{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-099-package-linux-application-dependencies-for-the-vm-s-actual-repository-access/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-099-package-linux-application-dependencies-for-the-vm-s-actual-repository-access/", "slug": "dse-20260909-099-package-linux-application-dependencies-for-the-vm-s-actual-repository-access", "url": "https://update.dsesecurity.com/updates/dse-20260909-099-package-linux-application-dependencies-for-the-vm-s-actual-repository-access/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-099-package-linux-application-dependencies-for-the-vm-s-actual-repository-access.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-099-package-linux-application-dependencies-for-the-vm-s-actual-repository-access/" }, "title": "Package Linux application dependencies for the VM's actual repository access", "summary": "Will a VM Application package install when its target Linux VM cannot download missing dependencies?", "format": { "slug": "checklist", "name": "Checklist" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:30:17+00:00", "modified_at": "2026-09-10T00:35:08+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 2, "word_count": 250, "potentially_affected": "Linux VM Application publishers targeting Azure VMs with restricted internet or repository access.", "dse_recommendation": "Build and test the dependency bundle against the target distribution and its permitted repository paths.", "primary_source": { "name": "Create packages and scripts for VM applications - Azure Virtual Machines | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/virtual-machines/vm-applications-create-app-package", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Microsoft warns that individual Linux package downloads usually omit dependencies. A VM Application must include those dependencies or let the target’s package manager obtain them from reachable repositories; restricted-internet targets need the dependencies packaged. The documented Ubuntu workflow also cautions against explicitly removing every bundled dependency because another installed application may share it. Package and removal design therefore need separate checks. Microsoft Learn.

\n

Applicability

\n

Identify the target distribution, release, architecture, existing package state, and repository access. Treat the source’s example package lists as illustrations rather than an inventory for every current image. Establish which dependencies must travel with the package and which approved repositories will remain available during deployment.

\n

DSE recommendation

\n

Build and test the dependency bundle against the target distribution and its permitted repository paths. Keep a manifest of package versions and provenance with the application version. Design removal around the target package manager’s dependency handling and have the application owner identify shared components that must remain. Avoid solving a missing package by opening unrestricted outbound access without a separate network decision.

\n

Verification

\n

Install the bundle on a representative clean test VM under the intended connectivity restrictions. Check the application’s actual workflow and retain missing-dependency or repository errors. Then rehearse removal while another representative application remains installed, verifying that its shared dependencies still function. Record both installation and removal outcomes so a successful connected build does not substitute for evidence from the restricted target environment.

\n

Official references

\n

Microsoft Learn: Create packages for VM applications. Source reviewed September 9, 2026.

