I'm currently working with Ubuntu and trying to install a Debian system on a VM, which means I have to deal with packages. Since I'm new to it, I've read a lot about it on the web and especially debian wiki (ubuntu wiki is useful too). In particular, I have learn how to make a local repository and how to properly edit the sources.list file.

However, I still have some questions about how it works, details I couldn't find on the web.

  • First, when you use an online repository. I understood that apt-get will follow the link you wrote in the source.list file and search for a Packages.gz archive. What i don't understand is how this simple archive (which seem to be only a list of installable packages) allow the installation of the package? Does Packages.gz gives apt information about how to find the .deb file and then proceed the installation? Or is it something else?

  • Second, about the Sources.gz archive. I've read it's the source code of the packages listed in Packages.gz, BUT in most cases it's not needed. So, if i add the link to this Sources.gz in my source.list file, what does it really gives to me? What's the point of it?

  • Third, about local repository; this is related to the previous questions. I know how to make a local repository with .deb files, but let's say i only have this Packages.gz archive: it won't be enough, rigth? and if i have the Sources.gz archive, will it work?

  • Finally, i've seen on Debian repository that, in addition to the dist repository, there is a pool repository with a lot of .deb in it. I know a way to install those (download the .deb and its dependencies, install them with dpkg -i), but is there an easier way? Something more automatic, which could find the .deb online, find its dependencies, and install everything ? (just like apt-get do, but as far as i've understood it, apt-get only works with the Packages.gz and Sources.gz archives, not directly with .deb)

I'm sorry this is not really a question, rather a list of questions ^^ but everything I found online was mostly "apt-get search for the package and its dependency in the online repository and install it through dpkg", and I would like more details about it.

  • 2
    Please, take the time to read this and edit the question afterwards.
    – Panki
    Commented May 27, 2019 at 14:06
  • 1
    done it (hopefully good enough :/ )
    – Ablia
    Commented May 27, 2019 at 14:51
  • Yes, good work, thanks a lot! It is now much easier to understand and answer your question.
    – Panki
    Commented May 27, 2019 at 15:04
  • If you want to set up your own APT repository, don't maintain those index files by hand. Use one of the dozen repository generation tools. Commented May 27, 2019 at 23:41

1 Answer 1

  1. The Packages.gz contains a Filename field with a value that probably looks something like pool/main/n/name-of-package/name-of-package_version_amd64.deb. This tells the package manager to look at that URL.
    For instance, if you have the following line in your sources.list(.d):
    deb https://some-domain.com/some-url some-distribution main
    You will have the following file: https://some-domain.com/some-url/dists/some-distribution/main/binary-amd64/Packages.gz
    That file will reference pool/main/n/name-of-package/name-of-package_version_amd64.deb, so your package manager will look at https://some-domain.com/some-url/pool/main/n/name-of-package/name-of-package_version_amd64.deb.

  2. Sources.gz works the same way, but is optional. It works with apt source, which will fetch you the source if you wish to compile it yourself instead of using the pre-built binaries.
    This is mainly useful for system administrators who want to patch the exact version of the package used by a distribution, rather than contributors/curious people who would just go to the project's homepage and follow the build instructions there.

  3. If a package is in the distribution's pool directory but not in Packages.gz, it is most probably in another Package.gz. Notice how you have several words in a typical sources.list line:
    deb http://archive.ubuntu.com/ubuntu precise main universe multiverse
    main, universe and multiverse each have their own Packages.gz file. You may need to enable some, as debian for instance disables non-free by default. However, some packages still won't be available (not even in pool). You may choose to add untrusted repositories (such as PPAs on Ubuntu), package the missing program yourself (so you and other people can use their package manager to manage that program) or simply build and install it yourself (you should use the /usr/local prefix to avoid conflicts with your package manager).

  4. When a new (version of a) package appears, the Release file for the distribution is updated. This allows apt update to know it has to re-download Packages.gz.
  • Thanks! that's exactly what i needed! Still one thing: is it ok to add the Packages.gz archive of another distrib to my sources.list? For example, if i want a new version of a package, which is not available in Debian 8 but is in Debian 9, and i don't want to add all the .deb files "per hand", i could just add http://ftp.debian.org/debian stretch main, so that i have access to all stretch packages. But is it safe? (i think i'm gonna try it on a vm :p )
    – Ablia
    Commented May 27, 2019 at 14:49
  • 1
    @Ablia No, it's not safe: the Debian 9 packages will be built against a newer kernel and libraries, and thus may require facilities not in Debian 8's kernel and libraries. If you're looking for newer versions of packages for Debian 8, you can try the backport repos.
    – cjs
    Commented May 28, 2019 at 0:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .