        return bad_request(
+            "package_delay_seconds is not supported for apt repositories: a proxy passes its upstream's signed indexes on as they are",
+        );
+    }
     if images && body.allow_redeploy == Some(true) {
         return bad_request(
             "allow_redeploy is a NuGet option; docker tags move unless immutable_tags is set",
@@ -1241,6 +1362,39 @@ pub async fn update(
         None => {}
     }
 
+    if let Some(given) = body.options.clone() {
+        let stored = existing
+            .config
+            .get(FORMAT_OPTIONS_KEY)
+            .and_then(|v| v.as_object())
+            .cloned()
+            .unwrap_or_default();
+        match format_options(
+            &state,
+            &existing.format,
+            existing.kind(),
+            &stored,
+            Some(given),
+        ) {
+            Ok(options) => {
+                if !config.is_object() {
+                    config = json!({});
+                }
+                if let Some(map) = config.as_object_mut() {
+                    if options.is_empty() {
+                        map.remove(FORMAT_OPTIONS_KEY);
+                    } else {
+                        map.insert(
+                            FORMAT_OPTIONS_KEY.into(),
+                            serde_json::Value::Object(options),
+                        );
+                    }
+                }
+            }
+            Err(resp) => return resp,
+        }
+    }
+
     // Stored credentials belong to the upstream origin they were entered for:
     // repointing the proxy elsewhere without a new password drops them.
     let drop_credentials = body
@@ -1453,7 +1607,8 @@ pub async fn delete(State(state): State<AppState>, Path(name): Path<String>) ->
         Err(e) => return db_error(e),
     };
     let grace = state.config.outbox.grace();
-    match delete_repository_locked(&state, existing.id, existing.kind(), grace).await {
+    let stores_files = state.formats.stores_files(&existing.format);
+    match delete_repository_locked(&state, existing.id, existing.kind(), stores_files, grace).await {
         Ok(RepoDelete::Deleted) => StatusCode::NO_CONTENT.into_response(),
         Ok(RepoDelete::NotFound) => (StatusCode::NOT_FOUND, "repository not found").into_response(),
         Ok(RepoDelete::HasPackages) if state.formats.stores_images(&existing.format) => (
@@ -1501,6 +1656,7 @@ async fn delete_repository_locked(
     state: &AppState,
     repo_id: i64,
     kind: RepoKind,
+    stores_files: bool,
     grace: chrono::Duration,
 ) -> sqlx::Result<RepoDelete> {
     // A proxy delete locks its cached versions before the repository row,
@@ -1510,7 +1666,7 @@ async fn delete_repository_locked(
     // whole transaction rolled back, so retrying the delete is safe.
     let mut attempt = 0;
     loop {
-        match delete_repository_once(state, repo_id, kind, grace).await {
+        match delete_repository_once(state, repo_id, kind, stores_files, grace).await {
             Err(sqlx::Error::Database(db))
                 if db.code().as_deref() == Some("40P01") && attempt < 3 =>
             {
@@ -1526,6 +1682,7 @@ async fn delete_repository_once(
     state: &AppState,
     repo_id: i64,
     kind: RepoKind,
+    stores_files: bool,
     grace: chrono::Duration,
 ) -> sqlx::Result<RepoDelete> {
     let mut tx = forge_db::begin(&state.pool).await?;
@@ -1545,10 +1702,11 @@ async fn delete_repository_once(
     if kind == RepoKind::Hosted {
         // Hosted repos may still own (non-reproducible) components or image
         // manifests; require them gone first so the deletion is an explicit
-        // admin action.
+        // admin action. A package repository's files are its indexes, made
+        // of its packages again whenever they are needed.
         if component_dao::repository_has_components(&mut *tx, repo_id).await?
             || oci_dao::repository_has_images(&mut *tx, repo_id).await?
-            || raw_dao::repository_has_files(&mut *tx, repo_id).await?
+            || (stores_files && raw_dao::repository_has_files(&mut *tx, repo_id).await?)
         {
             return Ok(RepoDelete::HasPackages);
         }
diff --git a/crates/server/src/admin/signing_keys.rs b/crates/server/src/admin/signing_keys.rs
new file mode 100644
index 00000000..5bcbc9b0
--- /dev/null
+++ b/crates/server/src/admin/signing_keys.rs
@@ -0,0 +1,186 @@
+//! The OpenPGP keys that sign a repository's indexes (a hosted repository of
+//! a format that keeps signed indexes: apt).
+//!
+//! * `GET /admin/repositories/{name}/signing-keys` — the keys, oldest first,
+//!   each with its fingerprint, algorithm, user id and ASCII-armored public
+//!   key ([`KeyView`]). A repository without one gets one first.
+//! * `POST /admin/repositories/{name}/signing-keys` — add a key: `{}` (or
+//!   `{"generate": true}`) generates an Ed25519 key, `{"secret_key":
+//!   "<ASCII-armored secret key>", "passphrase": "…"}` imports one (its
+//!   passphrase is removed: the key is kept sealed by the secret encryption,
+//!   and never returned). 201 with the new key; 409 when the repository has
+//!   it already.
+//! * `DELETE /admin/repositories/{name}/signing-keys/{fingerprint}` — remove
+//!   a key; 409 for a repository's last key.
+//!
+//! Every key of a repository signs its indexes, so a rotation is: add the
+//! new key, let clients trust it (its public key is in the repository's
+//! `key.asc` with the old one), then delete the old key.
+
+use axum::extract::{Path, State};
+use axum::http::StatusCode;
+use axum::response::{IntoResponse, Json, Response};
+use forge_db::model::Repository;
+use forge_db::{repository_dao, signing_key_dao};
+use serde::{Deserialize, Serialize};
+
+use super::db_error;
+use crate::indexes::{self, signing::Key};
+use crate::state::AppState;
+
+/// What is shown of a key; its secret never is.
+#[derive(Debug, Serialize)]
+pub struct KeyView {
+    pub fingerprint: String,
+    pub algorithm: String,
+    pub user_id: String,
+    pub public_key: String,
+    pub created_at: chrono::DateTime<chrono::Utc>,
+}
+
+impl From<signing_key_dao::SigningKeyRow> for KeyView {
+    fn from(row: signing_key_dao::SigningKeyRow) -> Self {
+        KeyView {
+            fingerprint: row.fingerprint,
+            algorithm: row.algorithm,
+            user_id: row.user_id,
+            public_key: row.public_key,
+            created_at: row.created_at,
+        }
+    }
+}
+
+/// Body of `POST …/signing-keys`.
+#[derive(Debug, Default, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct AddKey {
+    /// Generate a key (the default when no `secret_key` is given).
+    #[serde(default)]
+    pub generate: Option<bool>,
+    /// An ASCII-armored OpenPGP secret key to import.
+    #[serde(default)]
+    pub secret_key: Option<String>,
+    /// The imported key's passphrase, if it has one.
+    #[serde(default)]
+    pub passphrase: Option<String>,
+}
+
+fn problem(status: StatusCode, message: impl Into<String>) -> Response {
+    (status, message.into()).into_response()
+}
+
+fn index_error(e: indexes::IndexError) -> Response {
+    match e {
+        indexes::IndexError::Unavailable(m) => problem(StatusCode::SERVICE_UNAVAILABLE, m),
+        indexes::IndexError::Internal(m) => {
+            tracing::error!(error = %m, "signing keys failed");
+            problem(StatusCode::INTERNAL_SERVER_ERROR, "internal error")
+        }
+    }
+}
+
+/// The repository `name`, if it keeps signed indexes.
+async fn repository(state: &AppState, name: &str) -> Result<Repository, Response> {
+    match repository_dao::find_repository_by_name(&state.pool, name).await {
+        Ok(Some(repo)) if indexes::keeps_indexes(state, &repo) => Ok(repo),
+        Ok(Some(_)) => Err(problem(
+            StatusCode::BAD_REQUEST,
+            "only a hosted repository of a format with signed indexes (apt) has signing keys",
+        )),
+        Ok(None) => Err(problem(StatusCode::NOT_FOUND, "repository not found")),
+        Err(e) => Err(db_error(e)),
+    }
+}
+
+/// `GET /admin/repositories/{name}/signing-keys`
+pub async fn list(State(state): State<AppState>, Path(name): Path<String>) -> Response {
+    let repo = match repository(&state, &name).await {
+        Ok(repo) => repo,
+        Err(resp) => return resp,
+    };
+    match indexes::keys(&state, &repo).await {
+        Ok(keys) => Json(keys.into_iter().map(KeyView::from).collect::<Vec<_>>()).into_response(),
+        Err(e) => index_error(e),
+    }
+}
+
+/// `POST /admin/repositories/{name}/signing-keys`
+pub async fn add(
+    State(state): State<AppState>,
+    Path(name): Path<String>,
+    body: Option<Json<AddKey>>,
+) -> Response {
+    let repo = match repository(&state, &name).await {
+        Ok(repo) => repo,
+        Err(resp) => return resp,
+    };
+    let body = body.map(|b| b.0).unwrap_or_default();
+    let added = match (body.secret_key, body.generate) {
+        (Some(_), Some(true)) => {
+            return problem(
+                StatusCode::BAD_REQUEST,
+                "either generate a key or import secret_key, not both",
+            )
+        }
+        (Some(armored), _) => {
+            let passphrase = body.passphrase;
+            let imported =
+                tokio::task::spawn_blocking(move || Key::import(&armored, passphrase.as_deref()))
+                    .await;
+            let key = match imported {
+                Ok(Ok(key)) => key,
+                Ok(Err(e)) => return problem(StatusCode::BAD_REQUEST, e.to_string()),
+                Err(e) => return index_error(indexes::IndexError::Internal(e.to_string())),
+            };
+            match indexes::add_key(&state, &repo, &key).await {
+                Ok(Some(info)) => info.fingerprint,
+                Ok(None) => {
+                    return problem(StatusCode::CONFLICT, "the repository has this key already")
+                }
+                Err(e) => return index_error(e),
+            }
+        }
+        (None, Some(false)) => {
+            return problem(
+                StatusCode::BAD_REQUEST,
+                "give secret_key to import a key, or generate one",
+            )
+        }
+        (None, _) => match indexes::generate_key(&state, &repo).await {
+            Ok(info) => info.fingerprint,
+            Err(e) => return index_error(e),
+        },
+    };
+    tracing::info!(target: "forge::audit", repo = %repo.name, fingerprint = %added, "signing key added");
+    match signing_key_dao::list(&state.pool, repo.id).await {
+        Ok(keys) => match keys.into_iter().find(|k| k.fingerprint == added) {
+            Some(key) => (StatusCode::CREATED, Json(KeyView::from(key))).into_response(),
+            None => problem(StatusCode::CONFLICT, "the key was removed meanwhile"),
+        },
+        Err(e) => db_error(e),
+    }
+}
+
+/// `DELETE /admin/repositories/{name}/signing-keys/{fingerprint}`
+pub async fn delete(
+    State(state): State<AppState>,
+    Path((name, fingerprint)): Path<(String, String)>,
+) -> Response {
+    let repo = match repository(&state, &name).await {
+        Ok(repo) => repo,
+        Err(resp) => return resp,
+    };
+    let fingerprint = fingerprint.to_ascii_uppercase();
+    match signing_key_dao::delete(&state.pool, repo.id, &fingerprint).await {
+        Ok(Some(true)) => {
+            tracing::info!(target: "forge::audit", repo = %repo.name, %fingerprint, "signing key deleted");
+            StatusCode::NO_CONTENT.into_response()
+        }
+        Ok(Some(false)) => problem(
+            StatusCode::CONFLICT,
+            "a repository keeps at least one signing key: add the new key before deleting the last",
+        ),
+        Ok(None) => problem(StatusCode::NOT_FOUND, "no such key"),
+        Err(e) => db_error(e),
+    }
+}
diff --git a/crates/server/src/browse.rs b/crates/server/src/browse.rs
index 19b84d64..acb538f5 100644
--- a/crates/server/src/browse.rs
+++ b/crates/server/src/browse.rs
@@ -100,6 +100,9 @@ pub struct BrowseRepo {
     /// What the repository holds: `packages`, `files` (a files format: raw,
     /// browsed through its listings) or `images` (docker).
     pub storage: &'static str,
+    /// The settings of its format's own (apt's `distribution`), for the
+    /// connect snippets.
+    pub options: std::collections::BTreeMap<String, String>,
 }
 
 /// Query parameters for `GET /browse/repos`.
@@ -149,6 +152,7 @@ pub async fn list_repos(
                     .filter(|plugin| plugin.descriptor().storage != Storage::Images)
                     .map(|_| crate::plugins::repository_url(&state, &repo.name)),
                 storage: state.storage(&repo.format).as_str(),
+                options: repo.format_options().into_iter().collect(),
             });
         }
     }
@@ -293,7 +297,8 @@ pub async fn search_packages(
             q: query.q.clone(),
             skip,
             take,
-            prerelease: query.prerelease,
+            // A format without prereleases (apt) shows every version.
+            prerelease: query.prerelease || !format.has_prereleases(),
             // The web UI shows every version; only legacy NuGet clients
             // need SemVer 2.0.0 hidden.
             include_semver2: true,
diff --git a/crates/server/src/crypto.rs b/crates/server/src/crypto.rs
index 0997e08b..094d9431 100644
--- a/crates/server/src/crypto.rs
+++ b/crates/server/src/crypto.rs
@@ -234,6 +234,7 @@ async fn reseal_all(
     resealed += secret_dao::reseal_secret_settings(pool, envelope).await?;
     resealed += secret_dao::reseal_import_passwords(pool, envelope).await?;
     resealed += secret_dao::reseal_email_secrets(pool, envelope).await?;
+    resealed += forge_db::signing_key_dao::reseal(pool, envelope).await?;
     Ok(resealed)
 }
 
diff --git a/crates/server/src/files/mod.rs b/crates/server/src/files/mod.rs
index 1102431d..72afc812 100644
--- a/crates/server/src/files/mod.rs
+++ b/crates/server/src/files/mod.rs
@@ -192,6 +192,36 @@ impl Files<'_> {
         })
     }
 
+    /// A file the host keeps for a repository of a package format (apt): a
+    /// hosted repository's index file, or a proxy's copy of an upstream
+    /// file (re-validated once it is due, else with `fetch` fetched). The
+    /// caller's package selector decides on `package`, the package the file
+    /// belongs to; a file of no package (an index) is every reader's. A
+    /// group keeps no files.
+    pub async fn locate_kept(
+        &self,
+        repo: &Repository,
+        path: &str,
+        package: Option<&str>,
+        fetch: bool,
+    ) -> Result<Option<RawFile>, FileError> {
+        if let Some(package) = package {
+            let filter = self.state.authz.package_filter(&self.principal, repo).await;
+            if !filter.allows(package) {
+                return Ok(None);
+            }
+        }
+        match repo.kind() {
+            RepoKind::Hosted => Ok(raw_dao::find(&self.state.pool, repo.id, path).await?),
+            RepoKind::Proxy => match raw_dao::find(&self.state.pool, repo.id, path).await? {
+                Some(file) => Ok(Some(self.fresh(repo, file).await)),
+                None if fetch => self.fetch(repo, path).await,
+                None => Ok(None),
+            },
+            RepoKind::Group => Ok(None),
+        }
+    }
+
     /// The members of `group` that may serve the caller, highest priority
     /// first: repositories of the group's format the caller may read itself
     /// (reading a group grants nothing on its members), without offline hosted or group
diff --git a/crates/server/src/files/proxy.rs b/crates/server/src/files/proxy.rs
index 802cfaab..36c95bcc 100644
--- a/crates/server/src/files/proxy.rs
+++ b/crates/server/src/files/proxy.rs
@@ -26,10 +26,13 @@ use std::time::Duration;
 
 use axum::http::StatusCode;
 use forge_core::net::upstream::{RequestClass, UpstreamAuth};
-use forge_core::repo::proxy::{upstream_credentials, Credentials, DEFAULT_NOT_FOUND_TTL_SECONDS};
+use forge_core::repo::proxy::{
+    upstream_credentials, Credentials, DEFAULT_METADATA_TTL_SECONDS, DEFAULT_NOT_FOUND_TTL_SECONDS,
+};
 use forge_db::model::Repository;
 use forge_db::oci_dao;
 use forge_db::raw_dao::{self, NewRawFile, RawFile, Redeploy};
+use forge_plugin::api::FileLocation;
 use forge_telemetry::proxy::{Kind as LookupKind, Lookup, Outcome};
 use futures_util::TryStreamExt;
 use reqwest::header::{CONTENT_TYPE, ETAG, IF_MODIFIED_SINCE, IF_NONE_MATCH, LAST_MODIFIED};
@@ -122,13 +125,13 @@ impl Files<'_> {
             .map_err(|e| FileError::Internal(format!("proxy credentials: {e}")))
     }
 
-    /// The upstream URL of `path`, as the format's plugin names it; `None`
-    /// when the upstream cannot have it.
-    async fn upstream_url(
+    /// Where the upstream keeps `path`, as the format's plugin names it;
+    /// `None` when the upstream cannot have it.
+    async fn upstream_location(
         &self,
         repo: &Repository,
         path: &str,
-    ) -> Result<Option<String>, FileError> {
+    ) -> Result<Option<FileLocation>, FileError> {
         let format = self
             .state
             .formats
@@ -185,11 +188,13 @@ impl Files<'_> {
             })
     }
 
-    /// Cache a successful upstream response as `path`.
+    /// Cache a successful upstream response as `path`, unless it is not the
+    /// size and digest `location` gives it.
     async fn store_response(
         &self,
         repo: &Repository,
         path: &str,
+        location: &FileLocation,
         response: reqwest::Response,
     ) -> Result<RawFile, FileError> {
         let limit = self.state.upstream.config().max_package_bytes;
@@ -214,6 +219,25 @@ impl Files<'_> {
         })?;
         let stored = &ingested.stored;
         forge_telemetry::proxy::upstream_bytes(&repo.name, stored.size);
+        let wrong_size = location.size.is_some_and(|size| size != stored.size);
+        let wrong_digest = location
+            .sha256
+            .as_deref()
+            .is_some_and(|sha256| !sha256.eq_ignore_ascii_case(&stored.sha256));
+        if wrong_size || wrong_digest {
+            tracing::warn!(
+                repo = %repo.name,
+                %path,
+                size = stored.size,
+                sha256 = %stored.sha256,
+                expected_size = ?location.size,
+                expected_sha256 = ?location.sha256,
+                "file proxy: the upstream's file is not the one its index names; not cached"
+            );
+            return Err(FileError::BadGateway(
+                "the upstream's file does not match the size and digest its index gives it".into(),
+            ));
+        }
         let content_type = content_type(declared.as_deref(), path);
         let mut tx = forge_db::begin(&self.state.pool).await?;
         if !oci_dao::lock_proxy_upstream(&mut tx, repo.id, repo.remote_url.as_deref()).await? {
@@ -235,6 +259,7 @@ impl Files<'_> {
                 upstream_etag: etag.as_deref(),
                 upstream_last_modified: last_modified.as_deref(),
                 checked: true,
+                immutable: location.immutable,
             },
             stored.ingest_token,
             Redeploy::Allow,
@@ -262,8 +287,8 @@ impl Files<'_> {
 
     /// [`Self::fresh`], marking what it does on `lookup`.
     async fn fresh_file(&self, repo: &Repository, file: RawFile, lookup: &mut Lookup) -> RawFile {
-        let max_age = repo.max_age_seconds();
-        if max_age == 0 || !repo.online || !is_due(&file, max_age) {
+        let max_age = self.max_age(repo);
+        if file.immutable || max_age == 0 || !repo.online || !is_due(&file, max_age) {
             return file;
         }
         let gate = gate(repo.id, &file.path);
@@ -284,19 +309,32 @@ impl Files<'_> {
         }
     }
 
