Package management on Debian

This chapter follows Processes and inter-process communication.

Debian organizes software as .deb packages with metadata, file lists, and maintainer scripts. dpkg installs and removes individual packages; APT resolves dependencies from repositories, verifies signatures, and performs upgrades across the system. Server walkthroughs for Apache on Debian assume this layout—a2enmod, site configs under /etc/apache2, and packages from Debian mirrors (see the Server Development area when that walkthrough is published).

dpkg and low-level package state

dpkg is the back end: unpack, configure, remove. Administrators use it for diagnostics more than daily installs:

1
dpkg -l 'nginx*'
2
dpkg -s nginx
3
dpkg -L nginx
4
dpkg -S /usr/sbin/nginx

Broken dependencies after a partial install show in dpkg --configure -a and apt --fix-broken install. Package state letters in dpkg -l (ii, iF, rc) tell you if configure failed or files remain after removal.

APT, repositories, and components

APT reads sources, downloads packages, and runs dpkg in order. On Debian 12+, /etc/apt/sources.list.d/debian.sources uses deb822 format:

1
Types: deb
2
URIs: http://deb.debian.org/debian
3
Suites: trixie trixie-updates
4
Components: main contrib non-free-firmware
5
Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg

Components:

Enable non-free-firmware when installers or dmesg ask for missing firmware—see Hardware and devices in Linux.

Everyday commands:

1
sudo apt update
2
sudo apt upgrade
3
sudo apt install curl
4
apt search 'linux-image'

Security updates and unattended-upgrades

Debian stable receives DSA/DLA security advisories mirrored as package updates. unattended-upgrades can apply security suites automatically on servers.

Track /var/log/apt/history.log and /var/log/dpkg.log during incidents. Pin production servers to stable suite names, not testing, unless you accept API and library churn.

Backports and pinning

Backports bring newer versions to stable without jumping suite. Enable trixie-backports (or your stable backports suite) selectively:

1
sudo apt install -t trixie-backports some-package

Pinning via /etc/apt/preferences.d/ controls default candidate versions—useful to prefer stable but allow one backported kernel or toolchain.

Flatpak and Snap beside APT

Flatpak and Snap bundle applications with runtimes, independent of Debian’s release cycle. They help desktop apps (browsers, IDEs) but duplicate libraries and use separate trust models (Flathub, Snap Store).

On servers, stay with APT for a single patch surface. On desktops, mixing APT, Flatpak, and Snap is normal—know which updater owns each app.

Choosing packages does not replace understanding who runs as which user—Users, groups and permissions in Linux is next.

The next chapter is Users, groups and permissions in Linux.