Linux Package Management & Software Repositories

Software distribution in Linux relies on package managers that automate dependency resolution, cryptographic signature verification, installation, updates, and removals. This guide covers standard package management ecosystems across major distributions (Debian/Ubuntu, RHEL/Rocky, Alpine, Arch), managing software repositories and GPG keys, pinning versions, and compiling software from source.

⚡ Quick Dive

Cross-Distribution Package Management Rosetta Stone

Task Debian / Ubuntu (apt) RHEL / Fedora (dnf) Alpine Linux (apk) Arch Linux (pacman)
Update repo index apt update dnf check-update apk update pacman -Sy
Upgrade all packages apt upgrade -y dnf upgrade -y apk upgrade pacman -Syu
Install package apt install -y <pkg> dnf install -y <pkg> apk add <pkg> pacman -S <pkg>
Remove package apt remove <pkg> dnf remove <pkg> apk del <pkg> pacman -R <pkg>
Purge configs & pkg apt purge <pkg> dnf erase <pkg> apk del <pkg> pacman -Rns <pkg>
Search package apt search <keyword> dnf search <keyword> apk search <keyword> pacman -Ss <keyword>
Show package info apt show <pkg> dnf info <pkg> apk info -a <pkg> pacman -Si <pkg>
Clean cache apt clean / autoremove dnf clean all apk cache clean pacman -Sc
Find file owner dpkg -S /path/to/file rpm -qf /path/to/file apk info -W /path/file pacman -Qo /path/file

Quick Practical One-Liners

# Ubuntu: Non-interactive system update
sudo DEBIAN_FRONTEND=noninteractive apt update && sudo apt upgrade -y

# Prevent package from being upgraded automatically (version pinning)
sudo apt-mark hold nginx
# Unhold
sudo apt-mark unhold nginx

# RHEL/CentOS: Install EPEL (Extra Packages for Enterprise Linux)
sudo dnf install -y epel-release

📖 Extended Guide

1. Debian / Ubuntu: apt and dpkg

How APT Works

APT (Advanced Package Tool) acts as the high-level dependency solver on top of dpkg (the low-level .deb archive unpacker).

  • Repositories are configured in /etc/apt/sources.list and /etc/apt/sources.list.d/*.sources (modern DEB822 format).
  • Package cache is stored in /var/cache/apt/archives/.

Essential apt Operations

# 1. Update index without installing anything
sudo apt update

# 2. Upgrade packages and remove obsolete dependencies
sudo apt full-upgrade -y

# 3. Remove package along with configuration files
sudo apt purge -y apache2

# 4. Remove orphaned dependencies left behind by removed software
sudo apt autoremove --purge -y

# 5. List upgradable packages
apt list --upgradable

Low-Level dpkg Inspection

# Install standalone local .deb file
sudo dpkg -i package.deb
sudo apt install -f  # Fix missing dependencies if any

# List all files installed by an installed package
dpkg -L nginx

# Determine which package installed a specific command or file
dpkg -S /usr/bin/htop

Modern GPG Key & Repository Management (DEB822)

[!WARNING] Legacy apt-key add is deprecated for security reasons. Always store GPG keyrings in /etc/apt/keyrings/ with restricted permissions.

# 1. Create keyrings directory
sudo install -m 0755 -d /etc/apt/keyrings

# 2. Download and dearmor vendor GPG key (e.g., Docker)
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg
sudo chmod a+r /etc/apt/keyrings/docker.gpg

# 3. Add repository source file referencing keyring
echo \
  "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu \
  $(. /etc/os-release && echo "$VERSION_CODENAME") stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null

# 4. Refresh index and install
sudo apt update
sudo apt install docker-ce -y

2. RHEL / Rocky / Fedora: dnf and rpm

dnf (Dandified YUM) is the next-generation package manager for RPM-based distributions.

Essential dnf Commands

# Search and display detailed package metadata
dnf info postgresql-server

# List enabled software repositories
dnf repolist

# Install a group of packages (e.g., Development Tools)
sudo dnf groupinstall "Development Tools" -y

# View transaction history and rollback an update
dnf history
sudo dnf history undo <transaction_id>

Low-Level rpm Commands

# Query if a package is installed
rpm -q nginx

# List files inside an uninstalled .rpm file
rpm -qlp package.rpm

# Verify integrity of installed packages (detect modified binaries)
rpm -Va

3. Alpine Linux: apk (Minimalist Container Standard)

Alpine uses apk-tools for extremely lightweight, fast package installation in container images:

# Install without storing cached index in container image (reduces layer size)
apk add --no-cache curl jq git

# Install package into virtual build group and remove later (multi-stage pattern)
apk add --no-cache --virtual .build-deps gcc musl-dev make
# ... compile application ...
apk del .build-deps

4. Compiling and Installing from Source

When software is not packaged in official repositories, compile directly from source:

Standard Toolchain Setup

# Ubuntu/Debian
sudo apt install build-essential cmake git pkg-config -y

# RHEL/Rocky
sudo dnf groupinstall "Development Tools" -y

The Classic Three-Step Build Process

# 1. Clone or unpack source
git clone https://github.com/example/tool.git
cd tool

# 2. Configure compilation options and check system libraries
./configure --prefix=/usr/local --enable-optimizations

# 3. Compile across all CPU cores (-j)
make -j$(nproc)

# 4. Install binary into /usr/local/bin
sudo make install

5. Best Practices for Production Servers

  • Never enable untrusted 3rd-party PPAs/repositories on critical servers.
  • Automate Security Patches: Configure unattended-upgrades on Ubuntu or dnf-automatic on RHEL.
  • Pin Package Versions for databases and runtime languages to avoid unexpected breaking updates during deployments.
  • Clean package caches (apt clean or dnf clean all) inside CI/CD and container builds.
⌂ All Guides