+    /// How long a proxy's cached copy is served before it is re-validated:
+    /// a files format's `max_age_seconds`, a package format's metadata TTL.
+    fn max_age(&self, repo: &Repository) -> u64 {
+        if self.state.formats.stores_files(&repo.format) {
+            repo.max_age_seconds()
+        } else {
+            repo.metadata_ttl_seconds
+                .map(i64::from)
+                .unwrap_or(DEFAULT_METADATA_TTL_SECONDS)
+                .max(0) as u64
+        }
+    }
+
     async fn revalidate(
         &self,
         repo: &Repository,
         file: &RawFile,
         lookup: &mut Lookup,
     ) -> Result<RawFile, FileError> {
-        let Some(url) = self.upstream_url(repo, &file.path).await? else {
+        let Some(location) = self.upstream_location(repo, &file.path).await? else {
             // The upstream cannot have it (any more): the cached copy stands.
             raw_dao::mark_checked(&self.state.pool, file.id, None, None).await?;
             return Ok(file.clone());
         };
         let response = self
-            .upstream_get(repo, &file.path, &url, Some(file))
+            .upstream_get(repo, &file.path, &location.url, Some(file))
             .await?;
         let status = response.status();
         if status == StatusCode::NOT_MODIFIED {
@@ -312,7 +350,9 @@ impl Files<'_> {
         }
         if status.is_success() {
             lookup.mark(Outcome::Fetched);
-            return self.store_response(repo, &file.path, response).await;
+            return self
+                .store_response(repo, &file.path, &location, response)
+                .await;
         }
         if matches!(status, StatusCode::NOT_FOUND | StatusCode::GONE) {
             lookup.mark(Outcome::StaleServed);
@@ -369,11 +409,11 @@ impl Files<'_> {
             lookup.mark(Outcome::NegativeCached);
             return Ok(None);
         }
-        let Some(url) = self.upstream_url(repo, path).await? else {
+        let Some(location) = self.upstream_location(repo, path).await? else {
             self.remember_not_found(repo, path).await;
             return Ok(None);
         };
-        let response = self.upstream_get(repo, path, &url, None).await?;
+        let response = self.upstream_get(repo, path, &location.url, None).await?;
         let status = response.status();
         if matches!(status, StatusCode::NOT_FOUND | StatusCode::GONE) {
             self.remember_not_found(repo, path).await;
@@ -386,7 +426,9 @@ impl Files<'_> {
             )));
         }
         lookup.mark(Outcome::Fetched);
-        self.store_response(repo, path, response).await.map(Some)
+        self.store_response(repo, path, &location, response)
+            .await
+            .map(Some)
     }
 }
 
diff --git a/crates/server/src/files/serve.rs b/crates/server/src/files/serve.rs
index e22cd3c2..b1b8de43 100644
--- a/crates/server/src/files/serve.rs
+++ b/crates/server/src/files/serve.rs
@@ -223,6 +223,7 @@ mod tests {
             upstream_etag: None,
             upstream_last_modified: None,
             checked_at: None,
+            immutable: false,
         }
     }
 
diff --git a/crates/server/src/files/store.rs b/crates/server/src/files/store.rs
index 5298b1f0..9440b622 100644
--- a/crates/server/src/files/store.rs
+++ b/crates/server/src/files/store.rs
@@ -354,6 +354,7 @@ async fn record_all(
             upstream_etag: None,
             upstream_last_modified: None,
             checked: false,
+            immutable: false,
         };
         let redeploy = if replaceable {
             Redeploy::Allow
@@ -692,6 +693,7 @@ pub async fn import(
         upstream_etag: None,
         upstream_last_modified: None,
         checked: false,
+        immutable: false,
     };
     let redeploy = if file.overwrite && may_replace {
         Redeploy::Allow
diff --git a/crates/server/src/images/dispatch.rs b/crates/server/src/images/dispatch.rs
index 6ad430bc..4588ae8c 100644
--- a/crates/server/src/images/dispatch.rs
+++ b/crates/server/src/images/dispatch.rs
@@ -738,6 +738,7 @@ impl Conversation<'_> {
                 forge_plugin::api::IMAGES_MOUNT
             ),
             inline: false,
+            options: Vec::new(),
         }
     }
 
diff --git a/crates/server/src/images/proxy.rs b/crates/server/src/images/proxy.rs
index a4eea753..470894f7 100644
--- a/crates/server/src/images/proxy.rs
+++ b/crates/server/src/images/proxy.rs
@@ -266,6 +266,7 @@ impl Upstream {
         Remote {
             url: self.remote.clone(),
             index: None,
+            options: Vec::new(),
         }
     }
 
@@ -562,6 +563,7 @@ impl Registry {
         let remote = Remote {
             url: remote.to_string(),
             index: None,
+            options: Vec::new(),
         };
         match self.plugin().upstream(&remote, op, &[]) {
             Ok(UpstreamStep::Done(answer)) => Ok(answer),
diff --git a/crates/server/src/import/feed.rs b/crates/server/src/import/feed.rs
index 7c68352b..368c0513 100644
--- a/crates/server/src/import/feed.rs
+++ b/crates/server/src/import/feed.rs
@@ -65,6 +65,7 @@ impl Feed {
             remote: Remote {
                 url: url.to_string(),
                 index: None,
+                options: Vec::new(),
             },
             origins: Mutex::new(UpstreamOrigins::new(url, [])),
             username,
diff --git a/crates/server/src/indexes/mod.rs b/crates/server/src/indexes/mod.rs
new file mode 100644
index 00000000..33b5dbf2
--- /dev/null
+++ b/crates/server/src/indexes/mod.rs
@@ -0,0 +1,490 @@
+//! The indexes the host keeps for the repositories of a format whose
+//! descriptor says `indexes` (apt): files made of a repository's packages
+//! by the format's plugin ([`FormatPlugin::index`]), signed with the
+//! repository's OpenPGP keys ([`signing`]), and stored as the repository's
+//! files in the file store.
+//!
+//! An index is made when a client asks for one of its files
+//! ([`Query::Index`]) and what it is made of changed since the generation
+//! the repository serves: the listed versions and their packages, the
+//! repository's options, its signing keys, and the format's version (the
+//! generation's *fingerprint*, kept in `repository_index`). A publish, a
+//! delete, an unlist or a key rotation needs no hook of its own: the next
+//! `apt-get update` finds the fingerprint changed.
+//!
+//! A new generation replaces the previous one all at once: its files are
+//! stored, the previous generation's other files deleted and the
+//! fingerprint recorded in one transaction, which also checks that the
+//! packages and keys it was made of are still the repository's (else it is
+//! made again). Content-addressed files (apt's `by-hash/` copies) stay for
+//! a day after the last generation that named them, for clients that read
+//! an older `Release`.
+//!
+//! Every package is listed, whatever the reader's package selector: an
+//! index is signed once for every client, so a selector limits what a
+//! reader may download, not what the index names.
+//!
+//! [`FormatPlugin::index`]: forge_plugin::api::FormatPlugin::index
+//! [`Query::Index`]: forge_plugin::api::Query::Index
+
+pub mod signing;
+
+use std::collections::{HashMap, HashSet};
+use std::sync::{Arc, LazyLock, Mutex, PoisonError, Weak};
+
+use forge_crypto::ExposeSecret;
+use forge_db::model::{RepoKind, Repository};
+use forge_db::raw_dao::{self, NewRawFile, RawFile, Redeploy};
+use forge_db::signing_key_dao::{self, NewSigningKey, SigningKeyRow};
+use forge_db::{index_dao, repository_dao};
+use forge_plugin::api::{self as protocol, files, SignatureKind};
+use forge_plugin::Plugin;
+use sha1::{Digest as _, Sha1};
+use sha2::Sha256;
+
+use crate::state::AppState;
+use signing::{Key, KeyInfo, SigningError};
+
+/// Bumped when the host signs or stores indexes differently, so that every
+/// repository's index is made again.
+const HOST_GENERATION: &str = "1";
+
+/// How long a content-addressed index file outlives the last generation
+/// that named it.
+const KEEP_CONTENT_ADDRESSED: chrono::Duration = chrono::Duration::days(1);
+
+/// The most an index may hold, its files together.
+const MAX_INDEX_BYTES: usize = 1024 * 1024 * 1024;
+
+/// The most files an index may hold.
+const MAX_INDEX_FILES: usize = 10_000;
+
+/// Why an index could not be served.
+#[derive(Debug, thiserror::Error)]
+pub enum IndexError {
+    /// The database or the object store is unavailable.
+    #[error("{0}")]
+    Unavailable(String),
+    /// A failure of Forge or of the plugin.
+    #[error("{0}")]
+    Internal(String),
+}
+
+impl From<sqlx::Error> for IndexError {
+    fn from(e: sqlx::Error) -> Self {
+        forge_db::observe_error(&e);
+        match e {
+            sqlx::Error::PoolTimedOut => IndexError::Unavailable("database busy".into()),
+            e => IndexError::Internal(format!("database: {e}")),
+        }
+    }
+}
+
+impl From<forge_db::secret_dao::SecretDbError> for IndexError {
+    fn from(e: forge_db::secret_dao::SecretDbError) -> Self {
+        IndexError::Internal(format!("signing keys: {e}"))
+    }
+}
+
+impl From<SigningError> for IndexError {
+    fn from(e: SigningError) -> Self {
+        IndexError::Internal(format!("signing: {e}"))
+    }
+}
+
+/// One generation made at a time per repository and process; across
+/// processes the commit's checks keep the newest.
+type Gates = HashMap<i64, Weak<tokio::sync::Mutex<()>>>;
+static GATES: LazyLock<Mutex<Gates>> = LazyLock::new(Default::default);
+
+fn gate(repository_id: i64) -> Arc<tokio::sync::Mutex<()>> {
+    let mut gates = GATES.lock().unwrap_or_else(PoisonError::into_inner);
+    if gates.len() >= 1024 {
+        gates.retain(|_, weak| weak.strong_count() > 0);
+    }
+    if let Some(existing) = gates.get(&repository_id).and_then(Weak::upgrade) {
+        return existing;
+    }
+    let gate = Arc::new(tokio::sync::Mutex::new(()));
+    gates.insert(repository_id, Arc::downgrade(&gate));
+    gate
+}
+
+/// Whether `repo` keeps indexes: a hosted repository of a format with
+/// indexes.
+pub fn keeps_indexes(state: &AppState, repo: &Repository) -> bool {
+    repo.kind() == RepoKind::Hosted
+        && state
+            .formats
+            .plugin(&repo.format)
+            .is_some_and(|plugin| plugin.descriptor().indexes)
+}
+
+/// The user id of a key Forge makes for `repo`.
+fn key_user_id(state: &AppState, repo: &Repository) -> String {
+    let host = url::Url::parse(&state.config.public_base_url())
+        .ok()
+        .and_then(|u| u.host_str().map(str::to_string))
+        .unwrap_or_else(|| "forge".into());
+    format!("{} (Forge {host})", repo.name)
+}
+
+/// Store `key` as a signing key of `repo`. `None` when it has the key
+/// already.
+pub async fn add_key(
+    state: &AppState,
+    repo: &Repository,
+    key: &Key,
+) -> Result<Option<KeyInfo>, IndexError> {
+    let info = key.info()?;
+    let secret = forge_crypto::PlaintextSecret::from(key.to_sealable()?);
+    let mut tx = forge_db::begin(&state.pool).await?;
+    let stored = signing_key_dao::insert(
+        &mut tx,
+        &state.envelope,
+        repo.id,
+        &NewSigningKey {
+            fingerprint: &info.fingerprint,
+            algorithm: &info.algorithm,
+            user_id: &info.user_id,
+            public_key: &info.public_key,
+        },
+        &secret,
+    )
+    .await?;
+    tx.commit().await?;
+    Ok(stored.map(|_| info))
+}
+
+/// Generate a key for `repo` and store it.
+pub async fn generate_key(state: &AppState, repo: &Repository) -> Result<KeyInfo, IndexError> {
+    let user_id = key_user_id(state, repo);
+    let key = tokio::task::spawn_blocking(move || Key::generate(&user_id))
+        .await
+        .map_err(|e| IndexError::Internal(format!("key generation: {e}")))??;
+    add_key(state, repo, &key)
+        .await?
+        .ok_or_else(|| IndexError::Internal("a new key exists already".into()))
+}
+
+/// The signing keys of `repo`, a new one generated when it has none.
+pub async fn keys(state: &AppState, repo: &Repository) -> Result<Vec<SigningKeyRow>, IndexError> {
+    let keys = signing_key_dao::list(&state.pool, repo.id).await?;
+    if !keys.is_empty() {
+        return Ok(keys);
+    }
+    let user_id = key_user_id(state, repo);
+    let key = tokio::task::spawn_blocking(move || Key::generate(&user_id))
+        .await
+        .map_err(|e| IndexError::Internal(format!("key generation: {e}")))??;
+    let info = key.info()?;
+    let secret = forge_crypto::PlaintextSecret::from(key.to_sealable()?);
+    let mut tx = forge_db::begin(&state.pool).await?;
+    // Locked, so that two first requests store one key, not two.
+    repository_dao::lock_repository(&mut *tx, repo.id).await?;
+    if signing_key_dao::list(&mut *tx, repo.id).await?.is_empty() {
+        signing_key_dao::insert(
+            &mut tx,
+            &state.envelope,
+            repo.id,
+            &NewSigningKey {
+                fingerprint: &info.fingerprint,
+                algorithm: &info.algorithm,
+                user_id: &info.user_id,
+                public_key: &info.public_key,
+            },
+            &secret,
+        )
+        .await?;
+    }
+    tx.commit().await?;
+    Ok(signing_key_dao::list(&state.pool, repo.id).await?)
+}
+
+/// The file at `path` of `repo`'s indexes, once they are up to date.
+pub async fn file(
+    state: &AppState,
+    repo: &Repository,
+    path: &str,
+) -> Result<Option<RawFile>, IndexError> {
+    ensure_current(state, repo).await?;
+    Ok(raw_dao::find(&state.pool, repo.id, path).await?)
+}
+
+/// What a generation is made of, digested.
+fn fingerprint(
+    plugin: &Plugin,
+    repo: &Repository,
+    versions: &str,
+    keys: &[SigningKeyRow],
+) -> String {
+    let mut digest = Sha256::new();
+    let mut part = |s: &str| {
+        digest.update(s.as_bytes());
+        digest.update([0x1f]);
+    };
+    part(HOST_GENERATION);
+    part(plugin.descriptor().version);
+    part(&repo.name);
+    part(versions);
+    for (name, value) in repo.format_options() {
+        part(&name);
+        part(&value);
+    }
+    for key in keys {
+        part(&key.fingerprint);
+    }
+    hex::encode(digest.finalize())
+}
+
+/// Make `repo`'s index again if what it is made of changed.
+pub async fn ensure_current(state: &AppState, repo: &Repository) -> Result<(), IndexError> {
+    let plugin = state
+        .formats
+        .plugin(&repo.format)
+        .filter(|plugin| plugin.descriptor().indexes)
+        .ok_or_else(|| IndexError::Internal(format!("format {} keeps no indexes", repo.format)))?;
+    if repo.kind() != RepoKind::Hosted {
+        return Err(IndexError::Internal(
+            "only hosted repositories keep indexes".into(),
+        ));
+    }
+    let package_path = plugin.descriptor().assets.package;
+    let gate = gate(repo.id);
+    let _held = gate.lock().await;
+    for _ in 0..3 {
+        let keys = keys(state, repo).await?;
+        let versions = index_dao::versions_digest(&state.pool, repo.id, package_path).await?;
+        let fingerprint = fingerprint(&plugin, repo, &versions, &keys);
+        if index_dao::current(&state.pool, repo.id).await?.as_deref() == Some(&fingerprint) {
+            return Ok(());
+        }
+        if generate(state, repo, &plugin, &keys, &versions, &fingerprint).await? {
+            return Ok(());
+        }
+    }
+    Err(IndexError::Unavailable(
+        "the repository kept changing while its index was made; retry".into(),
+    ))
+}
+
+/// One file to store.
+struct Stored {
+    path: String,
+    content: Vec<u8>,
+    content_type: String,
+    immutable: bool,
+}
+
+/// Make and store a generation. `false` when the repository changed while
+/// it was made (nothing was stored).
+async fn generate(
+    state: &AppState,
+    repo: &Repository,
+    plugin: &Arc<Plugin>,
+    rows: &[SigningKeyRow],
+    versions_digest: &str,
+    fingerprint: &str,
+) -> Result<bool, IndexError> {
+    let started = std::time::Instant::now();
+    let descriptor = plugin.descriptor();
+    let format = state
+        .formats
+        .for_repository(repo)
+        .map_err(|e| IndexError::Internal(e.to_string()))?;
+
+    let mut keys = Vec::with_capacity(rows.len());
+    for row in rows {
+        let sealed = signing_key_dao::open(&state.envelope, row).await?;
+        keys.push(Key::from_sealed(sealed.expose_secret())?);
+    }
+
+    let mut versions =
+        index_dao::listed_versions(&state.pool, repo.id, descriptor.assets.package).await?;
+    versions.sort_by(|a, b| {
+        a.name
+            .cmp(&b.name)
+            .then_with(|| format.compare_versions(&a.version, &b.version))
+    });
+    let (keyring, keyring_armored) = signing::keyring(&keys)?;
+    let input = protocol::IndexInput {
+        packages: versions
+            .into_iter()
+            .map(|v| protocol::IndexedPackage {
+                id: v.name,
+                version: v.version,
+                version_original: v.version_original,
+                summary: v.manifest_summary.map(|s| s.to_string()),
+                size: u64::try_from(v.size).unwrap_or(0),
+                sha256: v.sha256,
+                sha512: v.sha512_base64,
+                published: Some(
+                    v.created_at
+                        .to_rfc3339_opts(chrono::SecondsFormat::Millis, false),
+                ),
+            })
+            .collect(),
+        generated: chrono::Utc::now().to_rfc3339_opts(chrono::SecondsFormat::Secs, true),
+        keyring,
+        keyring_armored,
+    };
+    let target = protocol::Repository {
+        name: repo.name.clone(),
+        kind: protocol::RepositoryKind::Hosted,
+        base_url: crate::plugins::repository_url(state, &repo.name),
+        inline: false,
+        options: repo.format_options(),
+    };
+    let implementation = plugin.implementation().clone();
+    let files = tokio::task::spawn_blocking(move || -> Result<Vec<Stored>, IndexError> {
+        let made = implementation
+            .index(&target, &input)
+            .map_err(|e| IndexError::Internal(format!("the format made no index: {e}")))?;
+        sign_and_check(made, &keys)
+    })
+    .await
+    .map_err(|e| IndexError::Internal(format!("index: {e}")))??;
+
+    // The content first, outside the transaction.
+    let mut ingested = Vec::with_capacity(files.len());
+    for file in &files {
+        let staged = state
+            .cas
+            .stage(&file.content[..], file.content.len() as u64)
+            .await
+            .map_err(cas_error)?;
+        let stored = state.cas.commit(staged).await.map_err(cas_error)?;
+        let sha1 = hex::encode(Sha1::digest(&file.content));
+        let md5 = hex::encode(md5::Md5::digest(&file.content));
+        ingested.push((stored, sha1, md5));
+    }
+
+    let grace = state.config.outbox.grace();
+    let mut tx = forge_db::begin(&state.pool).await?;
+    let current = index_dao::lock(&mut tx, repo.id).await?;
+    if current == fingerprint {
+        // Another process made it meanwhile.
+        return Ok(true);
+    }
+    // Still made of the repository's packages and keys?
+    let versions_now =
+        index_dao::versions_digest(&mut *tx, repo.id, descriptor.assets.package).await?;
+    let keys_now: Vec<String> = signing_key_dao::list(&mut *tx, repo.id)
+        .await?
+        .into_iter()
+        .map(|k| k.fingerprint)
+        .collect();
+    let keys_then: Vec<String> = rows.iter().map(|k| k.fingerprint.clone()).collect();
+    if versions_now != versions_digest || keys_now != keys_then {
+        return Ok(false);
+    }
+    for (file, (stored, sha1, md5)) in files.iter().zip(&ingested) {
+        raw_dao::store(
+            &mut tx,
+            repo.id,
+            &NewRawFile {
+                path: &file.path,
+                sha256: &stored.sha256,
+                size: i64::try_from(stored.size).unwrap_or(i64::MAX),
+                content_type: &file.content_type,
+                sha512_base64: &stored.sha512_base64,
+                sha1,
+                md5,
+                upstream_etag: None,
+                upstream_last_modified: None,
+                checked: true,
+                immutable: file.immutable,
+            },
+            stored.ingest_token,
+            Redeploy::Allow,
+            grace,
+        )
+        .await?;
+    }
+    let paths: Vec<String> = files.iter().map(|f| f.path.clone()).collect();
+    let pruned = index_dao::prune(&mut tx, repo.id, &paths, KEEP_CONTENT_ADDRESSED, grace).await?;
+    index_dao::set(&mut tx, repo.id, fingerprint).await?;
+    tx.commit().await?;
+    tracing::info!(
+        repo = %repo.name,
+        files = files.len(),
+        pruned,
+        elapsed_ms = started.elapsed().as_millis() as u64,
+        "index made"
+    );
+    Ok(true)
+}
+
+fn cas_error(e: forge_storage::CasError) -> IndexError {
+    if e.is_unavailable() {
+        IndexError::Unavailable("object store unavailable".into())
+    } else {
+        IndexError::Internal(format!("store index: {e}"))
+    }
+}
+
+/// Check what the plugin made (valid, distinct paths; bounded) and add the
+/// signed copies.
+fn sign_and_check(made: Vec<protocol::IndexFile>, keys: &[Key]) -> Result<Vec<Stored>, IndexError> {
+    let bad = |what: String| IndexError::Internal(format!("the format's index: {what}"));
+    let mut out = Vec::with_capacity(made.len() + 2);
+    for file in made {
+        for copy in &file.signed {
+            let content = match copy.signature {
+                SignatureKind::Cleartext => {
+                    let text = std::str::from_utf8(&file.content).map_err(|_| {
+                        bad(format!("{} is signed as text but is not UTF-8", file.path))
+                    })?;
+                    signing::sign_cleartext(keys, text)?
+                }
+                SignatureKind::Detached => signing::sign_detached(keys, &file.content)?,
+            };
+            out.push(Stored {
+                path: copy.path.clone(),
+                content: content.into_bytes(),
+                content_type: match copy.signature {
+                    SignatureKind::Cleartext => "text/plain; charset=utf-8".into(),
+                    SignatureKind::Detached => "application/pgp-signature".into(),
+                },
+                immutable: false,
+            });
+        }
+        out.push(Stored {
+            path: file.path,
+            content: file.content,
+            content_type: file.content_type,
+            immutable: file.immutable,
+        });
+    }
+    if out.len() > MAX_INDEX_FILES {
+        return Err(bad(format!("more than {MAX_INDEX_FILES} files")));
+    }
+    let mut seen = HashSet::new();
+    let mut total = 0usize;
+    for file in &out {
+        files::validate_path(&file.path).map_err(|e| bad(format!("{:?}: {e}", file.path)))?;
+        if !seen.insert(file.path.as_str()) {
+            return Err(bad(format!("{:?} twice", file.path)));
+        }
+        let essence = file.content_type.split(';').next().unwrap_or("").trim();
+        let content_type_ok = file.content_type.len() <= 127
+            && file
+                .content_type
+                .chars()
+                .all(|c| c.is_ascii_graphic() || c == ' ')
+            && essence
+                .split_once('/')
+                .is_some_and(|(t, s)| !t.is_empty() && !s.is_empty());
+        if !content_type_ok {
+            return Err(bad(format!(
+                "{:?} has the content type {:?}",
+                file.path, file.content_type
+            )));
+        }
+        total += file.content.len();
+    }
+    if total > MAX_INDEX_BYTES {
+        return Err(bad(format!("larger than {MAX_INDEX_BYTES} bytes")));
+    }
+    Ok(out)
+}
diff --git a/crates/server/src/indexes/signing.rs b/crates/server/src/indexes/signing.rs
new file mode 100644
index 00000000..ae35e0a7
--- /dev/null
+++ b/crates/server/src/indexes/signing.rs
@@ -0,0 +1,328 @@
+//! The OpenPGP keys that sign a repository's indexes (apt's `InRelease` and
+//! `Release.gpg`), with rPGP.
+//!
+//! A key Forge generates is a v4 Ed25519 key (EdDSA, which `gpgv` 2.1 and
+//! later verify: Debian 9, Ubuntu 18.04 and newer) whose primary key signs.
+//! An imported key must sign with Ed25519 too (its newest signing subkey,
+//! else its primary key): rPGP links RSA and NIST-curve code whose secret-key
+//! operations are not constant-time (RUSTSEC-2023-0071, RUSTSEC-2026-0387),
+//! and Forge never uses them. A passphrase is removed on import: the key is
+//! kept sealed by the secret encryption instead, and never leaves the
+//! server.
+//!
+//! Signatures are made with SHA-512, by every key of the repository, so a
+//! client trusting either key of a rollover verifies them.
+
+use pgp::armor::{self, BlockType};
+use pgp::composed::{
+    ArmorOptions, CleartextSignedMessage, Deserializable, DetachedSignature, EncryptionCaps,
+    KeyType, SecretKeyParamsBuilder, SignedPublicKey, SignedSecretKey,
+};
+use pgp::crypto::hash::HashAlgorithm;
+use pgp::crypto::public_key::PublicKeyAlgorithm;
+use pgp::packet::{Signature, SignatureConfig, SignatureType, Subpacket, SubpacketData};
+use pgp::ser::Serialize;
+use pgp::types::{KeyDetails, KeyVersion, Password, SigningKey, Timestamp};
+use rand_core_06::OsRng;
+
+/// Why a key could not be made, read or used.
+#[derive(Debug, thiserror::Error)]
+pub enum SigningError {
+    /// What an administrator gave is not a usable key (shown to them).
+    #[error("{0}")]
+    Invalid(String),
+    #[error("OpenPGP: {0}")]
+    Pgp(#[from] pgp::errors::Error),
+}
+
+/// What is shown of a key.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct KeyInfo {
+    /// The primary key's fingerprint, uppercase hex.
+    pub fingerprint: String,
+    /// The signing key's algorithm.
+    pub algorithm: String,
+    /// The primary user id.
+    pub user_id: String,
+    /// The certificate, ASCII-armored.
+    pub public_key: String,
+}
+
+/// A secret key, ready to sign.
+#[derive(Clone)]
+pub struct Key {
+    secret: SignedSecretKey,
+}
+
+impl std::fmt::Debug for Key {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("Key")
+            .field("fingerprint", &fingerprint(&self.secret))
+            .finish_non_exhaustive()
+    }
+}
+
+fn fingerprint(key: &SignedSecretKey) -> String {
+    format!("{:X}", key.fingerprint())
+}
+
+impl Key {
+    /// A new Ed25519 key for `user_id` (`Forge apt-internal <forge@host>`).
+    pub fn generate(user_id: &str) -> Result<Key, SigningError> {
+        let mut params = SecretKeyParamsBuilder::default();
+        params
+            .key_type(KeyType::Ed25519Legacy)
+            .can_certify(true)
+            .can_sign(true)
+            .can_encrypt(EncryptionCaps::None)
+            .preferred_hash_algorithms(
+                [HashAlgorithm::Sha512, HashAlgorithm::Sha256]
+                    .into_iter()
+                    .collect(),
+            )
+            .primary_user_id(user_id.to_string());
+        let params = params
+            .build()
+            .map_err(|e| SigningError::Invalid(format!("key parameters: {e}")))?;
+        let secret = params.generate(OsRng)?;
+        Ok(Key { secret })
+    }
+
+    /// An administrator's ASCII-armored secret key, its passphrase removed.
+    pub fn import(armored: &str, passphrase: Option<&str>) -> Result<Key, SigningError> {
+        let (mut secret, _) = SignedSecretKey::from_string(armored.trim()).map_err(|e| {
+            SigningError::Invalid(format!("not an ASCII-armored OpenPGP secret key: {e}"))
+        })?;
+        secret.verify_bindings().map_err(|e| {
+            SigningError::Invalid(format!("the key's self-signatures do not verify: {e}"))
+        })?;
+        if secret.version() != KeyVersion::V4 {
+            return Err(SigningError::Invalid(
+                "only v4 keys are supported (gpgv verifies no v6 signatures yet)".into(),
+            ));
+        }
+        let password = Password::from(passphrase.unwrap_or(""));
+        let locked = |e: pgp::errors::Error| {
+            SigningError::Invalid(format!(
+                "the key could not be unlocked (a wrong or missing passphrase?): {e}"
+            ))
+        };
+        if secret.primary_key.secret_params().is_encrypted() {
+            secret
+                .primary_key
+                .remove_password(&password)
+                .map_err(locked)?;
+        }
+        for sub in &mut secret.secret_subkeys {
+            if sub.key.secret_params().is_encrypted() {
+                sub.key.remove_password(&password).map_err(locked)?;
+            }
+        }
+        let key = Key { secret };
+        let algorithm = key.signer().algorithm();
+        if algorithm != PublicKeyAlgorithm::EdDSALegacy {
+            return Err(SigningError::Invalid(format!(
+                "Forge signs with Ed25519 (EdDSA) keys, and this key signs with {algorithm:?}: \
+                 generate a key, or import an Ed25519 one \
+                 (gpg --quick-gen-key '<user id>' ed25519 sign)"
+            )));
+        }
+        // It must be able to sign.
+        key.sign_detached(b"probe")?;
+        Ok(key)
+    }
+
+    /// A key sealed with [`Key::to_sealable`].
+    pub fn from_sealed(armored: &str) -> Result<Key, SigningError> {
+        let (secret, _) = SignedSecretKey::from_string(armored)?;
+        Ok(Key { secret })
+    }
+
+    /// The secret key, ASCII-armored, without a passphrase: what is sealed.
+    pub fn to_sealable(&self) -> Result<String, SigningError> {
+        Ok(self.secret.to_armored_string(ArmorOptions::default())?)
+    }
+
+    /// The certificate.
+    pub fn public(&self) -> SignedPublicKey {
+        self.secret.to_public_key()
+    }
+
+    /// What is shown of the key.
+    pub fn info(&self) -> Result<KeyInfo, SigningError> {
+        let public = self.public();
+        let user_id = public
+            .details
+            .users
+            .first()
+            .map(|u| String::from_utf8_lossy(u.id.id()).into_owned())
+            .unwrap_or_default();
+        let signer = self.signer();
+        Ok(KeyInfo {
+            fingerprint: fingerprint(&self.secret),
+            algorithm: algorithm_name(*signer),
+            user_id,
+            public_key: public.to_armored_string(ArmorOptions::default())?,
+        })
+    }
+
+    /// The key that signs: the newest subkey whose binding allows signing,
+    /// else the primary key.
+    // rPGP signs with a `Box<&dyn SigningKey>` (it implements its traits for
+    // that type, not for `&dyn SigningKey`).
+    #[allow(clippy::redundant_allocation)]
+    fn signer(&self) -> Box<&dyn SigningKey> {
+        let signing_subkey = self
+            .secret
+            .secret_subkeys
+            .iter()
+            .filter(|sub| sub.signatures.iter().any(|sig| sig.key_flags().sign()))
+            .max_by_key(|sub| sub.key.created_at());
+        match signing_subkey {
+            Some(sub) => Box::new(&sub.key as &dyn SigningKey),
+            None => Box::new(&self.secret.primary_key as &dyn SigningKey),
+        }
+    }
+
+    /// A signature of `data` of type `typ` (`data` normalized as that type
+    /// requires).
+    fn signature(&self, typ: SignatureType, data: &[u8]) -> pgp::errors::Result<Signature> {
+        let signer = self.signer();
+        let mut config = SignatureConfig::from_key(OsRng, &signer, typ)?;
+        config.hash_alg = HashAlgorithm::Sha512;
+        config.hashed_subpackets = vec![
+            Subpacket::regular(SubpacketData::SignatureCreationTime(Timestamp::now()))?,
+            Subpacket::regular(SubpacketData::IssuerFingerprint(signer.fingerprint()))?,
+        ];
+        config.unhashed_subpackets = vec![Subpacket::regular(SubpacketData::IssuerKeyId(
+            signer.legacy_key_id(),
+        ))?];
+        config.sign(&signer, &Password::empty(), data)
+    }
+
+    /// A detached signature of `data` (binary), ASCII-armored.
+    pub fn sign_detached(&self, data: &[u8]) -> Result<String, SigningError> {
+        sign_detached(std::slice::from_ref(self), data)
+    }
+}
+
+fn algorithm_name(key: &dyn SigningKey) -> String {
+    match key.algorithm() {
+        PublicKeyAlgorithm::EdDSALegacy | PublicKeyAlgorithm::Ed25519 => "EdDSA (Ed25519)".into(),
+        other => format!("{other:?}"),
+    }
+}
+
+/// `text` inside a cleartext signature of every one of `keys` (apt's
+/// `InRelease`).
+pub fn sign_cleartext(keys: &[Key], text: &str) -> Result<String, SigningError> {
+    let message = CleartextSignedMessage::new_many(text, |normalized| {
+        keys.iter()
+            .map(|key| key.signature(SignatureType::Text, normalized.as_bytes()))
+            .collect()
+    })?;
+    Ok(message.to_armored_string(ArmorOptions::default())?)
+}
+
+/// One ASCII-armored block of detached signatures of `data` (binary), one
+/// of every one of `keys` (apt's `Release.gpg`).
+pub fn sign_detached(keys: &[Key], data: &[u8]) -> Result<String, SigningError> {
+    // With their packet headers, as a detached signature is written.
+    let signatures = keys
+        .iter()
+        .map(|key| {
+            key.signature(SignatureType::Binary, data)
+                .map(DetachedSignature::new)
+        })
+        .collect::<Result<Vec<_>, _>>()?;
+    let mut out = Vec::new();
+    armor::write(&signatures, BlockType::Signature, &mut out, None, true)?;
+    String::from_utf8(out).map_err(|e| SigningError::Invalid(e.to_string()))
+}
+
+/// The certificates of `keys` as one binary keyring, and as one
+/// ASCII-armored block.
+pub fn keyring(keys: &[Key]) -> Result<(Vec<u8>, String), SigningError> {
+    let publics: Vec<SignedPublicKey> = keys.iter().map(Key::public).collect();
+    let binary = publics.to_bytes()?;
+    let mut armored = Vec::new();
+    armor::write(&publics, BlockType::PublicKey, &mut armored, None, true)?;
+    let armored = String::from_utf8(armored).map_err(|e| SigningError::Invalid(e.to_string()))?;
+    Ok((binary, armored))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn generated_keys_sign_both_ways() {
+        let a = Key::generate("Forge test <forge@example.com>").unwrap();
+        let b = Key::generate("Forge next <forge@example.com>").unwrap();
+        let info = a.info().unwrap();
+        assert_eq!(info.fingerprint.len(), 40);
+        assert_eq!(info.algorithm, "EdDSA (Ed25519)");
+        assert_eq!(info.user_id, "Forge test <forge@example.com>");
+
+        let text = "Origin: Forge\nSuite: bookworm\n";
+        let signed = sign_cleartext(&[a.clone(), b.clone()], text).unwrap();
+        assert!(
+            signed.starts_with("-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA512\n"),
+            "{signed}"
+        );
+        let (message, _) = CleartextSignedMessage::from_string(&signed).unwrap();
+        assert_eq!(message.signatures().len(), 2);
+        message.verify(&a.public()).unwrap();
+        message.verify(&b.public()).unwrap();
+
+        let detached = sign_detached(&[a.clone(), b.clone()], text.as_bytes()).unwrap();
+        assert!(detached.starts_with("-----BEGIN PGP SIGNATURE-----"));
+        let (parsed, _) = DetachedSignature::from_armor_many(detached.as_bytes()).unwrap();
+        let parsed: Vec<DetachedSignature> = parsed.collect::<Result<_, _>>().unwrap();
+        assert_eq!(parsed.len(), 2);
+        parsed[0].verify(&a.public(), text.as_bytes()).unwrap();
+        parsed[1].verify(&b.public(), text.as_bytes()).unwrap();
+        let (binary, armored) = keyring(&[a.clone(), b]).unwrap();
+        assert!(!binary.is_empty());
+        assert!(armored.starts_with("-----BEGIN PGP PUBLIC KEY BLOCK-----"));
+
+        // A sealed key comes back the same.
+        let again = Key::from_sealed(&a.to_sealable().unwrap()).unwrap();
+        assert_eq!(again.info().unwrap(), a.info().unwrap());
+    }
+
+    #[test]
+    fn imports_refuse_what_cannot_sign() {
+        assert!(matches!(
+            Key::import("not a key", None),
+            Err(SigningError::Invalid(_))
+        ));
+        let public = Key::generate("x <x@example.com>")
+            .unwrap()
+            .info()
+            .unwrap()
+            .public_key;
+        assert!(matches!(
+            Key::import(&public, None),
+            Err(SigningError::Invalid(_))
+        ));
+        let key = Key::generate("x <x@example.com>").unwrap();
+        let imported = Key::import(&key.to_sealable().unwrap(), None).unwrap();
+        assert_eq!(
+            imported.info().unwrap().fingerprint,
+            key.info().unwrap().fingerprint
+        );
+        // A key of another algorithm is refused: Forge signs with Ed25519 only.
+        let mut params = SecretKeyParamsBuilder::default();
+        params
+            .key_type(KeyType::ECDSA(pgp::crypto::ecc_curve::ECCCurve::P256))
+            .can_certify(true)
+            .can_sign(true)
+            .can_encrypt(EncryptionCaps::None)
+            .primary_user_id("p256 <p@example.com>".into());
+        let p256 = params.build().unwrap().generate(OsRng).unwrap();
+        let armored = p256.to_armored_string(ArmorOptions::default()).unwrap();
+        let err = Key::import(&armored, None).unwrap_err().to_string();
+        assert!(err.contains("Ed25519"), "{err}");
+    }
+}
diff --git a/crates/server/src/lib.rs b/crates/server/src/lib.rs
index b0f7d594..5d5b0843 100644
--- a/crates/server/src/lib.rs
+++ b/crates/server/src/lib.rs
@@ -29,6 +29,7 @@ pub mod files;
 pub mod health;
 pub mod images;
 pub mod import;
+pub mod indexes;
 pub mod invitations;
 pub mod me;
 pub mod me_tokens;
diff --git a/crates/server/src/plugins.rs b/crates/server/src/plugins.rs
index d2a3c143..c06d8d87 100644
--- a/crates/server/src/plugins.rs
+++ b/crates/server/src/plugins.rs
@@ -122,14 +122,15 @@ pub const PASSED_RESPONSE_HEADERS: &[&str] = &[
 ];
 