", "content_text": "Source facts\nMicrosoft warns that individual Linux package downloads usually omit dependencies. A VM Application must include those dependencies or let the target’s package manager obtain them from reachable repositories; restricted-internet targets need the dependencies packaged. The documented Ubuntu workflow also cautions against explicitly removing every bundled dependency because another installed application may share it. Package and removal design therefore need separate checks. Microsoft Learn.\nApplicability\nIdentify the target distribution, release, architecture, existing package state, and repository access. Treat the source’s example package lists as illustrations rather than an inventory for every current image. Establish which dependencies must travel with the package and which approved repositories will remain available during deployment.\nDSE recommendation\nBuild and test the dependency bundle against the target distribution and its permitted repository paths. Keep a manifest of package versions and provenance with the application version. Design removal around the target package manager’s dependency handling and have the application owner identify shared components that must remain. Avoid solving a missing package by opening unrestricted outbound access without a separate network decision.\nVerification\nInstall the bundle on a representative clean test VM under the intended connectivity restrictions. Check the application’s actual workflow and retain missing-dependency or repository errors. Then rehearse removal while another representative application remains installed, verifying that its shared dependencies still function. Record both installation and removal outcomes so a successful connected build does not substitute for evidence from the restricted target environment.\nOfficial references\nMicrosoft Learn: Create packages for VM applications. Source reviewed September 9, 2026.", "content_markdown": "## Source facts\n\nMicrosoft warns that individual Linux package downloads usually omit dependencies. A VM Application must include those dependencies or let the target’s package manager obtain them from reachable repositories; restricted-internet targets need the dependencies packaged. The documented Ubuntu workflow also cautions against explicitly removing every bundled dependency because another installed application may share it. Package and removal design therefore need separate checks. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/virtual-machines/vm-applications-create-app-package).\n\n## Applicability\n\nIdentify the target distribution, release, architecture, existing package state, and repository access. Treat the source’s example package lists as illustrations rather than an inventory for every current image. Establish which dependencies must travel with the package and which approved repositories will remain available during deployment.\n\n## DSE recommendation\n\nBuild and test the dependency bundle against the target distribution and its permitted repository paths. Keep a manifest of package versions and provenance with the application version. Design removal around the target package manager’s dependency handling and have the application owner identify shared components that must remain. Avoid solving a missing package by opening unrestricted outbound access without a separate network decision.\n\n## Verification\n\nInstall the bundle on a representative clean test VM under the intended connectivity restrictions. Check the application’s actual workflow and retain missing-dependency or repository errors. Then rehearse removal while another representative application remains installed, verifying that its shared dependencies still function. Record both installation and removal outcomes so a successful connected build does not substitute for evidence from the restricted target environment.\n\n## Official references\n\n[Microsoft Learn: Create packages for VM applications](https://learn.microsoft.com/en-us/azure/virtual-machines/vm-applications-create-app-package). Source reviewed September 9, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-099-package-linux-application-dependencies-for-the-vm-s-actual-repository-access/", "url": "https://update.dsesecurity.com/updates/dse-20260909-099-package-linux-application-dependencies-for-the-vm-s-actual-repository-access/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-099-package-linux-application-dependencies-for-the-vm-s-actual-repository-access/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Package Linux application dependencies for the VM's actual repository access", "item": "https://update.dsesecurity.com/updates/dse-20260909-099-package-linux-application-dependencies-for-the-vm-s-actual-repository-access/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-099-package-linux-application-dependencies-for-the-vm-s-actual-repository-access/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-099-package-linux-application-dependencies-for-the-vm-s-actual-repository-access/", "url": "https://update.dsesecurity.com/updates/dse-20260909-099-package-linux-application-dependencies-for-the-vm-s-actual-repository-access/", "headline": "Package Linux application dependencies for the VM's actual repository access", "description": "Will a VM Application package install when its target Linux VM cannot download missing dependencies?", "abstract": "Will a VM Application package install when its target Linux VM cannot download missing dependencies?", "articleBody": "Source facts\nMicrosoft warns that individual Linux package downloads usually omit dependencies. A VM Application must include those dependencies or let the target’s package manager obtain them from reachable repositories; restricted-internet targets need the dependencies packaged. The documented Ubuntu workflow also cautions against explicitly removing every bundled dependency because another installed application may share it. Package and removal design therefore need separate checks. Microsoft Learn.\nApplicability\nIdentify the target distribution, release, architecture, existing package state, and repository access. Treat the source’s example package lists as illustrations rather than an inventory for every current image. Establish which dependencies must travel with the package and which approved repositories will remain available during deployment.\nDSE recommendation\nBuild and test the dependency bundle against the target distribution and its permitted repository paths. Keep a manifest of package versions and provenance with the application version. Design removal around the target package manager’s dependency handling and have the application owner identify shared components that must remain. Avoid solving a missing package by opening unrestricted outbound access without a separate network decision.\nVerification\nInstall the bundle on a representative clean test VM under the intended connectivity restrictions. Check the application’s actual workflow and retain missing-dependency or repository errors. Then rehearse removal while another representative application remains installed, verifying that its shared dependencies still function. Record both installation and removal outcomes so a successful connected build does not substitute for evidence from the restricted target environment.\nOfficial references\nMicrosoft Learn: Create packages for VM applications. Source reviewed September 9, 2026.", "datePublished": "2026-09-10T00:30:17+00:00", "dateModified": "2026-09-10T00:35:08+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-099-package-linux-application-dependencies-for-the-vm-s-actual-repository-access/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-099-package-linux-application-dependencies-for-the-vm-s-actual-repository-access/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Package Linux application dependencies for the VM's actual repository access" }, "articleSection": [ "IT", "Networks & Infrastructure" ], "keywords": [ "IT", "Networks & Infrastructure", "Checklist", "Information priority" ], "genre": "Checklist", "about": [ { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 250, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Create packages and scripts for VM applications - Azure Virtual Machines | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/virtual-machines/vm-applications-create-app-package" } } ] } }