Package managers¶

Practical 2.6 package-managers-annex.pdf · PDF

How did you install the last program on a Windows PC at home? Search the web, pick a link, download an .exe, click Next, Next, Next... and hope it was the real site. And on your phone? Open the store, tap Install. Which one is safer? Which one updates itself?

Linux had the phone's way of installing software in the 1990s — about ten years before the first phone app store. Today you learn the tool behind it, and you find out what apt update and apt upgrade really did on your servers.

Three words¶

A package is one file that contains a program, plus a label with its name, its version and what else it needs. On Debian and Ubuntu, package files end in .deb.

A repository is a warehouse of packages on a server, run by the distribution. Debian 13 has more than 68,000 packages in its main repository.

A package manager is the program that talks to the warehouse: it downloads a package, checks it, installs it, and remembers every file it put on the disk. On Debian and Ubuntu it is apt.

Back in the kitchen: the repository is the wholesale supplier. apt update brings the supplier's new catalogue — nothing is delivered yet. apt install is the order: the van brings the product and every ingredient it needs. The delivery note is signed, so nobody can swap a box on the way.

flowchart LR
    subgraph REPO["Repository (the supplier)"]
        P["<b>Packages</b><br>.deb files<br>with signed labels"]
    end
    subgraph VM["deb-lab"]
        A["<b>apt</b><br>the person who<br>places the orders"]
        D["<b>Disk</b><br>installed programs"]
    end
    P -->|"apt update: the catalogue"| A
    P -->|"apt install: the order + its ingredients"| A
    A -->|"installs and remembers each file"| D

A little history¶

Ian Murdock started Debian in August 1993. Its first package tool, dpkg, could install one package file — but the user had to find every needed file by hand. APT fixed that: it shipped with Debian 2.1 on 9 March 1999 and fetched the missing pieces by itself. Almost every Linux distribution has copied the idea since.

Where does your software come from?¶

apt reads the list of warehouses from a file. Look at it on deb-lab:

cat /etc/apt/sources.list

If that file is empty or missing, newer systems use /etc/apt/sources.list.d/debian.sources. You will find the address deb.debian.org/debian and the release word trixie (also trixie-updates and trixie-security).

Update, search, show, install¶

First, the new catalogue — and what is waiting:

sudo apt update
apt list --upgradable

apt update ends with N packages can be upgraded or All packages are up to date. It installed nothing. apt list --upgradable lists each package with its old and new version.

Now look before you install:

apt search cowsay
apt show cowsay

apt show reads the label of the package: Version, Download-Size, and the line Depends, which lists what it needs (libtext-charwidth-perl, perl:any). You have still installed nothing.

Then order two packages:

sudo apt install cowsay fortune-mod

Read the screen before you answer Y. Under Installing dependencies, apt lists fortunes-min and librecode3. You asked for two packages; four arrive.

A dependency is a package that another package needs in order to work.

fortune-mod is the program; fortunes-min is its list of quotes. apt reads the label, finds what is missing and adds it to the order. Run them:

fortune | cowsay
dpkg -L cowsay

The bar | passes the text of the first program to the second: a cow says something. dpkg -L lists every file the package put on your disk — the program itself is /usr/games/cowsay.

Three ways to take software out¶

remove is not purge¶

The editor nano keeps its settings in /etc/nanorc. Prove the difference:

ls /etc/nanorc
sudo apt remove nano
ls /etc/nanorc
dpkg -l nano

After remove, the file is still there, and the last line of dpkg -l nano starts with rc: removed, configuration kept. That is on purpose — reinstall it and your settings are back.

sudo apt purge nano
ls /etc/nanorc
sudo apt install nano

After purge, ls says No such file or directory. The last line puts nano back: you will need it.

The orphans¶

sudo apt remove fortune-mod
sudo apt autoremove

The first command prints The following packages were automatically installed and are no longer required: fortunes-min librecode3. They are orphans: dependencies that nothing needs any more. purge would not take them either. apt autoremove removes exactly those, and nothing you asked for by name.

Upgrade everything, and read the diary¶

sudo apt upgrade
apt list --upgradable

apt upgrade shows a summary line (Upgrading: N, Installing: 0, Removing: 0). Afterwards, apt list --upgradable prints only the word Listing...: nothing left.

Who decides which version of Firefox you get? The distribution. Debian stable ships tested versions and then sends only security fixes. That is why deb-lab is "boring" — and why servers love it.

apt also keeps a diary of everything it did:

tail -n 25 /var/log/apt/history.log

tail -n 25 shows the last 25 lines of a file. Each block has a Start-Date, the Commandline, the packages under Install:, Remove:, Purge: or Upgrade:, and an End-Date. The packages you did not ask for by name carry the word automatic.

Outside the warehouse: .deb files, Flatpak and Snap¶

A loose .deb¶

Some companies do not put their program in Debian's repository; they offer a .deb file on their web page. Install it with apt and the path to the file, so apt can still fetch the dependencies:

apt download sl
ls
sudo apt install ./sl_*.deb
sl

apt download leaves a file like sl_5.02-1+b1_amd64.deb in the current folder. The * means "any text here". The ./ matters: it means "the file in this folder"; without it apt looks for a package named like the file. A train crosses your terminal.

The old tool dpkg -i also installs a file, but stops if a dependency is missing.

Two newer formats¶

Why would anyone want another format? To get the newest version of an app, the same package on every distribution, and apps locked in a sandbox — a closed box with limited access to your files.

Ubuntu installs Snap by default; Debian installs neither Flatpak nor Snap by default. One machine can use all three systems side by side.

The other machine¶

On ubu-srv, the same two commands keep it up to date, and one more shows its snaps:

sudo apt update
sudo apt upgrade
snap list

Ubuntu talks to archive.ubuntu.com and security.ubuntu.com, and its release word is resolute. snap list shows the installed snaps, or says none are installed yet.

Key takeaways¶

• A package is a program plus a label; a repository is the warehouse; apt is the package manager that places the orders.
• apt update downloads the catalogue; apt upgrade installs newer versions; apt install brings a package and its dependencies.
• remove keeps the configuration (rc in dpkg -l); purge deletes it; autoremove takes the orphans.
• apt records every action in /var/log/apt/history.log.
• Install a loose .deb with sudo apt install ./file.deb, only from the maker's official site.
• Flatpak and Snap bundle their dependencies and run apps in a sandbox, next to apt.

Quick check¶

On Linux, one tool updates the whole system. Windows does it differently — with three doors and one famous Friday in May 2017: Software and updates on Windows.