 /// The format plugins built into this server: crates under
-/// `crates/formats/<id>/`, linked in and always installed (Docker / OCI,
-/// NuGet, npm, raw). NuGet reads archives under `nuget_limits` (`[nuget]`),
+/// `crates/formats/<id>/`, linked in and always installed (apt, Docker /
+/// OCI, NuGet, npm, raw). NuGet reads archives under `nuget_limits` (`[nuget]`),
 /// npm requests under `npm_limits` (`[npm]`).
 pub fn builtin(
     nuget_limits: forge_format_nuget::NupkgLimits,
     npm_limits: forge_format_npm::NpmLimits,
 ) -> Vec<Arc<Plugin>> {
     vec![
+        Plugin::builtin(forge_format_apt::Apt),
         Plugin::builtin(forge_format_docker::Docker),
         Plugin::builtin(forge_format_nuget::Nuget::with_limits(nuget_limits)),
         Plugin::builtin(forge_format_npm::Npm::with_limits(npm_limits)),
@@ -369,6 +370,7 @@ async fn serve(
         // plugin renders, and the redirects it may return, stay there.
         base_url: repository_url_for(state, crate::base_urls::request_authority(&req), &repo.name),
         inline: stores_files && repo.inline_content(),
+        options: repo.format_options(),
     };
     let request = protocol::Request {
         method: method.as_str().to_string(),
@@ -597,7 +599,17 @@ impl Ctx<'_> {
             Action::ReadBody(_) | Action::Publish(_) => {
                 plugin_failed(self.repo, &"a body was asked for twice")
             }
-            Action::ServeFile(_) => self.plugin_misused("an action of the other storage"),
+            // A file the host keeps for the repository: an index, a
+            // proxy's copy of an upstream file.
+            Action::ServeFile(path) => {
+                if self.mutating() {
+                    return refused("serving a file");
+                }
+                match self.require_read().await {
+                    Ok(()) => self.serve_file(&path).await,
+                    Err(denied) => denied,
+                }
+            }
             // Images are the registry's (`crate::images`).
             Action::ServeBlob { .. } | Action::ServeManifest { .. } => {
                 self.plugin_misused("an image action")
@@ -680,9 +692,21 @@ impl Ctx<'_> {
         if queries.iter().any(Query::is_images) {
             return Err(self.plugin_misused("an image query"));
         }
-        if queries.iter().any(|q| q.is_files() != self.stores_files) {
+        let other_storage = |q: &Query| {
+            if self.stores_files {
+                !q.is_files() || matches!(q, Query::Index(_))
+            } else {
+                !q.is_for_packages()
+            }
+        };
+        if queries.iter().any(other_storage) {
             return Err(self.plugin_misused("a query of the other storage"));
         }
+        if queries.iter().any(|q| matches!(q, Query::Index(_)))
+            && !crate::indexes::keeps_indexes(self.state, self.repo)
+        {
+            return Err(self.plugin_misused("an index of a repository that keeps none"));
+        }
         if queries.len() > 1 && queries.iter().any(Query::is_change) {
             return Err(self.plugin_misused("a change with other queries in its round"));
         }
@@ -692,6 +716,9 @@ impl Ctx<'_> {
     /// The answer to one query, or the response that ends the request
     /// instead.
     async fn answer(&self, query: &Query) -> Result<Answer, Response> {
+        if query.is_files() && !self.stores_files {
+            return self.answer_kept_files(query).await;
+        }
         if query.is_files() {
             return self.answer_files(query).await;
         }
@@ -846,6 +873,45 @@ impl Ctx<'_> {
         }
     }
 
+    /// The answer to a query of a package format about a file the host
+    /// keeps for the repository: a hosted repository's index (brought up to
+    /// date first for `index`), a proxy's copy of an upstream file (fetched
+    /// for `fetch-file`). The caller's package selector decides on the
+    /// package the plugin says the file belongs to.
+    async fn answer_kept_files(&self, query: &Query) -> Result<Answer, Response> {
+        let (path, fetch) = match query {
+            Query::File(path) => (path, false),
+            Query::FetchFile(path) => (path, true),
+            Query::Index(path) => (path, false),
+            _ => return Err(self.plugin_misused("a files query of a package format")),
+        };
+        if forge_plugin::api::files::validate_path(path).is_err() {
+            return Err(self.plugin_misused("a file at an invalid path"));
+        }
+        let found = if let Query::Index(_) = query {
+            crate::indexes::file(self.state, self.repo, path)
+                .await
+                .map_err(|e| index_error(self.repo, e))?
+        } else {
+            let files = Files {
+                state: self.state,
+                principal: self.principal.clone(),
+            };
+            let package = self.implementation().file_package(path);
+            files
+                .locate_kept(self.repo, path, package.as_deref(), fetch)
+                .await
+                .map_err(IntoResponse::into_response)?
+        };
+        if let Some(file) = &found {
+            self.located
+                .lock()
+                .unwrap_or_else(PoisonError::into_inner)
+                .insert(path.clone(), file.clone());
+        }
+        Ok(Answer::File(found.as_ref().map(file_info)))
+    }
+
     /// The staged file part `index` of the form the plugin had received,
     /// taken (a part is stored once).
     fn take_part(&self, index: u32) -> Option<Ingested> {
@@ -876,7 +942,15 @@ impl Ctx<'_> {
                     state: self.state,
                     principal: self.principal.clone(),
                 };
-                match files.locate(self.repo, path, true, Vec::new(), 0).await {
+                let located = if self.stores_files {
+                    files.locate(self.repo, path, true, Vec::new(), 0).await
+                } else {
+                    let package = self.implementation().file_package(path);
+                    files
+                        .locate_kept(self.repo, path, package.as_deref(), true)
+                        .await
+                };
+                match located {
                     Ok(Some(file)) => file,
                     Ok(None) => return FileError::NotFound.into_response(),
                     Err(e) => return e.into_response(),
@@ -1007,6 +1081,7 @@ impl Ctx<'_> {
             }
             // Answered by `answer_files`.
             Query::File(_)
+            | Query::Index(_)
             | Query::FetchFile(_)
             | Query::Directory(_)
             | Query::Form
@@ -2186,6 +2261,22 @@ fn plugin_failed(repo: &Repository, e: &dyn std::fmt::Display) -> Response {
     (StatusCode::INTERNAL_SERVER_ERROR, "format plugin failed").into_response()
 }
 
