Specifying repositories

APTsits higher up in the package management hierarchy and does not interact with DEB files directly. In theAPTdomain, packages are referred to by their package name and optionally the version number.APTcan handle any number of reposito-ries and merge the list of available packages. Duplicates are resolved in favour of the first encounter. The repositories are identified by lines of the following form in /etc/apt/sources.list¹³:

deb ftp://ftp.debian.org/debian sarge main

deb http://nonus.debian.org/debian-non-US sarge main deb copy:/srv/mirror/debian/debian sarge main deb cdrom:[title]/ sarge main

11The underlying algorithm is a topological sort. See:http://www.cs.sunysb.edu/˜algorith/files/

topological-sorting.shtml

12The graph was made with the output ofapt-cache dotty --option APT::Cache::GivenOnly=true abcde wget speex speex lame cdda2wavfed throughdotof thegraphvizpackage

13Please make sure to use a closer mirror instead offtp.debian.org(see chapter 5.4.1). The full list of mirrors is available online:http://www.debian.org/mirror/list.

Each line encodes the location of thePackageson the given medium. The exact syntax definition of a valid line may be found in thesources.list (5)manpage. A line has at least three fields which together provide the information necessary to piece together the paths in the archive. The fields are:

package type

debreferences binary packages. To access source packages,deb-srcmust be used instead.

source URI

The Universal Resource Identifier (URI) identifies the source medium and can use any of the following access methods:

cdrom

allows access to local CD-ROM drives and supports media swapping as well as prompting for new media, identified by the title speci-fied between brackets. Use apt-cdrom to add CD-ROM entries to /etc/apt/sources.list.

file allows selection of an arbitrary file system location to be used as a repository, such as an NFS mount or a local mirror.

copysimilar to thefileaccess method,copyusesAPT’s cache directory¹⁴to store the files after the download.

http the fastest and preferred package source using a network connection, honouring the$http_proxyvariable.

ftp slightly slower than http, the ftpmethod is highly configurable via /etc/apt/apt.conf. It may use an optional proxy defined in$ftp_proxy.

ssh given an SSH connection which does not require password entry,APT can use a remote mirror via a secure tunnel. rshis also provided but should not be used or enabled for security reasons. For example:

deb ssh://user@intranet.company.com/srv/debian/ ./

distribution

With standard mirrors, thedistribution field identifies the Debian release by canonical name (e.g. stable) or codename (e.g. sarge). It can also be a complete path, in which case it must end with a slash. For instance, lines similar to the following (my staging repository) are frequently found for project or private repositories:

14/var/cache/apt/archives

deb http://people.debian.org/˜madduck/stage ./

/stageis a simple directory exported to the web server, which contains the Packagesfile and only provides a single collection of packages. When the distributionpath is not a complete path, it identifies part of the path to the Packagesfile for the desired distribution, as shown later.

components

The remainder of each line serves to identify the component collections con-tained in a distribution. For the official mirrors, these correspond to the archives (e.g. mainandnon-free) and also specify whennon-USsoftware is to be used. For unofficial repositories, these can be used to identify com-ponents freely defined by the repository administrator (see chapter 4.4.5 for a smart example).APTwill create a separate URI for each component. Thus, regulardistributionentries require at least one component. Conversely, lines with complete paths do not specify components.

WhenAPTis told to update its understanding of available packages withapt-get update, it goes out to fetch the variousPackagesfiles, whose locations are en-coded in the lines of/etc/apt/sources.list. Each component mentioned in the line corresponds to onePackagesfile, while lines withdistributionset to a complete path only identify a singlePackagesfile and have no components.

An entry in/etc/apt/sources.listof the following form:

deb ftp://ftp.debian.org/debian sarge main contrib non-free

causesapt-get updateto retrieve the followingPackagesfiles¹⁵, assuming ani386 architecture:

ftp://ftp.debian.org/debian/dists/sarge/main/binary-i386/Packages ftp://ftp.debian.org/debian/dists/sarge/contrib/binary-i386/Packages ftp://ftp.debian.org/debian/dists/sarge/non-free/binary-i386/Packages

A line can also specify a complete path within a repository. Note the final slash, which is mandatory. By using a variable for the architecture, the repositories can be specified in a portable way:

deb http://people.debian.org ˜madduck/packages/stage/

deb http://intranet.company.com/srv/debian/ $(ARCH)/

maps to the following URI:

http://people.debian.org/˜madduck/packages/stage/Packages http://intranet.company.com/srv/debian/i386/Packages

15If available,APTprefersPackages.gzfiles in the same location as thePackagesfiles.

Binary packages usually depend on the architectures for which they were compiled.

When a package provides architecture-independent data (such as documentation), it is labelled with the special architecturealland made available in thePackages files for all architectures.

The toolsapt-cdromandapt-setup(from thebase-configpackage) can be used to easily add sources to thesources.listfile:

˜# apt-cdrom --cdrom /media/cdrom Using CD-ROM mount point /media/cdrom/

Unmounting CD-ROM

Please insert a Disc in the drive and press enter Mounting CD-ROM

Identifying.. [1319efb1a0e8df6caed2bd4e0b507933-2]

[...]

Writing new source list [...]

Repeat this process for the rest of the CDs in your set.

apt-setupusesdebconfand is essentially the same too whichbase-configinvokes:

˜# apt-setup Apt configuration

---Please choose the method apt (the Debian package management tool) should use to access the Debian archive.

For example if you have a Debian cd, select "cdrom", while if you plan to install via a Debian mirror, choose "ftp" or "http".

1. cdrom 2. http 3. ftp 4. filesystem 5. edit sources list by hand Archive access method for apt:

[...]

Finding the closest mirror: apt-spy

The Debian mirror infrastructure is gigantic with over 100 mirrors officially pro-viding the entire Debian archive. In addition, many universities and institutions provide unofficial mirrors, so it is usually a good idea to listen around. While the majority of mirrors are available for worldwide access, it makes sense to use the mirrors closest to your location. This spreads mirror load and bandwidth evenly and ensures fastest download times.

A full list of all mirrors is available online¹⁶. For most countries, HTTP and FTP access is available fromftp.xx.debian.org, where “xx” is the standardised two-letter

coun-16http://www.debian.org/mirror/list

try code¹⁷. These mirrors can become very overloaded and choosing a different one generally results in improved access to the archive.

Theapt-spytool is designed to find the best mirror by trying out a set and picking the fastest one, automatically writing the result to /etc/apt/sources.list. It can restrict its test to servers within a specific country or area (set of countries), can optionally only test a limited number of servers, or run for a specific maximum time.

Furthermore, the areas are easily customised in/etc/apt-spy.conf. Thus, to find the fastest servers in the region around Lake Constance, and write an appropriate sources.listfile forsarge, the following would do the trick:

˜# cat <<EOF >> /etc/apt-spy.conf Bodensee:

AT CH DE EOF

˜# apt-spy update Updating...

Grabbing file http://http.us.debian.org/debian/README.mirrors.txt...

Update complete. Exiting.

˜# apt-spy -d sarge -a Bodensee [...]

The above will take about one minute per server, which can be controlled with the -toption. Make sure to read theapt-spy (8)manpage for further information on this option.

As mirrors can only be selected per country, users in countries with a large number of mirrors (such as the United States) will not findapt-spyvery useful. It is, how-ever, possible to cap the number of servers to be tested, using the-eoption. By restricting it to check only a small number of servers,apt-spyregains some of its value in large countries.