It is not. You are talking about a hack/workaround/different methodology. That hack cannot be natively integrated with the other software that uses a regular id

It is not. You are talking about a hack/workaround/different methodology. That hack cannot be natively integrated with the other software that uses a regular idea of what is a package name and what is a package version (for example, puppet, which ships with Debian). It is a garbage approach just like the APT approach of using a repo manifest for signatures is garbage, and just like approach of not storing crypto hashes of every file in a .deb inside the .deb is garbage. I have provided the challenge in another reply: I have in a repo: package: nginx version: 1.99.77 I need to add to the repo: package: nginx version: 1.99.78 Both of the versions must remain in the repo. Packages must be signed. Repo must be signed. The name of the package cannot change and neither can the version number. Both of the packages must be installable using a flag that specifies a version number passed to one of the standard Debian package install tools (the tool must be in "main" collection ) What is a tool that can be used that is listed https://wiki.debian.org/DebianRepository/Setup https://wiki.debian.org/DebianRepository/Setup as existing in the "main" part of the Debian? For half a point, you can use any tool listed in the wiki. Everything else is the hand waving.