+/// An index that could not be made, as the answer to the request.
+fn index_error(repo: &Repository, e: crate::indexes::IndexError) -> Response {
+    match e {
+        crate::indexes::IndexError::Unavailable(m) => (
+            StatusCode::SERVICE_UNAVAILABLE,
+            [(header::RETRY_AFTER, "30")],
+            m,
+        )
+            .into_response(),
+        crate::indexes::IndexError::Internal(m) => {
+            tracing::error!(repo = %repo.name, error = %m, "index failed");
+            (StatusCode::INTERNAL_SERVER_ERROR, "internal error").into_response()
+        }
+    }
+}
+
 pub(crate) fn repo_error(e: RepoError) -> Response {
     match e {
         RepoError::RepoNotFound(_) => {
@@ -2270,7 +2361,7 @@ mod tests {
         let descriptors: Vec<_> = plugins.iter().map(|p| p.descriptor()).collect();
         assert_eq!(forge_plugin::descriptor::check(&descriptors), Ok(()));
         let ids: Vec<_> = plugins.iter().map(|p| p.id()).collect();
-        assert_eq!(ids, ["docker", "nuget", "npm", "raw"]);
+        assert_eq!(ids, ["apt", "docker", "nuget", "npm", "raw"]);
         for plugin in &plugins {
             assert_eq!(plugin.descriptor().version, "1.0.0", "{}", plugin.id());
         }
diff --git a/crates/server/src/state.rs b/crates/server/src/state.rs
index 86bef87b..e026939a 100644
--- a/crates/server/src/state.rs
+++ b/crates/server/src/state.rs
@@ -713,8 +713,12 @@ mod tests {
         let registry = FormatRegistry::new(Default::default(), Default::default());
         assert_eq!(
             registry.ids().collect::<Vec<_>>(),
-            ["docker", "npm", "nuget", "raw"]
+            ["apt", "docker", "npm", "nuget", "raw"]
         );
+        // apt is a package format whose hosted repositories keep signed
+        // indexes; it has no groups.
+        assert!(!registry.stores_files("apt"));
+        assert_eq!(registry.kinds("apt"), Some(vec!["hosted", "proxy"]));
         // Raw is a built-in plugin whose repositories hold files, Docker one
         // whose repositories hold images, served by the registry.
         assert!(registry.get("raw").is_some());
diff --git a/crates/server/tests/apt.rs b/crates/server/tests/apt.rs
new file mode 100644
index 00000000..23eff281
--- /dev/null
+++ b/crates/server/tests/apt.rs
@@ -0,0 +1,860 @@
+//! Integration tests of apt repositories (`/repository/{repo}`): uploads
+//! (Nexus' raw body, a form, `PUT`), the redeploy policy, the signed indexes
+//! (`InRelease`, `Release.gpg`, `Packages` and their `by-hash` copies),
+//! downloads and deletes from the pool, path traversal, package selectors,
+//! signing key rotation and import, the format's options, and proxies of a
+//! mock mirror (files served unchanged, packages checked against the
+//! upstream's index, the cache while the upstream is down). Requires Docker
+//! (Postgres + versitygw via the shared harness), or
+//! `FORGE_TEST_DATABASE_URL` / `FORGE_TEST_S3_ENDPOINT`.
+//!
+//! The same flows run with the real `apt-get` and `gpgv` in CI
+//! (`.github/scripts/apt-e2e.sh`).
+
+mod common;
+
+use std::io::{Read, Write};
+use std::sync::atomic::{AtomicBool, AtomicUsize, Ordering};
+use std::sync::{Arc, Mutex};
+
+use axum::http::StatusCode;
+use axum::response::IntoResponse;
+use common::{unique, TestServer};
+use pgp::composed::{CleartextSignedMessage, Deserializable, DetachedSignature, SignedPublicKey};
+use serde_json::{json, Value};
+use sha2::Digest as _;
+use tokio::io::{AsyncReadExt, AsyncWriteExt};
+
+fn sha256(bytes: &[u8]) -> String {
+    hex::encode(sha2::Sha256::digest(bytes))
+}
+
+/// A binary package of `control` (a whole control file), its control
+/// member gzip-compressed, with a small data member.
+fn deb_of(control: &str) -> Vec<u8> {
+    let mut tar = tar::Builder::new(Vec::new());
+    let mut header = tar::Header::new_gnu();
+    header.set_size(control.len() as u64);
+    header.set_mode(0o644);
+    header.set_cksum();
+    tar.append_data(&mut header, "./control", control.as_bytes())
+        .unwrap();
+    let mut gz = flate2::write::GzEncoder::new(Vec::new(), flate2::Compression::default());
+    gz.write_all(&tar.into_inner().unwrap()).unwrap();
+    let control_tar = gz.finish().unwrap();
+    let mut out = b"!<arch>\n".to_vec();
+    for (name, data) in [
+        ("debian-binary", b"2.0\n".to_vec()),
+        ("control.tar.gz", control_tar),
+        ("data.tar", control.as_bytes().repeat(3)),
+    ] {
+        out.extend_from_slice(
+            format!(
+                "{:<16}{:<12}{:<6}{:<6}{:<8}{:<10}`\n",
+                name,
+                0,
+                0,
+                0,
+                100644,
+                data.len()
+            )
+            .as_bytes(),
+        );
+        out.extend_from_slice(&data);
+        if data.len() % 2 == 1 {
+            out.push(b'\n');
+        }
+    }
+    out
+}
+
+fn deb(name: &str, version: &str, arch: &str, section: &str) -> Vec<u8> {
+    deb_of(&format!(
+        "Package: {name}\nVersion: {version}\nArchitecture: {arch}\nMaintainer: Forge <forge@example.com>\n\
+         Section: {section}\nDepends: libc6 (>= 2.34)\nDescription: {name} for the tests\n It greets.\n"
+    ))
+}
+
+/// `POST /admin/repositories` with `body`: status and body.
+async fn admin_create(srv: &TestServer, body: Value) -> (StatusCode, String) {
+    let (u, p) = srv.admin_basic();
+    let resp = srv
+        .client()
+        .post(format!("{}/admin/repositories", srv.base_url))
+        .basic_auth(&u, Some(&p))
+        .json(&body)
+        .send()
+        .await
+        .unwrap();
+    (resp.status(), resp.text().await.unwrap())
+}
+
+async fn create(srv: &TestServer, body: Value) -> Value {
+    let (status, text) = admin_create(srv, body.clone()).await;
+    assert_eq!(status, StatusCode::CREATED, "create {body}: {text}");
+    serde_json::from_str(&text).unwrap()
+}
+
+/// An admin API call with the admin's token: status and body.
+async fn admin(
+    srv: &TestServer,
+    method: reqwest::Method,
+    path: &str,
+    body: Option<Value>,
+) -> (StatusCode, String) {
+    let (u, p) = srv.admin_basic();
+    let mut rb = srv
+        .client()
+        .request(method, format!("{}{path}", srv.base_url))
+        .basic_auth(&u, Some(&p));
+    if let Some(body) = body {
+        rb = rb.json(&body);
+    }
+    let resp = rb.send().await.unwrap();
+    (resp.status(), resp.text().await.unwrap())
+}
+
+/// A client of one repository, authenticated with an API token.
+struct Apt {
+    base: String,
+    client: reqwest::Client,
+    user: String,
+    token: String,
+}
+
+impl Apt {
+    async fn new(srv: &TestServer, repo: &str) -> Self {
+        Apt {
+            base: format!("{}/repository/{repo}", srv.base_url),
+            client: srv.client(),
+            user: srv.admin_user.clone().unwrap(),
+            token: srv.admin_token().await,
+        }
+    }
+
+    fn req(&self, method: reqwest::Method, path: &str) -> reqwest::RequestBuilder {
+        self.client
+            .request(method, format!("{}/{path}", self.base))
+            .basic_auth(&self.user, Some(&self.token))
+    }
+
+    async fn get(&self, path: &str) -> (StatusCode, Vec<u8>) {
+        let resp = self.req(reqwest::Method::GET, path).send().await.unwrap();
+        (resp.status(), resp.bytes().await.unwrap().to_vec())
+    }
+
+    async fn text(&self, path: &str) -> String {
+        let (status, body) = self.get(path).await;
+        assert_eq!(status, StatusCode::OK, "GET {path}");
+        String::from_utf8(body).unwrap()
+    }
+
+    /// Nexus' upload: the package as the body of a POST to the repository,
+    /// whatever its content type says.
+    async fn post(&self, package: &[u8]) -> (StatusCode, String) {
+        let resp = self
+            .req(reqwest::Method::POST, "")
+            .header("content-type", "multipart/form-data")
+            .body(package.to_vec())
+            .send()
+            .await
+            .unwrap();
+        (resp.status(), resp.text().await.unwrap())
+    }
+}
+
+/// The repository's public keys, from the admin API.
+async fn keys(srv: &TestServer, repo: &str) -> Vec<Value> {
+    let (status, text) = admin(
+        srv,
+        reqwest::Method::GET,
+        &format!("/admin/repositories/{repo}/signing-keys"),
+        None,
+    )
+    .await;
+    assert_eq!(status, StatusCode::OK, "{text}");
+    serde_json::from_str::<Value>(&text)
+        .unwrap()
+        .as_array()
+        .unwrap()
+        .clone()
+}
+
+fn public(key: &Value) -> SignedPublicKey {
+    SignedPublicKey::from_string(key["public_key"].as_str().unwrap())
+        .unwrap()
+        .0
+}
+
+/// `InRelease`'s signatures, and the `Release` text they sign.
+fn in_release(text: &str) -> (CleartextSignedMessage, String) {
+    let (message, _) = CleartextSignedMessage::from_string(text).unwrap();
+    let signed = message.signed_text().replace("\r\n", "\n");
+    (message, signed)
+}
+
+/// `Release`'s `SHA256` entries: (sha256, size, path).
+fn release_entries(release: &str) -> Vec<(String, u64, String)> {
+    release
+        .split("SHA256:\n")
+        .nth(1)
+        .unwrap()
+        .lines()
+        .take_while(|l| l.starts_with(' '))
+        .map(|l| {
+            let parts: Vec<&str> = l.split_whitespace().collect();
+            (
+                parts[0].to_string(),
+                parts[1].parse().unwrap(),
+                parts[2].to_string(),
+            )
+        })
+        .collect()
+}
+
+#[tokio::test]
+async fn options_are_checked() {
+    let srv = common::start().await;
+    let name = format!("aptopt{}", unique());
+    let (status, text) = admin_create(
+        &srv,
+        json!({"name": name, "kind": "hosted", "format": "apt"}),
+    )
+    .await;
+    assert_eq!(status, StatusCode::BAD_REQUEST);
+    assert!(text.contains("distribution"), "{text}");
+    for (options, why) in [
+        (json!({"distribution": "a/b"}), "distribution"),
+        (
+            json!({"distribution": "bookworm", "codename": "x"}),
+            "no option",
+        ),
+    ] {
+        let (status, text) = admin_create(
+            &srv,
+            json!({"name": name, "kind": "hosted", "format": "apt", "options": options}),
+        )
+        .await;
+        assert_eq!(status, StatusCode::BAD_REQUEST, "{options}");
+        assert!(text.contains(why), "{text}");
+    }
+    // A proxy has no package delay: its indexes are the upstream's.
+    let (status, text) = admin_create(
+        &srv,
+        json!({"name": name, "kind": "proxy", "format": "apt", "remote_url": "http://127.0.0.1:9/debian",
+               "package_delay_seconds": 3600, "options": {"distribution": "bookworm"}}),
+    )
+    .await;
+    assert_eq!(status, StatusCode::BAD_REQUEST);
+    assert!(text.contains("package_delay_seconds"), "{text}");
+    // Other formats have no options.
+    let (status, _) = admin_create(
+        &srv,
+        json!({"name": name, "kind": "hosted", "format": "raw", "options": {"distribution": "x"}}),
+    )
+    .await;
+    assert_eq!(status, StatusCode::BAD_REQUEST);
+    let repo = create(
+        &srv,
+        json!({"name": name, "kind": "hosted", "format": "apt", "options": {"distribution": " bookworm "}}),
+    )
+    .await;
+    assert_eq!(repo["options"], json!({"distribution": "bookworm"}));
+    // An update changes it; a required option cannot be cleared.
+    let (status, text) = admin(
+        &srv,
+        reqwest::Method::PUT,
+        &format!("/admin/repositories/{name}"),
+        Some(json!({"options": {"distribution": "trixie"}})),
+    )
+    .await;
+    assert_eq!(status, StatusCode::OK, "{text}");
+    assert!(text.contains("\"distribution\":\"trixie\""), "{text}");
+    let (status, _) = admin(
+        &srv,
+        reqwest::Method::PUT,
+        &format!("/admin/repositories/{name}"),
+        Some(json!({"options": {"distribution": null}})),
+    )
+    .await;
+    assert_eq!(status, StatusCode::BAD_REQUEST);
+    // The formats listing names the option.
+    let (_, formats) = admin(&srv, reqwest::Method::GET, "/admin/formats", None).await;
+    let formats: Value = serde_json::from_str(&formats).unwrap();
+    let apt = formats
+        .as_array()
+        .unwrap()
+        .iter()
+        .find(|f| f["id"] == "apt")
+        .unwrap();
+    assert_eq!(apt["options"][0]["name"], "distribution");
+    assert_eq!(apt["signed_indexes"], true);
+    assert_eq!(apt["kinds"], json!(["hosted", "proxy"]));
+}
+
+#[tokio::test]
+async fn hosted_repositories_publish_signed_indexes() {
+    let srv = common::start().await;
+    let name = format!("apt{}", unique());
+    create(
+        &srv,
+        json!({"name": name, "kind": "hosted", "format": "apt", "options": {"distribution": "bookworm"}}),
+    )
+    .await;
+    let apt = Apt::new(&srv, &name).await;
+
+    // Nexus' upload, a form and a PUT.
+    let hello = deb("hello", "1.0-1", "amd64", "utils");
+    let (status, text) = apt.post(&hello).await;
+    assert_eq!(status, StatusCode::CREATED, "{text}");
+    let form = reqwest::multipart::Form::new().part(
+        "package",
+        reqwest::multipart::Part::bytes(deb("hello", "1.0-1", "arm64", "utils"))
+            .file_name("hello_1.0-1_arm64.deb"),
+    );
+    let resp = apt
+        .req(reqwest::Method::POST, "")
+        .multipart(form)
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(resp.status(), StatusCode::CREATED);
+    let tool = deb("tool", "2:3.0~rc1", "all", "contrib/net");
+    let resp = apt
+        .req(reqwest::Method::PUT, "tool.deb")
+        .body(tool.clone())
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(resp.status(), StatusCode::CREATED);
+    // A redeploy is refused; so is what is not a package.
+    assert_eq!(apt.post(&hello).await.0, StatusCode::CONFLICT);
+    let (status, text) = apt.post(b"not a package").await;
+    assert_eq!(status, StatusCode::BAD_REQUEST, "{text}");
+    let (status, _) = apt
+        .post(&deb_of(
+            "Package: Bad_Name\nVersion: 1\nArchitecture: amd64\n",
+        ))
+        .await;
+    assert_eq!(status, StatusCode::BAD_REQUEST);
+
+    // InRelease is Release, signed with the repository's key.
+    let keys = keys(&srv, &name).await;
+    assert_eq!(keys.len(), 1);
+    let key = public(&keys[0]);
+    let (message, signed) = in_release(&apt.text("dists/bookworm/InRelease").await);
+    message.verify(&key).unwrap();
+    let release = apt.text("dists/bookworm/Release").await;
+    assert_eq!(signed.trim_end(), release.trim_end());
+    assert!(release.contains("Suite: bookworm\n"), "{release}");
+    assert!(
+        release.contains("Architectures: all amd64 arm64\n"),
+        "{release}"
+    );
+    assert!(release.contains("Components: contrib main\n"), "{release}");
+    assert!(release.contains("Acquire-By-Hash: yes\n"), "{release}");
+    let (status, detached) = apt.get("dists/bookworm/Release.gpg").await;
+    assert_eq!(status, StatusCode::OK);
+    let (signatures, _) = DetachedSignature::from_armor_many(&detached[..]).unwrap();
+    let signatures: Vec<DetachedSignature> = signatures.collect::<Result<_, _>>().unwrap();
+    assert_eq!(signatures.len(), 1);
+    signatures[0].verify(&key, release.as_bytes()).unwrap();
+
+    // Every file Release names is there, by name and by hash.
+    let entries = release_entries(&release);
+    assert_eq!(entries.len(), 2 * 3 * 3);
+    for (sha, size, path) in &entries {
+        let (status, named) = apt.get(&format!("dists/bookworm/{path}")).await;
+        assert_eq!(status, StatusCode::OK, "{path}");
+        assert_eq!(
+            (sha256(&named), named.len() as u64),
+            (sha.clone(), *size),
+            "{path}"
+        );
+        let dir = path.rsplit_once('/').unwrap().0;
+        let (status, by_hash) = apt
+            .get(&format!("dists/bookworm/{dir}/by-hash/SHA256/{sha}"))
+            .await;
+        assert_eq!(status, StatusCode::OK, "{path} by hash");
+        assert_eq!(by_hash, named);
+    }
+    let packages = apt.text("dists/bookworm/main/binary-amd64/Packages").await;
+    assert!(packages.contains("Package: hello\n"), "{packages}");
+    assert!(
+        packages.contains(&format!(
+            "Filename: pool/main/h/hello/hello_1.0-1_amd64.deb\nSize: {}\nSHA256: {}\n",
+            hello.len(),
+            sha256(&hello)
+        )),
+        "{packages}"
+    );
+    let contrib = apt
+        .text("dists/bookworm/contrib/binary-amd64/Packages")
+        .await;
+    assert!(
+        contrib.contains("Filename: pool/contrib/t/tool/tool_2:3.0~rc1_all.deb\n"),
+        "{contrib}"
+    );
+    let mut gz = Vec::new();
+    flate2::read::GzDecoder::new(
+        &apt.get("dists/bookworm/main/binary-amd64/Packages.gz")
+            .await
+            .1[..],
+    )
+    .read_to_end(&mut gz)
+    .unwrap();
+    assert_eq!(String::from_utf8(gz).unwrap(), packages);
+
+    // Downloads from the pool, at the package's path only.
+    let (status, body) = apt.get("pool/main/h/hello/hello_1.0-1_amd64.deb").await;
+    assert_eq!(status, StatusCode::OK);
+    assert_eq!(body, hello);
+    let (status, body) = apt
+        .get("pool/contrib/t/tool/tool_2%3a3.0~rc1_all.deb")
+        .await;
+    assert_eq!(status, StatusCode::OK);
+    assert_eq!(body, tool);
+    for wrong in [
+        "pool/contrib/h/hello/hello_1.0-1_amd64.deb",
+        "pool/main/x/hello/hello_1.0-1_amd64.deb",
+        "pool/main/h/hello/hello_9.9_amd64.deb",
+        "pool/main/h/hello/hello.deb",
+        "dists/bullseye/InRelease",
+        "dists/bookworm/main/binary-s390x/Packages",
+    ] {
+        assert_eq!(apt.get(wrong).await.0, StatusCode::NOT_FOUND, "{wrong}");
+    }
+
+    // A new version makes a new index; the older one's by-hash copies stay.
+    let old_hash = &entries
+        .iter()
+        .find(|(_, _, p)| p == "main/binary-amd64/Packages")
+        .unwrap()
+        .0;
+    let (status, _) = apt.post(&deb("hello", "1.1-1", "amd64", "utils")).await;
+    assert_eq!(status, StatusCode::CREATED);
+    let newer = apt.text("dists/bookworm/main/binary-amd64/Packages").await;
+    assert!(newer.contains("Version: 1.0-1\n") && newer.contains("Version: 1.1-1\n"));
+    assert!(
+        newer.find("Version: 1.0-1").unwrap() < newer.find("Version: 1.1-1").unwrap(),
+        "versions in Debian order"
+    );
+    let (status, older) = apt
+        .get(&format!(
+            "dists/bookworm/main/binary-amd64/by-hash/SHA256/{old_hash}"
+        ))
+        .await;
+    assert_eq!(status, StatusCode::OK);
+    assert_eq!(String::from_utf8(older).unwrap(), packages);
+
+    // DELETE of a pool file deletes the version, and the index follows.
+    let resp = apt
+        .req(
+            reqwest::Method::DELETE,
+            "pool/main/h/hello/hello_1.0-1_amd64.deb",
+        )
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(resp.status(), StatusCode::NO_CONTENT);
+    let after = apt.text("dists/bookworm/main/binary-amd64/Packages").await;
+    assert!(!after.contains("Version: 1.0-1\n"), "{after}");
+    assert_eq!(
+        apt.get("pool/main/h/hello/hello_1.0-1_amd64.deb").await.0,
+        StatusCode::NOT_FOUND
+    );
+
+    // The web UI's browse lists every version, `-` or not.
+    let (u, p) = srv.admin_basic();
+    let browse: Value = srv
+        .client()
+        .get(format!("{}/browse/packages?repo={name}", srv.base_url))
+        .basic_auth(&u, Some(&p))
+        .send()
+        .await
+        .unwrap()
+        .json()
+        .await
+        .unwrap();
+    let ids: Vec<&str> = browse["items"]
+        .as_array()
+        .unwrap()
+        .iter()
+        .map(|i| i["id"].as_str().unwrap())
+        .collect();
+    assert!(ids.contains(&"hello:amd64"), "{browse}");
+}
+
+/// Send `method path` as it is (no client-side normalization).
+async fn raw_status(srv: &TestServer, method: &str, path: &str, auth: &str) -> u16 {
+    let addr = srv.base_url.trim_start_matches("http://");
+    let mut stream = tokio::net::TcpStream::connect(addr).await.unwrap();
+    let request = format!(
+        "{method} {path} HTTP/1.1\r\nHost: {addr}\r\nAuthorization: Basic {auth}\r\nContent-Length: 1\r\nConnection: close\r\n\r\nx"
+    );
+    stream.write_all(request.as_bytes()).await.unwrap();
+    let mut response = Vec::new();
+    stream.read_to_end(&mut response).await.unwrap();
+    let text = String::from_utf8_lossy(&response);
+    text.split(' ')
+        .nth(1)
+        .and_then(|s| s.parse().ok())
+        .unwrap_or_else(|| panic!("no status in {text:?}"))
+}
+
+#[tokio::test]
+async fn path_traversal_is_refused() {
+    use base64::Engine as _;
+    let srv = common::start().await;
+    let name = format!("apttrav{}", unique());
+    create(
+        &srv,
+        json!({"name": name, "kind": "hosted", "format": "apt", "options": {"distribution": "bookworm"}}),
+    )
+    .await;
+    let apt = Apt::new(&srv, &name).await;
+    assert_eq!(
+        apt.post(&deb("hello", "1.0", "amd64", "utils")).await.0,
+        StatusCode::CREATED
+    );
+    let auth =
+        base64::engine::general_purpose::STANDARD.encode(format!("{}:{}", apt.user, apt.token));
+    for (method, path) in [
+        ("GET", "dists/bookworm/../../../etc/passwd"),
+        ("GET", "dists/%2e%2e/bookworm/InRelease"),
+        ("GET", "pool/main/h/hello/%2e%2e/hello_1.0_amd64.deb"),
+        ("GET", "pool/main/h%2Fhello/hello_1.0_amd64.deb"),
+        ("GET", "pool//main/h/hello/hello_1.0_amd64.deb"),
+        ("GET", "pool/main/h/hello/..%5chello_1.0_amd64.deb"),
+        ("PUT", "..%2fx.deb"),
+        ("PUT", "%2e%2e/x.deb"),
+        ("DELETE", "pool/main/h/hello/%2e%2e/hello_1.0_amd64.deb"),
+    ] {
+        let status = raw_status(&srv, method, &format!("/repository/{name}/{path}"), &auth).await;
+        assert!(
+            status == 400 || status == 404,
+            "{method} {path} answered {status}"
+        );
+    }
+    // The package is untouched.
+    assert_eq!(
+        apt.get("pool/main/h/hello/hello_1.0_amd64.deb").await.0,
+        StatusCode::OK
+    );
+}
+
+#[tokio::test]
+async fn signing_keys_rotate() {
+    let srv = common::start().await;
+    let name = format!("aptkeys{}", unique());
+    create(
+        &srv,
+        json!({"name": name, "kind": "hosted", "format": "apt", "options": {"distribution": "stable"}}),
+    )
+    .await;
+    let apt = Apt::new(&srv, &name).await;
+    assert_eq!(
+        apt.post(&deb("hello", "1.0", "amd64", "utils")).await.0,
+        StatusCode::CREATED
+    );
+    let old = keys(&srv, &name).await.remove(0);
+    let path = format!("/admin/repositories/{name}/signing-keys");
+
+    // A second key: both sign until the older is deleted.
+    let (status, text) = admin(&srv, reqwest::Method::POST, &path, Some(json!({}))).await;
+    assert_eq!(status, StatusCode::CREATED, "{text}");
+    let new: Value = serde_json::from_str(&text).unwrap();
+    assert!(new.get("secret_key").is_none());
+    let (message, _) = in_release(&apt.text("dists/stable/InRelease").await);
+    assert_eq!(message.signatures().len(), 2);
+    message.verify(&public(&old)).unwrap();
+    message.verify(&public(&new)).unwrap();
+    let release = apt.text("dists/stable/Release").await;
+    let (_, detached) = apt.get("dists/stable/Release.gpg").await;
+    let (signatures, _) = DetachedSignature::from_armor_many(&detached[..]).unwrap();
+    assert_eq!(signatures.count(), 2);
+    let _ = release;
+    // key.asc holds both keys.
+    let armored = apt.text("key.asc").await;
+    let (keyring, _) = SignedPublicKey::from_armor_many(armored.as_bytes()).unwrap();
+    assert_eq!(keyring.count(), 2);
+
+    // The older key goes; the last key stays.
+    let fingerprint = old["fingerprint"].as_str().unwrap();
+    let (status, _) = admin(
+        &srv,
+        reqwest::Method::DELETE,
+        &format!("{path}/{fingerprint}"),
+        None,
+    )
+    .await;
+    assert_eq!(status, StatusCode::NO_CONTENT);
+    let (status, _) = admin(
+        &srv,
+        reqwest::Method::DELETE,
+        &format!("{path}/{}", new["fingerprint"].as_str().unwrap()),
+        None,
+    )
+    .await;
+    assert_eq!(status, StatusCode::CONFLICT);
+    let (message, _) = in_release(&apt.text("dists/stable/InRelease").await);
+    assert_eq!(message.signatures().len(), 1);
+    message.verify(&public(&new)).unwrap();
+    assert!(message.verify(&public(&old)).is_err());
+
+    // An imported key signs too; importing it twice conflicts.
+    let imported = forge_server::indexes::signing::Key::generate("Imported <i@example.com>")
+        .unwrap()
+        .to_sealable()
+        .unwrap();
+    let (status, text) = admin(
+        &srv,
+        reqwest::Method::POST,
+        &path,
+        Some(json!({"secret_key": imported})),
+    )
+    .await;
+    assert_eq!(status, StatusCode::CREATED, "{text}");
+    let (status, _) = admin(
+        &srv,
+        reqwest::Method::POST,
+        &path,
+        Some(json!({"secret_key": imported})),
+    )
+    .await;
+    assert_eq!(status, StatusCode::CONFLICT);
+    let (status, text) = admin(
+        &srv,
+        reqwest::Method::POST,
+        &path,
+        Some(json!({"secret_key": "not a key"})),
+    )
+    .await;
+    assert_eq!(status, StatusCode::BAD_REQUEST, "{text}");
+    let (message, _) = in_release(&apt.text("dists/stable/InRelease").await);
+    assert_eq!(message.signatures().len(), 2);
+
+    // Proxies have no keys.
+    let proxy = format!("aptkeysproxy{}", unique());
+    create(
+        &srv,
+        json!({"name": proxy, "kind": "proxy", "format": "apt", "remote_url": "http://127.0.0.1:9/debian",
+               "options": {"distribution": "bookworm"}}),
+    )
+    .await;
+    let (status, _) = admin(
+        &srv,
+        reqwest::Method::GET,
+        &format!("/admin/repositories/{proxy}/signing-keys"),
+        None,
+    )
+    .await;
+    assert_eq!(status, StatusCode::BAD_REQUEST);
+}
+
+#[tokio::test]
+async fn package_selectors_limit_downloads() {
+    let srv = common::start().await;
+    let name = format!("aptsel{}", unique());
+    create(
+        &srv,
+        json!({"name": name, "kind": "hosted", "format": "apt", "options": {"distribution": "bookworm"}}),
+    )
+    .await;
+    let apt = Apt::new(&srv, &name).await;
+    for package in ["internal-tool", "other-tool"] {
+        assert_eq!(
+            apt.post(&deb(package, "1.0", "amd64", "utils")).await.0,
+            StatusCode::CREATED
+        );
+    }
+    let caller = srv.caller().await;
+    let selector = srv.create_selector(&["internal-*"]).await;
+    srv.grant_role(caller.id, &[(&name, "read", Some(selector))])
+        .await;
+    let get = |path: String| {
+        let client = srv.client();
+        let caller = &caller;
+        async move {
+            client
+                .get(path)
+                .basic_auth(&caller.username, Some(&caller.token))
+                .send()
+                .await
+                .unwrap()
+                .status()
+        }
+    };
+    let base = format!("{}/repository/{name}", srv.base_url);
+    assert_eq!(
+        get(format!(
+            "{base}/pool/main/i/internal-tool/internal-tool_1.0_amd64.deb"
+        ))
+        .await,
+        StatusCode::OK
+    );
+    assert_eq!(
+        get(format!(
+            "{base}/pool/main/o/other-tool/other-tool_1.0_amd64.deb"
+        ))
+        .await,
+        StatusCode::NOT_FOUND
+    );
+    // The signed index is everyone's who reads the repository.
+    assert_eq!(
+        get(format!("{base}/dists/bookworm/InRelease")).await,
+        StatusCode::OK
+    );
+}
+
+// ── Proxies ─────────────────────────────────────────────────────────────────
+
+/// A mock mirror: `/debian/dists/bookworm/...` and `/debian/pool/...`.
+#[derive(Default)]
+struct Mirror {
+    files: Mutex<std::collections::HashMap<String, Vec<u8>>>,
+    /// Requests per path.
+    seen: Mutex<std::collections::HashMap<String, usize>>,
+    down: AtomicBool,
+    requests: AtomicUsize,
+}
+
+async fn mirror(state: Arc<Mirror>) -> String {
+    let router = axum::Router::new().route(
+        "/{*path}",
+        axum::routing::get(
+            move |axum::extract::Path(path): axum::extract::Path<String>| {
+                let state = state.clone();
+                async move {
+                    state.requests.fetch_add(1, Ordering::SeqCst);
+                    *state.seen.lock().unwrap().entry(path.clone()).or_default() += 1;
+                    if state.down.load(Ordering::SeqCst) {
+                        return StatusCode::SERVICE_UNAVAILABLE.into_response();
+                    }
+                    match state.files.lock().unwrap().get(&path) {
+                        Some(body) => body.clone().into_response(),
+                        None => StatusCode::NOT_FOUND.into_response(),
+                    }
+                }
+            },
+        ),
+    );
+    let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
+    let addr = listener.local_addr().unwrap();
+    tokio::spawn(async move {
+        axum::serve(listener, router).await.unwrap();
+    });
+    format!("http://{addr}")
+}
+
+#[tokio::test]
+async fn proxies_serve_the_upstream_unchanged() {
+    let srv = common::start().await;
+    let state = Arc::new(Mirror::default());
+    let url = mirror(state.clone()).await;
+    let hello = deb("hello", "2.10-3", "amd64", "devel");
+    let bad = deb("bad", "1.0", "amd64", "devel");
+    let in_release =
+        b"-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA512\n\nOrigin: Debian\n".to_vec();
+    let packages = format!(
+        "Package: hello\nVersion: 2.10-3\nFilename: pool/main/h/hello/hello_2.10-3_amd64.deb\nSize: {}\nSHA256: {}\n\n\
+         Package: bad\nVersion: 1.0\nFilename: pool/main/b/bad/bad_1.0_amd64.deb\nSize: {}\nSHA256: {}\n",
+        hello.len(),
+        sha256(&hello),
+        bad.len(),
+        "0".repeat(64)
+    );
+    let mut gz = flate2::write::GzEncoder::new(Vec::new(), flate2::Compression::default());
+    gz.write_all(packages.as_bytes()).unwrap();
+    let packages_gz = gz.finish().unwrap();
+    {
+        let mut files = state.files.lock().unwrap();
+        files.insert("debian/dists/bookworm/InRelease".into(), in_release.clone());
+        files.insert(
+            "debian/dists/bookworm/main/binary-amd64/Packages.gz".into(),
+            packages_gz.clone(),
+        );
+        files.insert(
+            format!(
+                "debian/dists/bookworm/main/binary-amd64/by-hash/SHA256/{}",
+                sha256(&packages_gz)
+            ),
+            packages_gz.clone(),
+        );
+        files.insert(
+            "debian/pool/main/h/hello/hello_2.10-3_amd64.deb".into(),
+            hello.clone(),
+        );
+        files.insert("debian/pool/main/b/bad/bad_1.0_amd64.deb".into(), bad);
+        // A by-hash copy whose content is not its hash.
+        files.insert(
+            format!(
+                "debian/dists/bookworm/main/binary-amd64/by-hash/SHA256/{}",
+                "1".repeat(64)
+            ),
+            b"forged".to_vec(),
+        );
+    }
+    let name = format!("aptproxy{}", unique());
+    create(
+        &srv,
+        json!({"name": name, "kind": "proxy", "format": "apt", "remote_url": format!("{url}/debian/"),
+               "metadata_ttl_seconds": 1, "options": {"distribution": "bookworm"}}),
+    )
+    .await;
+    let apt = Apt::new(&srv, &name).await;
+
+    // The upstream's files, unchanged.
+    let (status, body) = apt.get("dists/bookworm/InRelease").await;
+    assert_eq!(status, StatusCode::OK);
+    assert_eq!(body, in_release);
+    let (status, body) = apt
+        .get(&format!(
+            "dists/bookworm/main/binary-amd64/by-hash/SHA256/{}",
+            sha256(&packages_gz)
+        ))
+        .await;
+    assert_eq!(status, StatusCode::OK);
+    assert_eq!(body, packages_gz);
+    let (status, body) = apt.get("pool/main/h/hello/hello_2.10-3_amd64.deb").await;
+    assert_eq!(status, StatusCode::OK);
+    assert_eq!(body, hello);
+    // Another distribution is not this proxy's.
+    assert_eq!(
+        apt.get("dists/bullseye/InRelease").await.0,
+        StatusCode::NOT_FOUND
+    );
+    // A package or a by-hash copy that is not what the index says is refused.
+    assert_eq!(
+        apt.get("pool/main/b/bad/bad_1.0_amd64.deb").await.0,
+        StatusCode::BAD_GATEWAY
+    );
+    assert_eq!(
+        apt.get(&format!(
+            "dists/bookworm/main/binary-amd64/by-hash/SHA256/{}",
+            "1".repeat(64)
+        ))
+        .await
+        .0,
+        StatusCode::BAD_GATEWAY
+    );
+    // Uploads go to hosted repositories.
+    assert_eq!(apt.post(&hello).await.0, StatusCode::METHOD_NOT_ALLOWED);
+
+    // Down: what was cached is served, the metadata TTL past or not, and a
+    // package is never asked for again.
+    tokio::time::sleep(std::time::Duration::from_millis(1100)).await;
+    state.down.store(true, Ordering::SeqCst);
+    let (status, body) = apt.get("dists/bookworm/InRelease").await;
+    assert_eq!(status, StatusCode::OK);
+    assert_eq!(body, in_release);
+    let before = state.requests.load(Ordering::SeqCst);
+    let (status, body) = apt.get("pool/main/h/hello/hello_2.10-3_amd64.deb").await;
+    assert_eq!(status, StatusCode::OK);
+    assert_eq!(body, hello);
+    assert_eq!(state.requests.load(Ordering::SeqCst), before);
+    assert_eq!(
+        state.seen.lock().unwrap()["debian/pool/main/h/hello/hello_2.10-3_amd64.deb"],
+        1
+    );
+}
diff --git a/crates/server/tests/plugin_contract.rs b/crates/server/tests/plugin_contract.rs
index 248d222a..ae381e96 100644
--- a/crates/server/tests/plugin_contract.rs
+++ b/crates/server/tests/plugin_contract.rs
@@ -34,6 +34,9 @@ const PROBE: Descriptor = Descriptor {
         manifest_type: "text/plain",
     },
     upstream_token: UpstreamToken::None,
+    options: &[],
+    prereleases: forge_plugin::api::Prereleases::Dash,
+    indexes: false,
 };
 
