Get Package Sources and Repository Link

rc virtualbox-guest-utils 4.1.12-dfsg-2ubuntu0.2

The first two flags in this output tell you exactly what is going on:

The 'r' means the package is in remove state. It's still technically installed, but most of it is actually gone.

The 'c' means that the configuration files are still installed.

Read man dpkg-query for more information if you're interested.

This state (rc) is common - pretty much any time you remove a package with configuration files, it'll end up in this state.

To fix it, use the --purge option to either dpkg or apt-get remove to clean these entries up.

I don't think its possible directly.

But somehow the user got your package to install—and apparently not from your repository, since it hasn't been added yet. So the first workaround I'd suggest would be to do things the normal way: have the user add the repository (or give the user a simple shell script), then install your package as normal. This would be my preferred solution, and running a shell script is no harder than installing a package.

Second workaround: have your package just be a setup package. Have it set up your repository, then tell the user (e.g., via debconf note or other prompt on screen) to install the real package (which will come from your repository).

Third workaround: Same setup package, but use the same package name in your repository, just a higher version (use an epoch, probably). So the initial install will set up the repository, then apt upgrade or similar will pull in the real package.

Fourth: I'm not sure this is a good idea, but—In your postinst, fire off a background process that will wait for the dpkg lock, then finish your install. I think at or batch will work for this, or just an ordinary /path/to/script & followed by disown. You probably want to let the user know that the package install will finish in the background.

PS: you probably need to add a GPG key as well.