Is the following configuration correct for keeping debian stable version even after update/dist-upgrade? I made this for having backports enabled so that install some packages as "wine" that I need latest version, and I think that have to comment out the backports for dist-upgrade. Are these the correct way as I don't want to break my Debian?

  1. My /apt/apt.conf is:

    APT::Default-Release "stable";
  2. My /apt/preferences is:

    Package: *
    Pin: release I=Debian-Security
    Pin-Priority: 1001
    Package: *
    Pin: release a=stable
    Pin-Priority: 990
    Package: *
    Pin: release a=stable-updates
    Pin-Priority: 990
    Package: *
    Pin: release a=jessie-backports
    Pin-Priority: 675
  • 1
    I simply did away with the backports in the test servers I have with Stretch; all backporteds packages were correctly upgraded except libssl, php5 and the kernel itself Oct 8, 2016 at 9:09
  • 4
    @maulinglawns code under enumerations requires 8 spaces
    – Anthon
    Oct 8, 2016 at 9:11
  • @Anthon Thank you! I wondered why I couldn't format properly, now I know! Oct 8, 2016 at 9:12

1 Answer 1


The backports repositories are already configured so that they're safe to use without pinning:

NotAutomatic: yes
ButAutomaticUpgrades: yes

This means that backported packages are never considered for automatic installation, nor are they valid candidates for upgrades from stable versions. But once you have installed a backported version of a package, you will get backported upgrades for that package automatically.

The pinning setup you have defined behaves in the same way as the default setup, except that security updates will always take priority, even if that entails downgrading a package.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .