Debian package management, distributions and the /etc/apt/sources.list file

Debian package management

  # apt-cache search string

searches for all packages which contain the specified string.

  # apt-get install package

fetches the package from the Internet and installs it. If there are any unmet dependencies, it automatically fetches and installs everything required to make the package work.

  # apt-get remove package

removes the package, and

  # apt-get --purge remove package

also removes the config files for the package.

In order to do it's work, apt-get maintains a local database of packages, dependencies, locations of files, etc. The essence of Debian's support for multiple distributions at one point in time: we use the same tool (apt-get), but we get it to behave differently by giving him a different database for each different distribution.

An example of apt-get in action --

Suppose I say
     # apt-cache show abcde
     Package: abcde
     Priority: optional
     Section: sound
     Installed-Size: 148
     Maintainer: Robert Woodcock 
     Architecture: all
     Version: 2.0-1
     Replaces: cdgrab
     Provides: cdgrab
     Depends: cd-discid, wget, cdparanoia | cdda2wav, vorbis-tools (>= 1.0beta4-1)
     Suggests: eject, distmp3, id3 (>= 0.12), id3v2
     Conflicts: cdgrab
     Filename: pool/main/a/abcde/abcde_2.0-1_all.deb
     Size: 39234
     MD5sum: b3b37ebf315a6634409fa6f66edbb885
     Description: A Better CD Encoder
      A frontend program to cdparanoia, wget, cd-discid, id3, and your favorite
      Ogg or MP3 encoder (defaults to oggenc). Grabs an entire CD and converts
      each track to Ogg or MP3, then comments or ID3-tags each file, with one

Here the "Depends:" lists out the packages which are absolutely required for running abcde. "Suggests:" is him being helpful that these packages also go well with abcde, but the automated tools do nothing about it. Some of the "Depends:" packages I have already, like wget, but others, I don't. So now when I say:

     # apt-get install abcde
     Reading Package Lists... Done
     Building Dependency Tree... Done
     The following extra packages will be installed:
       cd-discid cdparanoia libao2 vorbis-tools 
     The following NEW packages will be installed:
       abcde cd-discid cdparanoia libao2 vorbis-tools 
     0 packages upgraded, 5 newly installed, 0 to remove and 0  not upgraded.
     Need to get 128kB of archives. After unpacking 623kB will be used.
     Do you want to continue? [Y/n] 

He says that he wants to also install four packages, giving a total of five new packages that will come in. You will say -- Where did libao2 come from? It isn't mentioned as a dependency for abcde. The answer is that it's marked as a dependency for vorbis-tools, so in order to install vorbis-tools, he has to do libao2 too.

The distributions

At any point in time, Debian has three distributions: unstable, testing, stable.

is recommended for the most conservative users. It features a strong system for rapidly reacting to security exploits. It has the latest kernel as of release date, but that's often old when you are looking at it. I believe that by Debian policy, if any package has an "important" bug which is not resolved in 10 days, that package is not accepted into stable. This policy is seriously applied: e.g. there was a time when apache was almost thrown out for not conforming to standards of support that are required for entry into stable.
is the next release of stable, in the wings. It contains packages which don't have release-critical bugs. Packages should have the same version number a cross all architectures that they are present in, and they should have spent atleast two weeks in unstable.
is the wild west of bleeding edge stuff, where developers are still debating what the featureset should be.

A small footnote. The process through which testing becomes stable involves an intermediate step called frozen. At some point, testing is copied into frozen. This means no feature releases; only release-critical uploads take place. At that time there will be a separate testing and unstable also. Once frozen is debugged, it will be renamed stable, and we go back to having 3 distributions.

The distributions have used names of characters from Toy Story 2 for a while now. Right now stable is called `potato', testing is called `woody' and unstable is called `sid'. Fairly soon now, potato will be put into pasture, `woody' will become stable, and `sid' will become testing. I don't know whether these names will change in the future -- I'm eagerly waiting for a jessie.

The /etc/apt/sources.list file

The Debian distribution you use is controlled by /etc/apt/sources.list file. In this file, you specify whether you want stable, testing or unstable. Every time you modify this file, you have to say:

   # apt-get update

to rebuild the package database reflecting your newest sources.list.

Once this is done, if you say

   # apt-get dist-upgrade

everything on your system will get upgraded to the latest versions.

How do you flip from (say) stable to testing? Just modify the sources.list file, and say

   # apt-get update
   # apt-get dist-upgrade

Voila, you have a brand-new Debian distribution on your machine!


My text ahead assumes you're accessing Debian archives using the Internet. If you are using CDs then things are a little different (using a tool called apt-cdrom), and some of these instructions don't quite apply.

Example - stable

The sources.list for using stable reads --

  # See sources.list(5) for more information
  deb stable main contrib non-free
  deb stable/non-US main contrib non-free
  deb stable/updates main contrib non-free

As the comment points out, you can say man 5 sources.list to learn the file format.

Example - testing

You need to include the stable lines, and then add three lines with a s/stable/testing/g, giving the file:

  # See sources.list(5) for more information
  deb stable main contrib non-free
  deb stable/non-US main contrib non-free
  deb stable/updates main contrib non-free

  deb testing main contrib non-free
  deb testing/non-US main contrib non-free
  deb testing/updates main contrib non-free

Accessing other Debian archives

You can add other URLs for Debian packages. For example, my production sources.list reads:

# See sources.list(5) for more information

deb testing main contrib non-free
deb testing/non-US main contrib non-free
deb testing/updates main contrib non-free

# Blackdown Java
deb woody non-free

Where I'm picking up Blackdown Java from

Files and packages

What packages do I have installed?

  # dpkg -l

gives you a list of all installed packages. If you supply an argument, it will only talk about that package:

  # dpkg -l zip
| Status=Not/Installed/Config-files/Unpacked/Failed-config/Half-installed
|/ Err?=(none)/Hold/Reinst-required/X=both-problems (Status,Err: uppercase=bad)
||/ Name           Version        Description
ii  zip            2.30-3         Archiver for .zip files

How does one map existing files to package-names?

For example, I know a (broken) file india.fig is there, I want to know which package supplies this file.

  # dpkg -S `locate india.fig`
  xfig: /usr/share/xfig/Libraries/Maps/Asia/india.fig

This tells me that this file came from the package xfig

Use the source, Luke

If you say

  # apt-get -b source package

apt-get will get hold of the sources for you and compile them. In recent Debian revs, it will also get sources for all dependencies required.

The tool dpkg-buildpackage should also be useful.

Finding out more

There's a Debian package called apt-howto which is useful documentation.

Ajay Shah, 2007.