I want to block all packages from non-free, except for those that I name explicitly. Currently, I have:

/etc/apt/sources.list :

deb http://ftp.us.debian.org/debian stable main contrib non-free

/etc/apt/preferences.d/non-free_policy :

Explanation: Disable packages from `non-free` tree by default
Package: *
Pin: release c=non-free
Pin-Priority: -1

(The idea is, that I add an explicit stanza for every package I want from non-free.)

But it doesn't work:

root@silber:/etc/apt/preferences.d# apt-get -s install firmware-linux-nonfree
Paketlisten werden gelesen... Fertig
Abhängigkeitsbaum wird aufgebaut.       
Statusinformationen werden eingelesen.... Fertig
Die folgenden NEUEN Pakete werden installiert:
0 aktualisiert, 1 neu installiert, 0 zu entfernen und 0 nicht aktualisiert.
Inst firmware-linux-nonfree (0.43 Debian:8.4/stable [all])
Conf firmware-linux-nonfree (0.43 Debian:8.4/stable [all])

What am I missing?

  • You explicitly told apt-get to install firmware-linux-nonfree. IIRC, the only effect pinning can have in that situation is to select which debian release (e.g. 'stable' or 'sid') or third party repo (e.g. 'deb-multimedia.org') to install from, and/or which version to install. Your pin rule WILL block non-free packages, except those that you explicitly install on an apt-get install command line....you don't need an exception rule for each package.
    – cas
    May 21, 2016 at 6:03
  • @cas: Another example apt-get -s install raccoon tells me, that it would install autodocktools from non-free, which I didn't call explicitely. Is this still what you woud expect? Can I somehow prevent this? May 21, 2016 at 13:04
  • raccoon depends on autodocktools. If you tell apt-get to install racooon, what do you expect will happen? apt-get will do what it needs to in order to complete your instruction.
    – cas
    May 21, 2016 at 22:39

1 Answer 1


You need to ensure you don't have another, more general pin priority which takes priority over your non-free-excluding rule. (This includes the APT::Default-Release configuration setting which assigns a high priority to the given release.)

For example, if your /etc/apt/preferences file (or another file in /etc/apt/preferences.d) contains something like the following:

Package: *
Pin: release a=unstable
Pin-Priority: 200

then unstable packages will have pin priority 200, regardless of the component. To make this work with your additional file, you should change this to

Package: *
Pin: release a=unstable, c=main
Pin-Priority: 200

(and add an additional stanza for contrib if you care about that). (In your case you would have stable of course.)

You can check the effect of your pin priorities by running

apt-cache policy

If your non-free-excluding configuration is working correctly, you should see entries for all the suites you're tracking, on non-free, with a pin-priority of -1. Once that's working, you'll find that you can no longer install raccoon, or in fact any non-free package (even if mentioned explicitly) — you'll need to add the non-free packages you want to your configuration file, with an appropriate pin priority.

As an example, here’s the setup I use: I have a file named /etc/apt/preferences.d/non-free containing

Package: intel-microcode
Pin: release n=buster, c=non-free
Pin-Priority: 100

Explanation: Disable packages from non-free tree by default
Package: *
Pin: release c=non-free
Pin-Priority: -1

Non-free packages still appear in searches, but I can’t install them:

$ sudo apt install lmbench
Reading package lists... Done
Building dependency tree       
Reading state information... Done
Package lmbench is not available, but is referred to by another package.
This may mean that the package is missing, has been obsoleted, or
is only available from another source

E: Package 'lmbench' has no installation candidate

and apt policy agrees:

$ apt policy lmbench
  Installed: (none)
  Candidate: (none)
  Version table:
     3.0-a9+debian.1-2 -1
         -1 http://ftp.fr.debian.org/debian buster/non-free amd64 Packages
         -1 http://ftp.fr.debian.org/debian testing/non-free amd64 Packages
         -1 http://ftp.fr.debian.org/debian unstable/non-free amd64 Packages

But intel-microcode is installable and upgradable. Thus after a forced downgrade to the oldstable version, I get

$ apt policy intel-microcode
  Installed: 3.20190618.1~deb9u1
  Candidate: 3.20190618.1
  Version table:
     3.20190618.1 100
         -1 http://ftp.fr.debian.org/debian buster/non-free amd64 Packages
         -1 http://ftp.fr.debian.org/debian testing/non-free amd64 Packages
         -1 http://ftp.fr.debian.org/debian unstable/non-free amd64 Packages
 *** 3.20190618.1~deb9u1 100
        100 /usr/var/lib/dpkg/status

$ apt list --upgradable
intel-microcode/stable,testing,unstable 3.20190618.1 amd64 [upgradable from: 3.20190618.1~deb9u1]

The apt policy output ends up somewhat confusing — refer to the “Candidate” line to see what’s really going to happen.

  • My problem was, that I had the line APT::Default-Release "jessie"; in a file in /etc/apt.conf.d, which assinged a high priority to all packages from jessie. apt-cache policy helped to detect that. Thank you. May 22, 2016 at 21:45
  • @MaxKubierschky thanks, I've (belatedly) updated my answer to include that. Aug 29, 2016 at 13:23
  • I have been trying to do this. I got error Invalid record in the preferences file /etc/apt/preferences.d/apt-preferences-non-free-policy, no Package header because of Explanation: I added a # in front of this line to fix it. It no longer errors, but I see no additional output from apt-cache policy Aug 7, 2019 at 10:29
  • I then added non-free to sources, to see if that would fix it. It did. Aug 7, 2019 at 11:11
  • @ctrl-alt-delor I’ve added details of my setup. Aug 7, 2019 at 12:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .