Package management

Why it matters

On Linux you rarely download an installer from a website. Software comes from repositories through a package manager, which installs programs together with everything they depend on, keeps them updated, and removes them cleanly. Keeping packages patched is also one of the most important security jobs on any server: many real breaches exploit a vulnerability that already had a fix available.

Packages, repositories and dependencies

• A package is an archive with a program, its files and metadata: version, description and the other packages it needs (its dependencies).
• A repository is a server that hosts packages. Your system's list of repositories lives in /etc/apt/sources.list and /etc/apt/sources.list.d/ on Debian/Ubuntu, or /etc/yum.repos.d/ on the Red Hat family.
• Repositories sign their package lists with a cryptographic key. The package manager refuses packages whose signature does not match, which protects you from tampered downloads.

apt on Debian and Ubuntu

sudo apt update                 # refresh the list of available packages (installs nothing)
apt list --upgradable           # what could be updated
sudo apt upgrade                # install available updates
sudo apt install tree htop      # install packages and their dependencies
apt search json                 # search names and descriptions
apt show htop                   # details: version, size, dependencies
sudo apt remove htop            # remove the program, keep its config files
sudo apt purge htop             # remove the program and its config
sudo apt autoremove             # remove dependencies nothing needs any more

The most common beginner confusion: apt update does not update software. It downloads the latest package lists. apt upgrade installs the new versions. You normally run them together: sudo apt update && sudo apt upgrade.

Underneath, apt uses dpkg, which handles single .deb files:

dpkg -l | grep nginx            # is it installed, and which version?
dpkg -L tree                    # which files did this package install?
dpkg -S /usr/bin/htop           # which package owns this file?

dnf on the Red Hat family

The ideas are identical; the command names differ slightly.

Installing software safely

1. Prefer the distro's own repositories. Their packages are tested together and receive security updates automatically.
2. Read what apt is about to do. Before you answer Y, apt lists what it will install, upgrade and remove. If an install wants to remove many packages, stop and find out why.
3. Add third-party repositories only from the vendor's official instructions (for example PostgreSQL, Docker or Node.js docs), and understand that you are trusting their signing key with root on your machine.
4. Be wary of curl ... | sudo bash. It runs a script from the internet as root without letting you read it. Download it, read it, then decide.
5. Do not mix in random .deb or .rpm files from file-sharing sites.
6. Snapshot first on your practice VM before big upgrades, and on real servers follow the change process (test environment first, a maintenance window, a rollback plan).

Automatic security updates

Ubuntu servers usually run unattended-upgrades, which installs security updates daily:

systemctl status unattended-upgrades
cat /etc/apt/apt.conf.d/20auto-upgrades

Some updates (for example a new kernel) only take effect after a reboot. Ubuntu creates /var/run/reboot-required when that is the case:

[ -f /var/run/reboot-required ] && cat /var/run/reboot-required

Other formats you will meet

• Snap and Flatpak bundle an app with its own libraries; common on desktops.
• Language package managers (pip, npm, cargo) install libraries for a programming language. Use them inside a virtual environment or project folder, not with sudo into the system Python, so they do not fight with the OS package manager.
• Containers package a whole application environment; you will meet them in later cloud and DevOps courses.

Common mistakes

• Running apt upgrade without apt update first, so nothing new is found.
• Answering Y without reading the list of packages to be removed.
• sudo pip install into the system Python, which can break OS tools that depend on it.
• Never rebooting after kernel updates, leaving the vulnerable kernel running.
• Adding a random PPA or repository from a blog post to get a newer version.

Recap

• Software comes from signed repositories through a package manager that resolves dependencies.
• apt update refreshes lists; apt upgrade installs updates; apt install/remove/purge/autoremove manage packages (dnf on the Red Hat family).
• dpkg -L and dpkg -S connect packages and files.
• Stay with official repositories, read before confirming, avoid piping scripts into root, and reboot when updates require it.

Try it

In the Do tab you will update your practice system and install, inspect and remove a package.