I have packaged 4.2.9 as a debian package https://steinar.bang.priv.no/2018/01/23/installing-apache-karaf-on-debian/#comment-15434
I have only tested this with openjdk 11 on debian 10.5 "buster" on amd64, but I use it there in production. Note1! I needed to sign karaf 4.2.8 with a different key than earlier releases because of an aptly bug, so anyone already using my APT repository will need to add an extra GPG key. I have updated the apt-key command example in the blog post to reflect this. If you updated the key for 4.2.8 you don't have to do anything new. Heh, it took 14 weeks and 3 days from the karaf 4.2.9 release until I got around to make a deb package. Ironically, this was the simplest deb package upgrade I've done: I just changed the VERSION in the debian/rules file and re-ran dpkg-buildpackage and that was all I had to do (except for republishing the package in aptly) https://github.com/steinarb/karaf-debian/commit/9779a0a4513024ebd077f3442fcd4f8bd177bc79