APT – How Does apt-get Deal with Multiple Sources

aptpackage-management

Let's say Ubuntu's repositories features a package.

I install that package using apt-get.

I then add an additional source (with add-apt-repository) that lists either a newer or older version of the package.

Will apt-get always upgrade to the latest version, regardless of which source offers the latest version?

Best Answer

APT will always install the latest version that isn't excluded by preferences. Preferences are indicated in the file /etc/apt/preferences (and in files under /etc/apt/preferences.d).

Some repositories have a configuration that prevents their packages from being installed automatically. For example, the Debian backports have release files (which you can see in /var/lib/apt/lists) that contain

NotAutomatic: yes
ButAutomaticUpgrades: yes

If you have multiple sources for the exact same package (i.e. same package name, same version number), then APT downloads from the first source found in /etc/apt/sources.list (or /etc/apt/sources.list.d/*; the files are searched in lexicographic order, and the sources are searched in order inside each file). So list local mirrors first. The order in sources.list is irrelevant for packages that have a different version number.

Related Solutions

Debian – How to tell apt to use the latest package by default

As @cutrightjm has mentioned apt-pinning is the solution.

If you create a file /etc/apt/preferences.d/backports with the following content

Package: *
Pin: release a=stretch-backports
Pin-Priority: 800

apt will always install packages from stretch-backports, except when you pin another package source with a priority higher than 800.

If you want to see all available versions of a package, their priority and which one will be installed, you can use apt-cache policy <packagename>.

How to see if a .deb package inserts a repository

It's not fool-proof, but this will give a good indication:

dpkg-deb -c virtualbox-5.1_5.1.12-112440\~Debian\~stretch_amd64.deb|grep etc/apt

In this case nothing is found, so it looks like the package doesn't add a repository.

We're specifically looking for files in /etc/apt/sources.list.d. It's not fool-proof because packages could add a repository in their postinst. You can examine the latter using

dpkg-deb --ctrl-tarfile virtualbox-5.1_5.1.12-112440\~Debian\~stretch_amd64.deb|tar xf - ./postinst

then reading the extracted postinst (which confirms that the package doesn't add a repository).

Best Answer

Related Solutions

Debian – How to tell apt to use the latest package by default

How to see if a .deb package inserts a repository

Related Question