 /// A package is text whose first line is `<id> <version>`.
diff --git a/docs/README.md b/docs/README.md
index 79c04db9..f1d952fd 100644
--- a/docs/README.md
+++ b/docs/README.md
@@ -35,6 +35,9 @@ its [quickstart](../README.md#quickstart);
 
 - **NuGet**: the README's [quickstart](../README.md#quickstart) points a
   `dotnet` client at a feed, and the CI guides below publish to one.
+- **[apt repositories](apt.md)**: Debian and Ubuntu packages for `apt`:
+  `.deb` uploads, signed indexes and key rotation, `sources.list` and
+  `auth.conf.d`, proxies of Debian and Ubuntu mirrors.
 - **[Docker / OCI registry](docker.md)**: image repositories (hosted, proxy,
   group), naming, `docker login`, retention and garbage collection.
 - **[npm registries](npm.md)**: npm packages for npm, pnpm, Yarn and Bun:
diff --git a/docs/SUMMARY.md b/docs/SUMMARY.md
index 1c599617..8ac6fb1d 100644
--- a/docs/SUMMARY.md
+++ b/docs/SUMMARY.md
@@ -14,6 +14,7 @@
 
 # Formats
 
+- [apt repositories](apt.md)
 - [Docker / OCI registry](docker.md)
 - [npm registries](npm.md)
 - [Raw file repositories](raw.md)
diff --git a/docs/apt.md b/docs/apt.md
new file mode 100644
index 00000000..b8383b6b
--- /dev/null
+++ b/docs/apt.md
@@ -0,0 +1,257 @@
+# apt repositories
+
+Forge serves Debian packages to `apt`, the way Nexus' apt-hosted and
+apt-proxy repositories do: hosts and container builds install your internal
+`.deb` packages from Forge, and pull Debian or Ubuntu through a cache.
+
+Packages live in repositories of `format: "apt"`, a format plugin built into
+Forge ([`crates/formats/apt`](../crates/formats/apt); `GET /admin/formats`
+lists it), served at `https://<host>/repository/<repository>/`, the path
+Nexus uses: a migrated `sources.list` only changes the host. They come in
+two kinds:
+
+- **hosted**: upload your packages; Forge publishes them as one
+  distribution, with indexes signed by the repository's own OpenPGP key;
+- **proxy**: a cache of a Debian or Ubuntu mirror's distribution, whose
+  signed indexes are passed on unchanged.
+
+Every repository serves one **distribution** (`bookworm`, `jammy`,
+`stable`), its `distribution` option: the name clients write in
+`sources.list`.
+
+## Contents
+
+- [Hosted repositories](#hosted-repositories)
+- [Connecting apt](#connecting-apt)
+- [Uploading packages](#uploading-packages)
+- [What is served](#what-is-served)
+- [Signing keys](#signing-keys)
+- [Proxy repositories](#proxy-repositories)
+- [Permissions](#permissions)
+- [Retention](#retention)
+- [Limitations](#limitations)
+
+## Hosted repositories
+
+```bash
+curl -u admin@example.com:<admin-token> -H 'content-type: application/json' \
+  https://forge.example.com/admin/repositories \
+  -d '{"name": "apt-internal", "kind": "hosted", "format": "apt",
+       "options": {"distribution": "bookworm"}}'
+```
+
+or **Admin → Repositories → New repository**, format *apt (Debian/Ubuntu)*.
+The repository gets an Ed25519 signing key when it is created
+([Signing keys](#signing-keys)).
+
+A package is one architecture of a binary package: its id is
+`<name>:<architecture>` (`hello:amd64`, `tool:all`), Debian's own spelling,
+which package selectors, retention rules and the web UI use. Its version is
+the Debian version, ordered as dpkg orders them (epoch, upstream version,
+revision, `~` before everything): `1.0~rc1` < `1.0` < `1.0-1` < `1:0.9`.
+Every version is a release: a `-` starts a Debian revision, not a
+prerelease label.
+
+The repository's **components** come from the packages' `Section`: a
+package of `Section: contrib/net` is in `contrib`, any other in `main`. Its
+**architectures** are those of its packages; an `all` package is listed
+under every one of them (and under `binary-all`).
+
+## Connecting apt
+
+Each repository's page in the web UI shows these lines with its name, URL
+and distribution filled in, and links its keys.
+
+```bash
+# The repository's signing keys.
+curl -fsSL https://forge.example.com/repository/apt-internal/key.asc \
+  | sudo tee /etc/apt/keyrings/apt-internal.asc > /dev/null
+# The source.
+echo "deb [signed-by=/etc/apt/keyrings/apt-internal.asc] https://forge.example.com/repository/apt-internal/ bookworm main" \
+  | sudo tee /etc/apt/sources.list.d/apt-internal.list
+```
+
+Add the components your packages are in (`main contrib`). A repository
+that does not allow anonymous reads needs credentials: an API token as the
+password, in `/etc/apt/auth.conf.d/` (mode 600):
+
+```
+machine forge.example.com/repository/apt-internal
+login ci@example.com
+password <token>
+```
+
+apt sends credentials over plain HTTP only to a machine written with its
+scheme (`machine http://forge.internal:8421/repository/apt-internal`).
+Anonymous reads follow the repository's *Allow anonymous read*, as for
+every format.
+
+Then `apt-get update` and `apt-get install` as usual.
+
+## Uploading packages
+
+With an API token as the password (a password typed at the web login is not
+an upload credential), any of:
+
+```bash
+# Nexus' upload: the package as the body of a POST to the repository.
+curl -u ci@example.com:<token> -H "Content-Type: multipart/form-data" \
+  --data-binary "@hello_2.10-3_amd64.deb" https://forge.example.com/repository/apt-internal/
+# A form.
+curl -u ci@example.com:<token> -F "package=@hello_2.10-3_amd64.deb" \
+  https://forge.example.com/repository/apt-internal/
+# A PUT.
+curl -u ci@example.com:<token> --upload-file hello_2.10-3_amd64.deb \
+  https://forge.example.com/repository/apt-internal/
+```
+
+The package's `control` file says what it is (`Package`, `Version`,
+`Architecture`; the control member compressed with gzip, xz or zstd, or
+not at all). An upload answers `201`; a version that exists answers `409`
+unless the repository's deployment policy allows redeploying, a file that is
+not a binary package `400`. Trusted publishing works as for every format
+([trusted-publishing.md](trusted-publishing.md)).
+
+`DELETE` of a package's pool file deletes the version (delete permission):
+
+```bash
+curl -u ci@example.com:<token> -X DELETE \
+  https://forge.example.com/repository/apt-internal/pool/main/h/hello/hello_2.10-3_amd64.deb
+```
+
+## What is served
+
+```
+dists/<distribution>/InRelease                     Release, signed (cleartext)
+dists/<distribution>/Release                       components, architectures, digests
+dists/<distribution>/Release.gpg                   Release's detached signature
+dists/<distribution>/<component>/binary-<arch>/Packages     (also .gz and .xz)
+dists/<distribution>/<component>/binary-<arch>/by-hash/SHA256/<sha256>
+pool/<component>/<prefix>/<name>/<name>_<version>_<arch>.deb
+key.asc, key.gpg                                   the signing keys
+```
+
+`<prefix>` is the name's first letter (`lib` and the next one for a `lib`
+name); a version with an epoch keeps it in the file name
+(`tool_2:3.0_all.deb`).
+
+The indexes are made when a client asks for them and the repository changed
+since: a publish, a delete, an unlist (an unlisted version is not listed), a
+new signing key or another distribution. A new index replaces the previous
+one all at once, and `Release` says `Acquire-By-Hash: yes`: every index file
+is also served by its SHA-256, and those copies stay a day after a newer
+index no longer names them, so a client never mixes a `Release` and a
+`Packages` of two generations. The `Release` file is signed with every key
+of the repository, with SHA-512.
+
+The web UI browses a repository by distribution, component and
+architecture: its `Release` (date, components, architectures) and, for a
+hosted repository, the packages of each component and architecture, each
+linking to its page.
+
+## Signing keys
+
+A hosted repository signs its indexes with its own OpenPGP keys, kept
+encrypted with Forge's secret encryption (`[crypto]`,
+[deployment.md](deployment.md)); a secret key never leaves the server.
+**Admin → Repositories → (the repository)** shows its keys, and the admin
+API manages them:
+
+```bash
+# The keys: fingerprint, algorithm, user id, public key.
+curl -u admin@example.com:<admin-token> \
+  https://forge.example.com/admin/repositories/apt-internal/signing-keys
+# Generate another key.
+curl -u admin@example.com:<admin-token> -X POST -H 'content-type: application/json' -d '{}' \
+  https://forge.example.com/admin/repositories/apt-internal/signing-keys
+# Import one (an ASCII-armored secret key, with its passphrase if it has one).
+jq -n --rawfile key private.asc '{secret_key: $key, passphrase: "…"}' \
+  | curl -u admin@example.com:<admin-token> -X POST -H 'content-type: application/json' -d @- \
+    https://forge.example.com/admin/repositories/apt-internal/signing-keys
+# Delete one (never the last).
+curl -u admin@example.com:<admin-token> -X DELETE \
+  https://forge.example.com/admin/repositories/apt-internal/signing-keys/<fingerprint>
+```
+
+Keys are v4 **Ed25519** (EdDSA) keys, which `gpgv` 2.1 and later verify
+(Debian 9, Ubuntu 18.04 and newer). Forge generates them so, and imports
+only them: `gpg --quick-gen-key 'apt-internal <apt@example.com>' ed25519
+sign` makes one to import. An imported key's passphrase is removed: the
+secret encryption protects it instead.
+
+**Rotating a key.** Every key of a repository signs, so a rotation needs no
+downtime:
+
+1. Add the new key (generate or import). `InRelease` and `Release.gpg` now
+   carry a signature of each key; a client trusting either one verifies
+   them, without a warning.
+2. Give clients the new key: `key.asc` (and `key.gpg`) hold every key, so
+   downloading it again into `/etc/apt/keyrings/` is enough.
+3. Delete the old key.
+
+## Proxy repositories
+
+```bash
+curl -u admin@example.com:<admin-token> -H 'content-type: application/json' \
+  https://forge.example.com/admin/repositories \
+  -d '{"name": "debian", "kind": "proxy", "format": "apt",
+       "remote_url": "http://deb.debian.org/debian",
+       "options": {"distribution": "bookworm"}}'
+```
+
+A proxy serves one distribution of its upstream (`bookworm-updates` and
+`bookworm-security`, on `http://security.debian.org/debian-security`, are
+proxies of their own) and the whole pool. Its files are the upstream's,
+unchanged, so clients verify them with the upstream's keys:
+
+```
+deb [signed-by=/usr/share/keyrings/debian-archive-keyring.gpg] https://forge.example.com/repository/debian/ bookworm main
+```
+
+- `InRelease`, `Release` and the other indexes are re-validated with the
+  upstream once the repository's metadata TTL (`metadata_ttl_seconds`, 10
+  minutes by default) has passed; `by-hash/` copies and pool files never
+  change, and are cached on their first download for good.
+- A pool file is checked against the size and SHA-256 the upstream's
+  `Packages` index of its component and architecture gives it (the
+  distribution's `Packages.gz`, else `.xz`, else the plain one), when the
+  index lists it: a file that does not match is not cached, and answers
+  `502`. A `by-hash` copy is checked against its hash.
+- While the upstream is down, what is cached is served; a file the
+  upstream did not have is remembered for the not-found TTL. Upstream
+  credentials are optional (`upstream_username`, `upstream_password`).
+- *Invalidate cache* on the repository's page (or
+  `POST /admin/repositories/{name}/proxy-cache/invalidate`) has the cached
+  indexes re-validated on their next download.
+
+There is no package delay for apt proxies: the indexes are the upstream's,
+signed, and cannot leave a version out.
+
+## Permissions
+
+A repository is read with **read**, uploaded to with **write**, and a
+version deleted with **delete**, as for every format. A package selector
+limits which packages a reader may download (`internal-*` matches
+`internal-tool:amd64`) and upload; the signed indexes are the same for every
+reader, so they name every package of the repository. Give a team that may
+not see some packages a repository of its own.
+
+## Retention
+
+A hosted repository's versions follow the repository's retention policy,
+ordered by Debian version; the indexes follow on their next request.
+
+## Limitations
+
+- **One distribution per repository.** A hosted repository publishes its
+  packages as one distribution, as Nexus does; serve another distribution
+  from another repository.
+- **No groups.** Nexus has no apt groups; a group would merge its members'
+  indexes and sign them with a key of its own.
+- **A proxy's cache is not trimmed.** Retention does not evict an apt
+  proxy's cached files yet; a proxy keeps every package and index copy it
+  downloaded until it is deleted.
+- **Ed25519 keys only.** RSA and NIST-curve keys are refused: the OpenPGP
+  library's code for them is not constant-time.
+- **Source packages** (`.dsc`, `Sources`) are not hosted; a proxy serves its
+  upstream's.
diff --git a/docs/changes/2.2.0/176.feature.md b/docs/changes/2.2.0/176.feature.md
new file mode 100644
index 00000000..e27d5ebd
--- /dev/null
+++ b/docs/changes/2.2.0/176.feature.md
@@ -0,0 +1,11 @@
+apt repositories for Debian and Ubuntu packages (`"format": "apt"`, served at
+`/repository/<name>/` like Nexus'): hosted repositories take `.deb` uploads
+(Nexus' `curl --data-binary` `POST`, a form or a `PUT`) and publish them as
+one distribution, the repository's `distribution` option, with `InRelease`,
+`Release.gpg` and `Packages` indexes (also `.gz`, `.xz` and `by-hash`) signed
+by Ed25519 keys of the repository's own, which **Admin → Repositories**
+generates, imports and rotates; proxies cache a Debian or Ubuntu mirror's
+distribution, passing its signed indexes on unchanged and checking packages
+against them. Each repository's page shows its `sources.list` line, its key
+and its `auth.conf.d` entry, and browses its distribution by component and
+architecture ([apt repositories](docs/apt.md)).
diff --git a/docs/changes/2.2.0/176.limitation.md b/docs/changes/2.2.0/176.limitation.md
new file mode 100644
index 00000000..276c27a3
--- /dev/null
+++ b/docs/changes/2.2.0/176.limitation.md
@@ -0,0 +1,2 @@
+apt repositories have no groups yet, a hosted one serves one distribution,
+and retention does not evict an apt proxy's cached files.
diff --git a/docs/format-plugins.md b/docs/format-plugins.md
index 374350c7..8e450eb2 100644
--- a/docs/format-plugins.md
+++ b/docs/format-plugins.md
@@ -10,13 +10,15 @@ streaming of package bytes.
 
 Every plugin is built in: a crate under `crates/formats/<id>/` linked into
 the server and called directly, like any other Rust code. Plugins need no
-configuration. Forge ships four: **Docker / OCI**
+configuration. Forge ships five: **Docker / OCI**
 ([`crates/formats/docker`](../crates/formats/docker),
 [Images formats](#images-formats), [docker.md](docker.md)), **NuGet**
 ([`crates/formats/nuget`](../crates/formats/nuget)), **npm**
-([`crates/formats/npm`](../crates/formats/npm), [npm.md](npm.md)) and **raw
+([`crates/formats/npm`](../crates/formats/npm), [npm.md](npm.md)), **raw
 files** ([`crates/formats/raw`](../crates/formats/raw),
-[Files formats](#files-formats)). Helm charts are pushed to Docker
+[Files formats](#files-formats)) and **apt**
+([`crates/formats/apt`](../crates/formats/apt),
+[Signed indexes](#signed-indexes), [apt.md](apt.md)). Helm charts are pushed to Docker
 repositories ([docker.md](docker.md#helm-charts)).
 
 > **Status: preview.** The plugin contract may change in any release. The
@@ -25,7 +27,9 @@ repositories ([docker.md](docker.md#helm-charts)).
 > ([Files formats](#files-formats)), and `render` returns an action, like
 > `handle`; for npm, request bodies, document uploads, changes (tags,
 > deprecations), logins and forwards followed ([npm as a plugin](#npm-as-a-plugin)),
-> and images formats ([Images formats](#images-formats)).
+> and images formats ([Images formats](#images-formats)); for apt, signed
+> indexes ([Signed indexes](#signed-indexes)) and format options
+> ([Format options](#format-options)).
 
 ## Contents
 
@@ -33,6 +37,8 @@ repositories ([docker.md](docker.md#helm-charts)).
 - [How it fits together](#how-it-fits-together)
 - [Files formats](#files-formats)
 - [Images formats](#images-formats)
+- [Signed indexes](#signed-indexes)
+- [Format options](#format-options)
 - [Retention](#retention)
 - [Proxy repositories](#proxy-repositories)
 - [Using a plugin](#using-a-plugin)
@@ -71,6 +77,16 @@ crates/formats/npm/
 ├── src/proxy.rs   # proxies: reading another registry (upstream)
 └── tests/         # the protocol against canned answers
 
+crates/formats/apt/
+├── Cargo.toml
+├── src/lib.rs     # DESCRIPTOR (kinds hosted/proxy, the distribution option,
+│                  # signed indexes) and impl FormatPlugin for Apt
+├── src/version.rs # Debian versions, ordered as dpkg orders them
+├── src/deb.rs, control.rs, manifest.rs  # a .deb's control file, deb822
+├── src/layout.rs  # dists/ and pool/ paths
+├── src/index.rs   # Packages and Release of a hosted repository's packages
+└── src/proxy.rs   # proxies: the upstream's files, packages checked against its index
+
 crates/formats/docker/
 ├── Cargo.toml
 ├── src/lib.rs     # DESCRIPTOR (storage images, kinds hosted/proxy/group)
@@ -352,6 +368,63 @@ requires; the token is the host's, cached for its lifetime.
 `testing::converse_answered` runs `upstream` against canned answers with
 their status and headers, as the Docker plugin's tests do.
 
+## Signed indexes
+
+A package format whose clients read indexes rather than ask for each
+package (apt's `Release` and `Packages`) says `indexes: true` in its
+descriptor. The host then keeps the indexes of its hosted repositories:
+
+- **Made of the packages.** `index` gets every listed version of the
+  repository (its id, version, stored summary, size and digests, by id,
+  then version) and returns the index files: paths, content, content types.
+  The plugin makes them as a pure function of its input (apt's
+  [`index.rs`](../crates/formats/apt/src/index.rs)), so the summary a
+  package format stores at publish should hold what its index lists of a
+  version: making an index reads no package and no manifest.
+- **Signed by the host.** A file names its signed copies, each a cleartext
+  signature or an ASCII-armored detached one (apt's `InRelease` and
+  `Release.gpg` of `Release`). The host signs them with every OpenPGP key of
+  the repository: Ed25519 keys, generated when the repository is created or
+  imported, sealed with the secret encryption, managed under
+  `/admin/repositories/{name}/signing-keys`. The plugin never sees a key;
+  it gets the public keys, as a binary keyring and armored, to publish
+  (apt's `key.gpg` and `key.asc`).
+- **Made when needed.** A request asks for an index file with
+  `index(path)`, answered as `file`. When the repository's listed versions,
+  options or keys, or the format's version, changed since the index was
+  made (a fingerprint the host keeps), the host makes a new one first:
+  no write path needs a hook, and a burst of publishes makes one index.
+- **Replaced at once.** A new index's files are stored, and the previous
+  one's other files deleted, in one transaction, which checks that the
+  packages and keys it was made of are still the repository's. A file
+  marked `immutable` (apt's `by-hash` copies) stays a day after the last
+  index that named it, for clients that read the previous `Release`.
+- **Served as files.** The index files are files of the repository in the
+  host's file store, served with `serve-file` (validators, ranges,
+  conditional requests). A package format may ask `file`, `fetch-file` and
+  `index` and answer `serve-file`: a hosted repository's index files, and
+  a proxy's copies of its upstream's files (apt's proxies pass the
+  upstream's signed indexes and packages on unchanged). `file_package`
+  names the package a file belongs to (apt's pool files), which package
+  selectors decide on; a file of no package (an index) is every reader's.
+
+## Format options
+
+A format's repositories may carry settings of its own (apt's
+`distribution`): the descriptor lists them (`options`: a name, a label, a
+description, the kinds that take one, whether it is required, an example),
+`GET /admin/formats` names them, and the web UI's repository form offers
+them. An administrator sets them in the admin API's `options` (`null` on an
+update clears one that is not required); the plugin checks and normalizes
+each value (`check_option`), and gets the repository's in
+`Repository::options` and a proxy's in `Remote::options`.
+
+Which versions the host's search filter takes for prereleases is the
+descriptor's too (`prereleases`): those with a `-` in the normalized version
+(SemVer: NuGet, npm), or none (apt, whose `-` starts the Debian revision), so
+the web UI lists every version. Retention asks the plugin instead
+(`version_class`, [Retention](#retention)).
+
 ## Retention
 
 The host runs every retention rule ([retention.md](retention.md)) for a
@@ -375,8 +448,9 @@ them; these are the hooks the formats planned next need:
   before its release, so `prerelease_superseded_for_days` deletes them once
   the release exists, and `release_type: snapshots` with `older_than_days`
   deletes builds older than N days.
-- **apt:** `retention_partition` returns a version's architecture, so keep-N
-  counts per package and architecture.
+- **apt:** every version is a release (`version_class`: a `-` starts the
+  Debian revision). A package id is `<name>:<architecture>`, so keep-N already
+  counts per package and architecture, without a `retention_partition`.
 
 Both run inline for every version and rule a run evaluates: keep them quick
 and free of I/O.
@@ -401,7 +475,7 @@ what they say:
 | `manifest(id, version)` | The manifest, verified to be that version's, without downloading the package |
 | `metadata(versions)`, `dating(versions)` | Per version: listing state, publish time, a manifest summary for a version not downloaded yet, and (`dating`) when it was created upstream, which the package delay counts from |
 | `search(query)` | A page of the upstream's search results |
-| `file(path)` | A files format: the file's URL, or none when the upstream cannot have it. The host downloads it (following redirects; credentials go to `remote_url`'s origin only), caches it, and re-validates it with a conditional GET once the repository's `max_age_seconds` has passed (raw: `<remote_url>/<path>`) |
+| `file(path)` | The file's URL, or none when the upstream cannot have it. The host downloads it (following redirects; credentials go to `remote_url`'s origin only), caches it, and re-validates it with a conditional GET once the repository's `max_age_seconds` (a package format: its metadata TTL) has passed (raw: `<remote_url>/<path>`). Answered `file-at`, it says more: that the file never changes (`immutable`: never re-validated, as apt's packages and `by-hash` copies), and the size and SHA-256 the upstream's index gives it, which the host checks before it caches the file (502 when it does not match) |
 | `tags(id)` | The tags the upstream gives the package. The host keeps the last ones read, for when the upstream is down |
 
 Each operation is a conversation: `upstream` either answers or asks for
@@ -463,12 +537,13 @@ cached.
 ## Using a plugin
 
 `GET /admin/formats` lists every format the server can create repositories
-of: the plugins (Docker, NuGet, npm, raw files), each from its descriptor, with
-the repository kinds it supports, what its repositories hold (`storage`:
-`packages`, `files` or `images`) and where its repositories are served. The
-web UI's *New repository* form offers them. Plugins serve **hosted** and
-**group** repositories, and **proxies** when they implement the upstream
-side (all four do).
+of: the plugins (Docker, NuGet, npm, raw files, apt), each from its
+descriptor, with the repository kinds it supports, what its repositories hold
+(`storage`: `packages`, `files` or `images`), its options and whether it keeps
+signed indexes, and where its repositories are served. The web UI's *New
+repository* form offers them. Plugins serve **hosted** and **group**
+repositories (apt: hosted only), and **proxies** when they implement the
+upstream side (all five do).
 
 A repository of a plugin's format is created like any other, with the
 plugin's format id, and served under `/repository`:
@@ -655,10 +730,11 @@ to lift them:
 - **One package file per version.** Formats that publish several files per
   version (PyPI wheels per platform, Maven's jar, pom and sources) need
   multi-asset versions.
-- **Prerelease is "contains a `-`" for searches.** This is right for SemVer
-  formats. Retention asks the plugin (`version_class`, [Retention](#retention)),
-  but the host's search filter (`prerelease`) still reads the `-`; a format
-  with another rule (PEP 440's `1.0a1`) needs the search to ask it too.
+- **Prerelease is "contains a `-`", or nothing is, for searches.** This is
+  right for SemVer formats and apt ([Format options](#format-options)).
+  Retention asks the plugin (`version_class`, [Retention](#retention)), but
+  the host's search filter (`prerelease`) still reads the `-`; a format with
+  another rule (PEP 440's `1.0a1`) needs the search to ask it too.
 - **Listings are bounded.** A response may load at most 2,048 answers, so
   a listing of every package of a repository covers at most about 2,000
   packages.
diff --git a/docs/retention.md b/docs/retention.md
index 0e3ed9ad..6569bdd1 100644
--- a/docs/retention.md
+++ b/docs/retention.md
@@ -302,12 +302,14 @@ hooks of the format contract
 
 NuGet and npm use the generic rules: a version with a `-` is a prerelease,
 any other a release, and a package is one partition. Helm charts are stored
-in Docker repositories and follow the [image rules](#image-rules). Maven and
-apt bring their own when they arrive: Maven's `-SNAPSHOT` builds are
+in Docker repositories and follow the [image rules](#image-rules). apt
+([apt.md](apt.md)) has no prereleases (a `-` starts the Debian revision, so
+every version is a release), orders versions as dpkg does, and counts per
+package and architecture: its package ids are `<name>:<architecture>`.
+Maven brings its own rules when it arrives: its `-SNAPSHOT` builds are
 snapshots counted per snapshot version (the newest N builds of each), its
 releases per `groupId:artifactId`, and `prerelease_superseded_for_days`
-removes a version's snapshots once its release exists; apt counts per
-package and architecture.
+removes a version's snapshots once its release exists.
 
