6.1. Filling in the sources.list File
Each active line of the /etc/apt/sources.list file contains the description of a source, made of 3 parts separated by spaces.
The first field indicates the source type:
“deb” for binary packages,
“deb-src” for source packages.
The second field gives the base URL of the source (combined with the filenames present in the Packages.gz files, it must give a full and valid URL): this can consist in a Debian mirror or in any other package archive set up by a third party. The URL can start with file:// to indicate a local source installed in the system's file hierarchy, with http:// to indicate a source accessible from a web server, or with ftp:// for a source available on an FTP server. The URL can also start with cdrom:// for CD-ROM based installations, although this is less frequent, since network-based installation methods are more and more common.
The syntax of the last field depends on whether the source corresponds to a Debian mirror or not. In the case of a Debian mirror, name the chosen distribution (stable, testing, unstable or their current code names — see the list in sidebar COMMUNITY Bruce Perens, a controversial leader), then the sections to enable (chosen between main, contrib, and non-free). In all other cases, simply indicate the subdirectory of the desired source (this is often a simple “./” which refers to the absence of a subdirectory — the packages are then directly at the specified URL).
VOCABULARY The main, contrib and non-free archives
Debian uses three sections to differentiate packages according to the licenses chosen by the authors of each program. Main (the main archive) gathers all packages which fully comply with the Debian Free Software Guidelines.
The non-free archive is different because it contains software which does not (entirely) conform to these principles but which can nevertheless be distributed freely. This archive, which is not officially part of Debian, is a service for users who could need those softwares — however Debian always recommends giving priority to free software. The existence of this section represents a considerable problem for Richard M. Stallman and keeps the Free Software Foundation from recommending Debian to users.
Contrib (contributions) is a stock of open source software which cannot function without some non-free elements. These elements can be software from the non-free section, or non-free files such as game ROMs, BIOS of consoles, etc. Contrib also includes free software whose compilation requires proprietary elements. This was initially the case for the OpenOffice.org office suite, which used to require a proprietary Java environment.
Generally, the contents of a standard sources.list file can be the following:
Example 6.1. /etc/apt/sources.list file
# Security updates
deb http://security.debian.org/ stable/updates main contrib non-free
deb-src http://security.debian.org/ stable/updates main contrib non-free
# Debian mirror
deb http://ftp.debian.org/debian stable main contrib non-free
deb-src http://ftp.debian.org/debian stable main contrib non-free
This file lists all sources of packages associated with the stable version of Debian. If you would like to use Testing or Unstable, you will of course have to add (or replace them with) the appropriate lines. When the desired version of a package is available on several mirrors, the first one listed in the sources.list file will be used. For this reason, non-official sources are usually added at the end of the file.
TIP /etc/apt/sources.list.d/*.list files
If many package sources are referenced, it can be useful to split them in multiple files. Each part is then stored in /etc/apt/sources.list.d/filename.list (see sidebar BACK TO BASICS Directories ending in .d).
QUICK LOOK apt-spy
This software tests the download speed from several Debian mirrors and generates a sources.list file which points to the the fastest mirror.
The mirror selected during installation is generally suitable since its selection is based on the country. However, if the download is a little slow, or after a move, you can try running the application available in the apt-spy package.
The sources.list file contains several other entry types: some describe the Debian CD-ROMs you have. Contrary to other entries, a CD-ROM is not always available since it has to be inserted into the drive and since only one disc can be read at a time — consequently, these sources are managed in a slightly different way. These entries need to be added with the apt-cdrom program, usually executed with the add parameter. The latter will then request the disc to be inserted in the drive and will browse its contents looking for Packages files. It will use these files to update its database of available packages (this is usually done by the aptitude update command). From then on, APT can require the disc to be inserted if it needs one of its packages.
6.1.1. Other Available Official Repositories
6.1.1.1. Stable Updates
Once published, the Stable distribution is only updated about once every 2 months in order to integrate the security updates published on security.debian.org.
This minor release can also include updates for packages that have to evolve over time... like spamassassin's spam detection rules, clamav's virus database, or the daylight-saving rules of all timezones (tzdata).
All those updates are prepared in a repository known as proposed-updates. Anyone can use this repository to test those updates before their official publication. The extract below uses the squeeze-proposed-updates alias which is both more explicit and more consistent since lenny-proposed-updates also exists (for the Oldstable updates):
deb http://ftp.debian.org/debian squeeze-proposed-updates main contrib non-free
Once ready, the most important updates — those which cannot wait for the next minor Debian release — are published in the stable-updates repository (which most systems are expected to use):
deb http://ftp.debian.org/debian stable-updates main contrib non-free
6.1.1.2. The Backports From backports.debian.org
Unsurprisingly, the backports.debian.org server hosts “package backports”. The term refers to a package of a recent software which has been recompiled for an older distribution, generally for Stable. When the distribution becomes a little dated, numerous software projects have released new versions that are not integrated into the current Stable (which is only modified to address the most critical problems, such as security problems). Since the Testing and Unstable distributions can be more risky, some volunteers sometimes offer recompilations of recent software applications for Stable, which has the advantage to limit potential instability to a small number of chosen packages.