 ## Raw file rules
 
diff --git a/migrations/0012_apt.sql b/migrations/0012_apt.sql
new file mode 100644
index 00000000..961c2307
--- /dev/null
+++ b/migrations/0012_apt.sql
@@ -0,0 +1,57 @@
+-- ---------------------------------------------------------------------------
+-- apt repositories (#176): signing keys, index generations, and files that
+-- never change.
+-- ---------------------------------------------------------------------------
+
+-- A file that never changes at its path: a proxy's copy of an upstream
+-- package or content-addressed index (apt's `pool/` and `by-hash/`), which
+-- is never re-validated, and a hosted repository's content-addressed index
+-- file, which outlives the index that named it by a day (`checked_at`: when
+-- an index last named it).
+ALTER TABLE raw_file ADD COLUMN immutable boolean NOT NULL DEFAULT false;
+
+-- ---------------------------------------------------------------------------
+-- repository_signing_key: the OpenPGP keys that sign a repository's indexes
+--
+-- A repository of a format that keeps signed indexes (apt) has one key from
+-- its creation, generated by Forge or imported. Every key of a repository
+-- signs: during a rollover a repository has two, its clients trust either,
+-- and the older is deleted once they all trust the newer.
+--
+-- `secret_key_enc` is the ASCII-armored transferable secret key, without a
+-- passphrase, sealed with the secret encryption (`[crypto]`) and AAD-bound
+-- to ('repository_signing_key', 'secret_key_enc', <row id>) and the key's
+-- fingerprint. It never leaves the server.
+-- ---------------------------------------------------------------------------
+CREATE TABLE repository_signing_key (
+    id              bigint      GENERATED ALWAYS AS IDENTITY PRIMARY KEY,
+    repository_id   bigint      NOT NULL REFERENCES repository(id) ON DELETE CASCADE,
+    -- The primary key's fingerprint, uppercase hex.
+    fingerprint     text        NOT NULL,
+    -- The signing key's algorithm, for display (`EdDSA`, `RSA 4096`).
+    algorithm       text        NOT NULL,
+    -- The key's primary user id, for display.
+    user_id         text        NOT NULL,
+    -- The ASCII-armored certificate (public key).
+    public_key      text        NOT NULL,
+    secret_key_enc  bytea,
+    created_at      timestamptz NOT NULL DEFAULT now(),
+    UNIQUE (repository_id, fingerprint)
+);
+
+CREATE INDEX repository_signing_key_repository_idx ON repository_signing_key (repository_id);
+
+-- ---------------------------------------------------------------------------
+-- repository_index: the index generation a repository serves
+--
+-- The files of a repository's indexes are `raw_file` rows of the repository.
+-- `fingerprint` digests what they were made of (the listed versions, the
+-- options, the signing keys, the format's version): a client's request for
+-- an index whose fingerprint no longer matches makes a new generation, which
+-- replaces the files all at once.
+-- ---------------------------------------------------------------------------
+CREATE TABLE repository_index (
+    repository_id   bigint      PRIMARY KEY REFERENCES repository(id) ON DELETE CASCADE,
+    fingerprint     text        NOT NULL,
+    generated_at    timestamptz NOT NULL DEFAULT now()
+);
diff --git a/web/src/api/packages.ts b/web/src/api/packages.ts
index 534627f1..796a2cfa 100644
--- a/web/src/api/packages.ts
+++ b/web/src/api/packages.ts
@@ -45,6 +45,8 @@ export interface BrowseRepo {
    * for a format this server does not have installed.
    */
   url?: string
+  /** The settings of its format's own (apt's `distribution`). */
+  options?: Record<string, string>
 }
 
 /**
diff --git a/web/src/api/repositories.ts b/web/src/api/repositories.ts
index c6eb25f0..e45bbb81 100644
--- a/web/src/api/repositories.ts
+++ b/web/src/api/repositories.ts
@@ -95,6 +95,11 @@ export interface RepoView {
    * whether it changed (`0`: never). `null` otherwise.
    */
   max_age_seconds?: number | null
+  /**
+   * The settings of its format's own (`FormatView.options`), by name: apt's
+   * `distribution`. Empty for formats without any.
+   */
+  options?: Record<string, string>
 }
 
 /** A hosted raw repository's deployment policy, as Nexus'. */
@@ -138,6 +143,8 @@ export interface CreateRepo {
   content_disposition?: 'attachment' | 'inline'
   /** Raw proxy only. Absent: a day. */
   max_age_seconds?: number
+  /** The settings of the format's own (`FormatView.options`), by name. */
+  options?: Record<string, string>
 }
 
 /**
@@ -181,6 +188,8 @@ export interface UpdateRepo {
   content_disposition?: 'attachment' | 'inline'
   /** Raw proxy only; `null` clears it (a day). */
   max_age_seconds?: number | null
+  /** Each one given is set (`null` clears one that is not required). */
+  options?: Record<string, string | null>
 }
 
 /**
@@ -202,6 +211,50 @@ export interface FormatView {
   default_max_upload_bytes?: number
   /** The largest upload limit a repository may be given; `null`: unbounded. */
   max_upload_bytes_limit?: number | null
+  /** The settings of the format's own its repositories carry (apt's distribution). */
+  options?: FormatOption[]
+  /** Its hosted repositories keep indexes signed with keys of their own (apt). */
+  signed_indexes?: boolean
+}
+
+/** A setting of a format's own (`OptionView`). */
+export interface FormatOption {
+  name: string
+  label: string
+  description: string
+  /** The repository kinds that take it. */
+  kinds: RepoKind[]
+  /** Whether every repository of those kinds sets it. */
+  required: boolean
+  /** An example value, for the form's placeholder. */
+  example: string
+}
+
+/** The options of `format` a repository of `kind` takes. */
+export function optionsFor(format: FormatView | undefined, kind: RepoKind): FormatOption[] {
+  return (format?.options ?? []).filter((option) => option.kinds.includes(kind))
+}
+
+/**
+ * An OpenPGP key that signs a repository's indexes (`KeyView` of
+ * `/admin/repositories/{name}/signing-keys`); its secret is never returned.
+ */
+export interface SigningKey {
+  /** The primary key's fingerprint, uppercase hex. */
+  fingerprint: string
+  algorithm: string
+  user_id: string
+  /** The ASCII-armored public key. */
+  public_key: string
+  created_at: string
+}
+
+/** `POST …/signing-keys`: `{}` generates a key, `secret_key` imports one. */
+export interface AddSigningKey {
+  generate?: boolean
+  /** An ASCII-armored OpenPGP secret key. */
+  secret_key?: string
+  passphrase?: string
 }
 
 /**
@@ -278,6 +331,7 @@ export const repoKeys = {
   list: () => ['repositories', 'list'] as const,
   detail: (name: string) => ['repositories', 'detail', name] as const,
   members: (name: string) => ['repositories', 'members', name] as const,
+  signingKeys: (name: string) => ['repositories', 'signing-keys', name] as const,
   trustedPublishers: (name: string) =>
     ['repositories', 'trusted-publishers', name] as const,
 }
@@ -421,3 +475,26 @@ export function deleteTrustedPublisher(name: string, id: number): Promise<void>
     `/admin/repositories/${encodeURIComponent(name)}/trusted-publishers/${id}`,
   )
 }
+
+/** `GET /admin/repositories/{name}/signing-keys` — the keys that sign its indexes. */
+export function fetchSigningKeys(name: string, signal?: AbortSignal): Promise<SigningKey[]> {
+  return httpClient.get<SigningKey[]>(
+    `/admin/repositories/${encodeURIComponent(name)}/signing-keys`,
+    { signal },
+  )
+}
+
+/** `POST /admin/repositories/{name}/signing-keys` — generate or import a key (201). */
+export function addSigningKey(name: string, body: AddSigningKey): Promise<SigningKey> {
+  return httpClient.post<SigningKey>(
+    `/admin/repositories/${encodeURIComponent(name)}/signing-keys`,
+    body,
+  )
+}
+
+/** `DELETE /admin/repositories/{name}/signing-keys/{fingerprint}` (204; 409 for the last key). */
+export function deleteSigningKey(name: string, fingerprint: string): Promise<void> {
+  return httpClient.delete<void>(
+    `/admin/repositories/${encodeURIComponent(name)}/signing-keys/${encodeURIComponent(fingerprint)}`,
+  )
+}
diff --git a/web/src/components/AptIndex.test.ts b/web/src/components/AptIndex.test.ts
new file mode 100644
index 00000000..70a0d757
--- /dev/null
+++ b/web/src/components/AptIndex.test.ts
@@ -0,0 +1,28 @@
+import { describe, expect, it } from 'vitest'
+
+import { indexedPackages, parseParagraphs, words } from './AptIndex'
+
+describe('apt indexes', () => {
+  it('reads a Release file', () => {
+    const [release] = parseParagraphs(
+      'Origin: Forge\nSuite: bookworm\nArchitectures: all amd64 arm64\nComponents: contrib main\nSHA256:\n abc 12 main/binary-amd64/Packages\n',
+    )
+    expect(release.Suite).toBe('bookworm')
+    expect(words(release.Architectures)).toEqual(['all', 'amd64', 'arm64'])
+    expect(words(release.Components)).toEqual(['contrib', 'main'])
+    expect(release.SHA256).toBe('\nabc 12 main/binary-amd64/Packages')
+  })
+
+  it('lists the packages of a Packages index by name', () => {
+    expect(
+      indexedPackages(
+        'Package: zeta\nVersion: 1.0-1\nArchitecture: amd64\nDescription: last\n more\n\n' +
+          'Package: alpha\r\nVersion: 2:3.0\r\nArchitecture: all\r\nSection: utils\r\n',
+      ),
+    ).toEqual([
+      { name: 'alpha', version: '2:3.0', architecture: 'all', section: 'utils', summary: undefined },
+      { name: 'zeta', version: '1.0-1', architecture: 'amd64', section: undefined, summary: 'last' },
+    ])
+    expect(indexedPackages('')).toEqual([])
+  })
+})
diff --git a/web/src/components/AptIndex.tsx b/web/src/components/AptIndex.tsx
new file mode 100644
index 00000000..5457a49e
--- /dev/null
+++ b/web/src/components/AptIndex.tsx
@@ -0,0 +1,225 @@
+import { useState } from 'react'
+import { Link } from '@tanstack/react-router'
+import { useQuery } from '@tanstack/react-query'
+
+import { httpClient, type ApiError } from '~/lib/httpClient'
+import {
+  EmptyState,
+  FactList,
+  Notice,
+  Panel,
+  SelectField,
+  Skeleton,
+  Table,
+  TableBody,
+  TableCell,
+  TableHead,
+  TableHeader,
+  TableRow,
+  Toolbar,
+} from '~/components/ui'
+
+/** One deb822 paragraph: its fields by name, values with continuation lines. */
+export type Paragraph = Record<string, string>
+
+/** Parse deb822 text (`Release`, `Packages`) into its paragraphs. */
+export function parseParagraphs(text: string): Paragraph[] {
+  const paragraphs: Paragraph[] = []
+  let current: Paragraph = {}
+  let last: string | null = null
+  for (const raw of text.split('\n')) {
+    const line = raw.replace(/\r$/, '')
+    if (line.trim() === '') {
+      if (Object.keys(current).length > 0) paragraphs.push(current)
+      current = {}
+      last = null
+      continue
+    }
+    if (/^[ \t]/.test(line)) {
+      if (last) current[last] += `\n${line.trim()}`
+      continue
+    }
+    const colon = line.indexOf(':')
+    if (colon <= 0) continue
+    last = line.slice(0, colon)
+    current[last] = line.slice(colon + 1).trim()
+  }
+  if (Object.keys(current).length > 0) paragraphs.push(current)
+  return paragraphs
+}
+
+/** The words of a `Release` field (`Components`, `Architectures`). */
+export function words(value: string | undefined): string[] {
+  return (value ?? '').split(/\s+/).filter((w) => w !== '')
+}
+
+/** A package of a `Packages` index, as the table lists it. */
+export interface IndexedPackage {
+  name: string
+  version: string
+  architecture: string
+  section?: string
+  summary?: string
+}
+
+/** The packages a `Packages` index lists, by name then as listed. */
+export function indexedPackages(text: string): IndexedPackage[] {
+  return parseParagraphs(text)
+    .filter((p) => p.Package)
+    .map((p) => ({
+      name: p.Package,
+      version: p.Version ?? '',
+      architecture: p.Architecture ?? '',
+      section: p.Section,
+      summary: p.Description?.split('\n')[0],
+    }))
+    .sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0))
+}
+
+function useIndexFile(repo: string, path: string, enabled = true) {
+  return useQuery<string, ApiError>({
+    queryKey: ['apt-index', repo, path],
+    queryFn: ({ signal }) =>
+      httpClient.get<string>(`/repository/${encodeURIComponent(repo)}/${path}`, { signal }),
+    enabled,
+  })
+}
+
+/**
+ * An apt repository's distribution, browsed as `apt-get` reads it: the
+ * `Release` file's components and architectures and, for a hosted
+ * repository, the packages its `Packages` index lists for one component and
+ * architecture (each linking to the package). A proxy's indexes are its
+ * upstream's, which can be large: its `Release` is shown, its packages are
+ * the ones clients download through it.
+ */
+export function AptIndex({
+  repo,
+  kind,
+  distribution,
+}: {
+  repo: string
+  kind: string
+  distribution: string
+}) {
+  const dist = encodeURIComponent(distribution)
+  const release = useIndexFile(repo, `dists/${dist}/Release`)
+  const info = release.data ? (parseParagraphs(release.data)[0] ?? {}) : {}
+  const components = words(info.Components)
+  const architectures = words(info.Architectures)
+  const concrete = architectures.filter((a) => a !== 'all')
+  const [component, setComponent] = useState<string | null>(null)
+  const [architecture, setArchitecture] = useState<string | null>(null)
+  const chosenComponent = component ?? components[0]
+  const chosenArchitecture = architecture ?? concrete[0] ?? architectures[0]
+  const hosted = kind === 'hosted'
+  const packages = useIndexFile(
+    repo,
+    `dists/${dist}/${encodeURIComponent(chosenComponent ?? '')}/binary-${encodeURIComponent(chosenArchitecture ?? '')}/Packages`,
+    hosted && !!chosenComponent && !!chosenArchitecture,
+  )
+  const listed = packages.data ? indexedPackages(packages.data) : []
+
+  return (
+    <Panel
+      title={`Distribution ${distribution}`}
+      description={
+        hosted
+          ? 'What apt-get update reads: the signed Release file, and the packages of each component and architecture.'
+          : 'The upstream’s signed Release file, passed through unchanged; packages are cached as clients download them.'
+      }
+      flush={hosted}
+    >
+      {release.isLoading && <Skeleton lines={3} label="Loading the Release file…" />}
+      {release.isError && (
+        <Notice tone="danger" title="Could not load the Release file">
+          {release.error.body || release.error.message}
+        </Notice>
+      )}
+      {release.data && (
+        <div className={hosted ? 'px-4 pt-3' : undefined}>
+          <FactList
+            items={[
+              { term: 'Suite', value: info.Suite ?? info.Codename ?? distribution, mono: true },
+              { term: 'Date', value: info.Date ?? '—' },
+              { term: 'Components', value: components.join(' ') || '—', mono: true },
+              { term: 'Architectures', value: architectures.join(' ') || '—', mono: true },
+            ]}
+          />
+        </div>
+      )}
+      {hosted && release.data && components.length > 0 && (
+        <>
+          <Toolbar>
+            <SelectField
+              label="Component"
+              value={chosenComponent}
+              onChange={(e) => setComponent(e.target.value)}
+            >
+              {components.map((c) => (
+                <option key={c} value={c}>
+                  {c}
+                </option>
+              ))}
+            </SelectField>
+            <SelectField
+              label="Architecture"
+              value={chosenArchitecture}
+              onChange={(e) => setArchitecture(e.target.value)}
+            >
+              {architectures.map((a) => (
+                <option key={a} value={a}>
+                  {a}
+                </option>
+              ))}
+            </SelectField>
+          </Toolbar>
+          {packages.isLoading && <Skeleton variant="table" label="Loading packages…" />}
+          {packages.isError && (
+            <Notice tone="danger" title="Could not load the packages">
+              {packages.error.body || packages.error.message}
+            </Notice>
+          )}
+          {packages.data !== undefined && listed.length === 0 && (
+            <EmptyState bordered={false} title="No packages">
+              Nothing in {chosenComponent} for {chosenArchitecture} yet.
+            </EmptyState>
+          )}
+          {listed.length > 0 && (
+            <Table caption={`Packages of ${chosenComponent} for ${chosenArchitecture}`} dense>
+              <TableHead>
+                <TableHeader>Package</TableHeader>
+                <TableHeader>Version</TableHeader>
+                <TableHeader>Architecture</TableHeader>
+                <TableHeader>Section</TableHeader>
+              </TableHead>
+              <TableBody>
+                {listed.map((p) => (
+                  <TableRow key={`${p.name}:${p.architecture}:${p.version}`}>
+                    <TableCell lead>
+                      <Link
+                        to="/packages/$repo/$id"
+                        params={{ repo, id: `${p.name}:${p.architecture}` }}
+                        className="fg-link font-mono"
+                      >
+                        {p.name}
+                      </Link>
+                      {p.summary && <div className="fg-field-desc">{p.summary}</div>}
+                    </TableCell>
+                    <TableCell nowrap className="font-mono">
+                      {p.version}
+                    </TableCell>
+                    <TableCell nowrap className="font-mono">
+                      {p.architecture}
+                    </TableCell>
+                    <TableCell nowrap>{p.section ?? '—'}</TableCell>
+                  </TableRow>
+                ))}
+              </TableBody>
+            </Table>
+          )}
+        </>
+      )}
+    </Panel>
+  )
+}
diff --git a/web/src/components/PackageConnect.test.ts b/web/src/components/PackageConnect.test.ts
index dd1d7e99..8ed725c3 100644
--- a/web/src/components/PackageConnect.test.ts
+++ b/web/src/components/PackageConnect.test.ts
@@ -1,6 +1,6 @@
 import { describe, expect, it } from 'vitest'
 
-import { connectSnippets, npmrc, yarnrc } from './PackageConnect'
+import { aptAuth, aptSource, connectSnippets, npmrc, yarnrc } from './PackageConnect'
 
 describe('connectSnippets', () => {
   it('gives a format without commands of its own its URL', () => {
@@ -46,3 +46,47 @@ describe('npmrc', () => {
     )
   })
 })
+
+describe('apt', () => {
+  const url = 'https://forge.example.com/repository/apt-internal'
+
+  it('trusts the repository key, adds the source and uploads like Nexus', () => {
+    const snippets = connectSnippets('apt', 'apt-internal', url, true, {
+      kind: 'hosted',
+      options: { distribution: 'bookworm' },
+    })
+    expect(snippets.map((s) => s.command)).toEqual([
+      `curl -fsSL ${url}/key.asc | sudo tee /etc/apt/keyrings/apt-internal.asc > /dev/null`,
+      `echo "deb [signed-by=/etc/apt/keyrings/apt-internal.asc] ${url}/ bookworm main" | sudo tee /etc/apt/sources.list.d/apt-internal.list`,
+      `curl -u <username>:<token> -H "Content-Type: multipart/form-data" --data-binary "@<package>.deb" ${url}/`,
+    ])
+    expect(
+      connectSnippets('apt', 'apt-internal', url, false, {
+        kind: 'hosted',
+        options: { distribution: 'bookworm' },
+      }),
+    ).toHaveLength(2)
+  })
+
+  it("points a proxy's clients at the upstream's keyring", () => {
+    const [source] = connectSnippets('apt', 'debian', url, false, {
+      kind: 'proxy',
+      options: { distribution: 'bookworm-security' },
+    })
+    expect(source.command).toContain('signed-by=/usr/share/keyrings/debian-archive-keyring.gpg')
+    expect(source.command).toContain(`${url}/ bookworm-security main`)
+  })
+
+  it('writes the sources.list line and the auth.conf entry', () => {
+    expect(aptSource('apt-internal', url, 'jammy')).toBe(
+      `deb [signed-by=/etc/apt/keyrings/apt-internal.asc] ${url}/ jammy main`,
+    )
+    expect(aptAuth(url)).toBe(
+      'machine forge.example.com/repository/apt-internal\nlogin <username>\npassword <token>',
+    )
+    // apt sends credentials over plain HTTP only to an http:// machine.
+    expect(aptAuth('http://localhost:8421/repository/apt').split('\n')[0]).toBe(
+      'machine http://localhost:8421/repository/apt',
+    )
+  })
+})
diff --git a/web/src/components/PackageConnect.tsx b/web/src/components/PackageConnect.tsx
index 0755bc9e..dd4c3fcc 100644
--- a/web/src/components/PackageConnect.tsx
+++ b/web/src/components/PackageConnect.tsx
@@ -9,6 +9,12 @@ interface Snippet {
   copyLabel: string
 }
 
+/** What else the snippets of some formats need: apt's kind and distribution. */
+export interface ConnectContext {
+  kind?: string
+  options?: Record<string, string>
+}
+
 /**
  * The client commands for a repository of `format` at `url` (its
  * `/browse/repos` address), named `repo` in the client's configuration.
@@ -20,8 +26,42 @@ export function connectSnippets(
   repo: string,
   url: string,
   canPush: boolean,
+  context: ConnectContext = {},
 ): Snippet[] {
   switch (format) {
+    case 'apt': {
+      const distribution = context.options?.distribution ?? '<distribution>'
+      if (context.kind === 'proxy') {
+        return [
+          {
+            label: 'Add the source (the upstream signs its indexes: trust its keyring)',
+            command: `echo "deb [signed-by=/usr/share/keyrings/debian-archive-keyring.gpg] ${url}/ ${distribution} main" | sudo tee /etc/apt/sources.list.d/${repo}.list`,
+            copyLabel: 'Copy add-source command',
+          },
+        ]
+      }
+      return [
+        {
+          label: 'Trust the repository’s signing keys',
+          command: `curl -fsSL ${url}/key.asc | sudo tee /etc/apt/keyrings/${repo}.asc > /dev/null`,
+          copyLabel: 'Copy key download command',
+        },
+        {
+          label: 'Add the source',
+          command: `echo "${aptSource(repo, url, distribution)}" | sudo tee /etc/apt/sources.list.d/${repo}.list`,
+          copyLabel: 'Copy add-source command',
+        },
+        ...(canPush
+          ? [
+              {
+                label: 'Upload a package',
+                command: `curl -u <username>:<token> -H "Content-Type: multipart/form-data" --data-binary "@<package>.deb" ${url}/`,
+                copyLabel: 'Copy upload command',
+              },
+            ]
+          : []),
+      ]
+    }
     case 'nuget':
       return [
         {
@@ -87,6 +127,26 @@ export function npmrc(url: string): string {
   return `registry=${url}/\n${path}/:_authToken=<token>`
 }
 
+/** The `sources.list` line of a hosted apt repository, its keys at `/etc/apt/keyrings/<repo>.asc`. */
+export function aptSource(repo: string, url: string, distribution: string): string {
+  return `deb [signed-by=/etc/apt/keyrings/${repo}.asc] ${url}/ ${distribution} main`
+}
+
+/**
+ * The `/etc/apt/auth.conf.d/` entry of the repository at `url`: apt sends
+ * credentials over plain HTTP only to a machine written with `http://`.
+ */
+export function aptAuth(url: string): string {
+  let machine = url
+  try {
+    const parsed = new URL(url)
+    machine = `${parsed.protocol === 'http:' ? 'http://' : ''}${parsed.host}${parsed.pathname.replace(/\/$/, '')}`
+  } catch {
+    // Not a URL: shown as it is.
+  }
+  return `machine ${machine}\nlogin <username>\npassword <token>`
+}
+
 /** The `.yarnrc.yml` settings of Yarn 2 and later for the registry at `url`. */
 export function yarnrc(url: string): string {
   return `npmRegistryServer: "${url}/"\nnpmAlwaysAuth: true\nnpmAuthToken: "<token>"`
@@ -103,14 +163,20 @@ export function PackageConnect({
   format,
   repo,
   url,
+  kind,
+  options,
   canPush = false,
 }: {
   format: string
   repo: string
   url: string
+  /** The repository's kind (apt's snippets differ for a proxy). */
+  kind?: string
+  /** The settings of its format's own (apt's distribution). */
+  options?: Record<string, string>
   canPush?: boolean
 }) {
-  const snippets = connectSnippets(format, repo, url, canPush)
+  const snippets = connectSnippets(format, repo, url, canPush, { kind, options })
   const tokens = (
     <Link to="/tokens" className="fg-link">
       Your tokens
@@ -140,9 +206,47 @@ export function PackageConnect({
       {format === 'npm' && (
         <CopyField label="Registry URL" value={`${url}/`} copyLabel="Copy registry URL" />
       )}
+      {format === 'apt' && (
+        <CopyField
+          label="Repository URL"
+          value={`${url}/`}
+          copyLabel="Copy repository URL"
+          description={
+            options?.distribution ? (
+              <>
+                Distribution <code>{options.distribution}</code>, components from the
+                packages’ sections (<code>main</code> unless a section says otherwise).
+              </>
+            ) : undefined
+          }
+        />
+      )}
       {snippets.map((snippet) => (
         <CommandSnippet key={snippet.label} {...snippet} prompt={snippet.command !== url} />
       ))}
+      {format === 'apt' && (
+        <>
+          {kind !== 'proxy' && (
+            <CodeBlock
+              title={`/etc/apt/sources.list.d/${repo}.list`}
+              copyLabel="Copy sources.list line"
+              code={aptSource(repo, url, options?.distribution ?? '<distribution>')}
+              placeholders={['<distribution>']}
+            />
+          )}
+          <CodeBlock
+            title={`/etc/apt/auth.conf.d/${repo}.conf`}
+            copyLabel="Copy auth.conf entry"
+            code={aptAuth(url)}
+          />
+          {kind !== 'proxy' && (
+            <p className="fg-field-desc">
+              Download the signing keys: <a href={`${url}/key.asc`} className="fg-link">key.asc</a>{' '}
+              (armored) or <a href={`${url}/key.gpg`} className="fg-link">key.gpg</a> (binary keyring).
+            </p>
+          )}
+        </>
+      )}
       {format === 'npm' && (
         <>
           <CodeBlock
diff --git a/web/src/components/RepositoryForm.test.tsx b/web/src/components/RepositoryForm.test.tsx
index 2c5e4ed6..cec73b65 100644
--- a/web/src/components/RepositoryForm.test.tsx
+++ b/web/src/components/RepositoryForm.test.tsx
@@ -12,6 +12,7 @@ import {
   bytesToMib,
   mibToBytes,
   toCreateBody,
+  toFormValues,
   toUpdateBody,
   validateDockerHost,
   validateRepoName,
@@ -109,6 +110,86 @@ describe('RepositoryForm', () => {
     })
   })
 
+  it('asks for the options of a format, and sends them', async () => {
+    const apt: FormatView = {
+      id: 'apt',
+      name: 'apt (Debian/Ubuntu)',
+      kinds: ['hosted', 'proxy'],
+      signed_indexes: true,
+      options: [
+        {
+          name: 'distribution',
+          label: 'Distribution',
+          description: 'The distribution clients name in sources.list.',
+          kinds: ['hosted', 'proxy'],
+          required: true,
+          example: 'bookworm',
+        },
+      ],
+    }
+    const user = userEvent.setup()
+    const onSubmit = vi.fn()
+    render(
+      <RepositoryForm
+        mode="create"
+        formats={[NUGET_FORMAT, apt]}
+        submitting={false}
+        onSubmit={onSubmit}
+        onCancel={() => {}}
+      />,
+    )
+    // NuGet has no options.
+    expect(screen.queryByLabelText(/Distribution/)).not.toBeInTheDocument()
+    await user.selectOptions(screen.getByLabelText('Format'), 'apt')
+    await user.type(screen.getByLabelText('Name'), 'apt-internal')
+    // Required: the form refuses to submit without it.
+    await user.click(screen.getByRole('button', { name: 'Create repository' }))
+    expect(onSubmit).not.toHaveBeenCalled()
+    expect(screen.getByText('Distribution is required.')).toBeInTheDocument()
+    await user.type(screen.getByLabelText(/Distribution/), ' bookworm ')
+    await user.click(screen.getByRole('button', { name: 'Create repository' }))
+    expect(toCreateBody(lastValues(onSubmit))).toMatchObject({
+      name: 'apt-internal',
+      format: 'apt',
+      options: { distribution: 'bookworm' },
+    })
+  })
+
+  it('sends a changed option on edit, and nothing for an unchanged one', () => {
+    const stored: RepoView = {
+      id: 7,
+      name: 'apt-internal',
+      format: 'apt',
+      kind: 'hosted',
+      anonymous_read: false,
+      online: true,
+      remote_url: null,
+      package_delay_seconds: 0,
+      upstream_username: null,
+      has_upstream_password: false,
+      metadata_ttl_seconds: null,
+      not_found_ttl_seconds: null,
+      allow_redeploy: false,
+      prefer_hosted: false,
+      reserved_prefixes: [],
+      host: null,
+      immutable_tags: false,
+      latest_mutable: false,
+      writable_member: null,
+      max_upload_bytes: null,
+      deployment_policy: 'disable_redeploy',
+      options: { distribution: 'bookworm' },
+    }
+    const values = (options: Record<string, string>): RepoFormValues => ({
+      ...toFormValues(stored),
+      options,
+    })
+    expect(toUpdateBody(values({ distribution: 'bookworm' }), stored)).toEqual({})
+    expect(toUpdateBody(values({ distribution: 'trixie' }), stored)).toEqual({
+      options: { distribution: 'trixie' },
+    })
+  })
+
   it('shows a stored format read-only on edit', () => {
     renderEdit({ ...storedProxy, kind: 'hosted', format: 'example' })
     expect(screen.getByLabelText('Format')).toHaveValue('example')
diff --git a/web/src/components/RepositoryForm.tsx b/web/src/components/RepositoryForm.tsx
index a3aeee55..0c9abdcf 100644
--- a/web/src/components/RepositoryForm.tsx
+++ b/web/src/components/RepositoryForm.tsx
@@ -1,12 +1,13 @@
 import { useState, type ReactNode } from 'react'
 
-import type {
-  CreateRepo,
-  DeploymentPolicy,
-  FormatView,
-  RepoKind,
-  RepoView,
-  UpdateRepo,
+import {
+  optionsFor,
+  type CreateRepo,
+  type DeploymentPolicy,
+  type FormatView,
+  type RepoKind,
+  type RepoView,
+  type UpdateRepo,
 } from '~/api/repositories'
 import {
   Button,
@@ -214,6 +215,8 @@ export interface RepoFormValues {
   inline_content: boolean
   /** Raw proxy: seconds before a cached file is re-validated; blank = a day. */
   max_age_seconds: string
+  /** The settings of the format's own (`FormatView.options`), by name. */
+  options: Record<string, string>
 }
 
 export interface RepositoryFormProps {
@@ -274,9 +277,13 @@ function seed(existing?: RepoView): RepoFormValues {
       existing.max_age_seconds !== DEFAULT_RAW_MAX_AGE_SECONDS
         ? String(existing.max_age_seconds)
         : '',
+    options: { ...(existing?.options ?? {}) },
   }
 }
 
+/** The form's values seeded from `existing` (the defaults without one). */
+export const toFormValues = seed
+
 const MIB = 1024 * 1024
 
 /** Bytes as MiB for the upload-limit field: whole MiB, or up to 6 decimals. */
@@ -391,6 +398,11 @@ export function RepositoryForm({
       const hostError = validateDockerHost(values.host)
       if (hostError) next.host = hostError
     }
+    for (const option of optionsFor(format, values.kind)) {
+      if (option.required && (values.options[option.name] ?? '').trim() === '') {
+        next[`option:${option.name}`] = `${option.label} is required.`
+      }
+    }
     if (values.kind === 'hosted' && values.max_upload_mib.trim() !== '') {
       const bytes = mibToBytes(values.max_upload_mib)
       const ceiling = format.max_upload_bytes_limit
@@ -427,9 +439,17 @@ export function RepositoryForm({
       ...v,
       format: next.id,
       kind: next.kinds.includes(v.kind) ? v.kind : 'hosted',
+      // Options are the format's own.
+      options: next.id === v.format ? v.options : {},
     }))
   }
 
+  function setOption(name: string, value: string) {
+    setValues((v) => ({ ...v, options: { ...v.options, [name]: value } }))
+  }
+
+  const formatOptions = optionsFor(format, values.kind)
+
   const isProxy = values.kind === 'proxy'
   const isHosted = values.kind === 'hosted'
   const isGroup = values.kind === 'group'
@@ -534,6 +554,21 @@ export function RepositoryForm({
             )}
           </div>
 
+          {formatOptions.map((option) => (
+            <TextField
+              key={option.name}
+              label={option.label}
+              type="text"
+              mono
+              optional={!option.required}
+              placeholder={option.example}
+              value={values.options[option.name] ?? ''}
+              onChange={(e) => setOption(option.name, e.target.value)}
+              error={announced(errors[`option:${option.name}`])}
+              description={option.description}
+            />
+          ))}
+
           <Switch
             label="Online"
             checked={values.online}
@@ -736,7 +771,7 @@ export function RepositoryForm({
               />
             )}
 
-            {!isDocker && !isRaw && (
+            {!isDocker && !isRaw && !format.signed_indexes && (
               <TextField
                 label="Package delay (seconds)"
                 type="number"
@@ -1076,6 +1111,12 @@ export function toCreateBody(values: RepoFormValues): CreateRepo {
   }
   // Absent means NuGet, the server's default.
   if (values.format !== 'nuget') body.format = values.format
+  const options = Object.fromEntries(
+    Object.entries(values.options)
+      .map(([name, value]) => [name, value.trim()] as const)
+      .filter(([, value]) => value !== ''),
+  )
+  if (Object.keys(options).length > 0) body.options = options
   if (docker && values.host.trim() !== '') {
     body.host = values.host.trim()
   }
@@ -1161,6 +1202,14 @@ export function toUpdateBody(
     body.anonymous_read = values.anonymous_read
   }
   if (values.online !== before.online) body.online = values.online
+  const changed: Record<string, string | null> = {}
+  for (const [name, raw] of Object.entries(values.options)) {
+    const value = raw.trim()
+    if (value !== (before.options[name] ?? '').trim()) {
+      changed[name] = value === '' ? null : value
+    }
+  }
+  if (Object.keys(changed).length > 0) body.options = changed
   if (
     !docker &&
     values.kind === 'hosted' &&
diff --git a/web/src/components/SigningKeysPanel.tsx b/web/src/components/SigningKeysPanel.tsx
new file mode 100644
index 00000000..22558108
--- /dev/null
+++ b/web/src/components/SigningKeysPanel.tsx
@@ -0,0 +1,154 @@
+import { useState } from 'react'
+
+import type { RepoView } from '~/api/repositories'
+import {
+  useAddSigningKey,
+  useDeleteSigningKey,
+  useSigningKeys,
+} from '~/queries/useRepositories'
+import {
+  Button,
+  CodeBlock,
+  Notice,
+  Panel,
+  Skeleton,
+  TextField,
+  TextareaField,
+} from '~/components/ui'
+
+/** A fingerprint in groups of four, as gpg prints it. */
+export function groupedFingerprint(fingerprint: string): string {
+  return fingerprint.replace(/(.{4})(?=.)/g, '$1 ')
+}
+
+/**
+ * The OpenPGP keys that sign a hosted apt repository's indexes
+ * (`/admin/repositories/{name}/signing-keys`). Every key signs, so a key is
+ * rotated by adding the new one (generated, or imported with its
+ * passphrase), letting clients trust it, then deleting the old one; the
+ * last key cannot be deleted. Secret keys are never shown. A panel of the
+ * edit screen.
+ */
+export function SigningKeysPanel({ repo }: { repo: RepoView }) {
+  const keys = useSigningKeys(repo.name)
+  const add = useAddSigningKey(repo.name)
+  const remove = useDeleteSigningKey(repo.name)
+  const [importing, setImporting] = useState(false)
+  const [secretKey, setSecretKey] = useState('')
+  const [passphrase, setPassphrase] = useState('')
+  const keyUrl = `/repository/${encodeURIComponent(repo.name)}/key.asc`
+
+  function generate() {
+    add.mutate({})
+  }
+
+  function submitImport(e: React.FormEvent) {
+    e.preventDefault()
+    add.mutate(
+      { secret_key: secretKey, ...(passphrase !== '' ? { passphrase } : {}) },
+      {
+        onSuccess: () => {
+          setSecretKey('')
+          setPassphrase('')
+          setImporting(false)
+        },
+      },
+    )
+  }
+
+  const list = keys.data ?? []
+  return (
+    <Panel
+      title="Signing keys"
+      description={
+        <>
+          Every key signs the repository’s <code>InRelease</code> and <code>Release.gpg</code>.
+          To rotate, add a key, let clients download <a href={keyUrl} className="fg-link">key.asc</a>{' '}
+          (it holds every key), then delete the old one.
+        </>
+      }
+    >
+      {keys.isLoading && <Skeleton lines={3} label="Loading signing keys…" />}
+      {keys.isError && (
+        <Notice tone="danger" title="Could not load the signing keys">
+          {keys.error.body || keys.error.message}
+        </Notice>
+      )}
+      {list.map((key) => (
+        <div key={key.fingerprint} className="flex flex-col gap-2">
+          <CodeBlock
+            title={
+              <>
+                {key.user_id || 'Key'} · {key.algorithm} · <span className="font-mono">{groupedFingerprint(key.fingerprint)}</span>
+              </>
+            }
+            copyLabel={`Copy public key ${key.fingerprint}`}
+            code={key.public_key}
+            placeholders={[]}
+          />
+          <div>
+            <Button
+              variant="danger"
+              size="sm"
+              icon="Trash"
+              disabled={list.length < 2 || remove.isPending}
+              title={list.length < 2 ? 'A repository keeps at least one signing key.' : undefined}
+              onClick={() => remove.mutate(key.fingerprint)}
+            >
+              Delete key
+            </Button>
+          </div>
+        </div>
+      ))}
+      {remove.isError && (
+        <Notice tone="danger" title="Could not delete the key">
+          {remove.error.body || remove.error.message}
+        </Notice>
+      )}
+      <div className="flex flex-wrap gap-2">
+        <Button type="button" icon="Key" onClick={generate} disabled={add.isPending}>
+          {add.isPending && !importing ? 'Generating…' : 'Generate a new key'}
+        </Button>
+        <Button
+          type="button"
+          variant="secondary"
+          icon="Upload"
+          onClick={() => setImporting((v) => !v)}
+        >
+          Import a key
+        </Button>
+      </div>
+      {importing && (
+        <form onSubmit={submitImport} className="flex flex-col gap-3">
+          <TextareaField
+            label="Secret key"
+            mono
+            rows={6}
+            value={secretKey}
+            onChange={(e) => setSecretKey(e.target.value)}
+            placeholder="-----BEGIN PGP PRIVATE KEY BLOCK-----"
+            description="ASCII-armored (gpg --armor --export-secret-keys <id>). It is kept encrypted, without its passphrase, and never shown again."
+          />
+          <TextField
+            label="Passphrase"
+            type="password"
+            optional
+            value={passphrase}
+            onChange={(e) => setPassphrase(e.target.value)}
+            autoComplete="off"
+          />
+          <div>
+            <Button type="submit" disabled={add.isPending || secretKey.trim() === ''}>
+              {add.isPending ? 'Importing…' : 'Import key'}
+            </Button>
+          </div>
+        </form>
+      )}
+      {add.isError && (
+        <Notice tone="danger" title="Could not add the key">
+          {add.error.body || add.error.message}
+        </Notice>
+      )}
+    </Panel>
+  )
+}
diff --git a/web/src/queries/useRepositories.ts b/web/src/queries/useRepositories.ts
index 177a288e..3d8d9402 100644
--- a/web/src/queries/useRepositories.ts
+++ b/web/src/queries/useRepositories.ts
@@ -11,6 +11,9 @@ import { pkgKeys } from '~/api/packages'
 import { rawKeys } from '~/api/raw'
 import {
   addMember,
+  addSigningKey,
+  deleteSigningKey,
+  fetchSigningKeys,
   createTrustedPublisher,
   createRepository,
   deleteTrustedPublisher,
@@ -28,12 +31,14 @@ import {
   updateRepository,
   updateTrustedPublisher,
   type AddMember,
+  type AddSigningKey,
   type CreateRepo,
   type FormatView,
   type InvalidateProxyCache,
   type MemberView,
   type ProxyCacheInvalidated,
   type RepoView,
+  type SigningKey,
   type UpdateRepo,
   type TrustedPublisherBody,
   type TrustedPublisherView,
@@ -236,3 +241,33 @@ export function useDeleteTrustedPublisher(name: string) {
     deleteTrustedPublisher(name, id),
   )
 }
+
+/** The keys that sign a repository's indexes (`GET …/signing-keys`, apt). */
+export function useSigningKeys(name: string) {
+  return useQuery<SigningKey[], ApiError>({
+    queryKey: repoKeys.signingKeys(name),
+    queryFn: ({ signal }) => fetchSigningKeys(name, signal),
+  })
+}
+
+/** Generate or import a signing key; refreshes the repository's keys. */
+export function useAddSigningKey(name: string) {
+  const queryClient = useQueryClient()
+  return useMutation<SigningKey, ApiError, AddSigningKey>({
+    mutationFn: (body) => addSigningKey(name, body),
+    onSuccess: () => {
+      void queryClient.invalidateQueries({ queryKey: repoKeys.signingKeys(name) })
+    },
+  })
+}
+
+/** Delete a signing key (not the last); refreshes the repository's keys. */
+export function useDeleteSigningKey(name: string) {
+  const queryClient = useQueryClient()
+  return useMutation<void, ApiError, string>({
+    mutationFn: (fingerprint) => deleteSigningKey(name, fingerprint),
+    onSuccess: () => {
+      void queryClient.invalidateQueries({ queryKey: repoKeys.signingKeys(name) })
+    },
+  })
+}
diff --git a/web/src/routes/RepoBrowse.tsx b/web/src/routes/RepoBrowse.tsx
index a5aedab5..2f9101ff 100644
--- a/web/src/routes/RepoBrowse.tsx
+++ b/web/src/routes/RepoBrowse.tsx
@@ -18,6 +18,7 @@ import { EmptyState } from '~/components/EmptyState'
 import { DockerConnect } from '~/components/DockerConnect'
 import { PackageConnect } from '~/components/PackageConnect'
 import { RawBrowser } from '~/components/RawBrowser'
+import { AptIndex } from '~/components/AptIndex'
 import {
   Button,
   Checkbox,
@@ -261,12 +262,22 @@ function RepoBrowse() {
                 format={info.format}
                 repo={repo}
                 url={info.url}
+                kind={info.kind}
+                options={info.options}
                 canPush={info.kind === 'hosted'}
               />
             )
           }
           asideLabel="Connect"
         >
+          {info?.format === 'apt' && info.options?.distribution && (
+            <AptIndex
+              key={`${repo}:${info.options.distribution}`}
+              repo={repo}
+              kind={info.kind}
+              distribution={info.options.distribution}
+            />
+          )}
           <PackageBrowse
             repo={repo}
             q={q}
@@ -280,11 +291,14 @@ function RepoBrowse() {
                   onChange={setInput}
                   className="min-w-0 flex-[1_1_280px]"
                 />
-                <Checkbox
-                  label="Include prerelease versions"
-                  checked={prerelease}
-                  onChange={(checked) => togglePrerelease(checked)}
-                />
+                {/* apt has no prereleases: a `-` starts the Debian revision. */}
+                {info?.format !== 'apt' && (
+                  <Checkbox
+                    label="Include prerelease versions"
+                    checked={prerelease}
+                    onChange={(checked) => togglePrerelease(checked)}
+                  />
+                )}
               </>
             }
           />
diff --git a/web/src/routes/admin/repositories/Edit.tsx b/web/src/routes/admin/repositories/Edit.tsx
index 1e633966..e7e6449e 100644
--- a/web/src/routes/admin/repositories/Edit.tsx
+++ b/web/src/routes/admin/repositories/Edit.tsx
@@ -26,6 +26,7 @@ import {
 } from '~/components/ui'
 import { ErrorState } from '~/components/ErrorState'
 import { ProxyCachePanel } from '~/components/ProxyCachePanel'
+import { SigningKeysPanel } from '~/components/SigningKeysPanel'
 import { AnonymousAccessPanel } from '~/components/AnonymousAccessPanel'
 import { IMPORT_FORMATS } from '~/api/imports'
 import { TrustedPublishers } from './TrustedPublishers'
@@ -178,6 +179,10 @@ function EditRepository() {
           onSubmit={handleSubmit}
           onCancel={() => void navigate({ to: '/manage/repositories' })}
         />
+        {current.kind === 'hosted' &&
+          formats.data?.find((f) => f.id === current.format)?.signed_indexes && (
+            <SigningKeysPanel key={current.name} repo={current} />
+          )}
         {current.kind === 'hosted' && (
           <TrustedPublishers key={current.name} repository={current.name} />
         )}