SOURCES.LIST(5)

📦
version 3.3.5 · 15 versions
, in arch rolling, nixpkgs unstable

✨ SOURCES.LIST(5) ✨

Okay bestie, welcome to the source list—the literal main character of your APT setup. 💅

🌸 NAME 🌸

sources.list — the list of configured APT data sources, no cap. 🫶

🦋 DESCRIPTION 🦋

Okay so the source list /etc/apt/sources.list and the files contained in /etc/apt/sources.list.d/ are designed to support any number of active sources and a variety of source media. 🌈 The files list one source per line (one-line style) or contain multiline stanzas defining one or more sources per stanza (deb822 style), with the most preferred source listed first (in case a single version is available from more than one source). The information available from the configured sources is acquired by apt-get update (or by an equivalent command from another APT front-end). ✨

If multiple source lists are used, the most-preferred sources are those listed in /etc/apt/sources.list, followed by each file in /etc/apt/sources.list.d/ in lexicographic order: for example, 00-high-preference.list is more-preferred than 50-middle-preference.sources which is more-preferred than z-low-preference.list. Periodt. 👑

🎀 SOURCES.LIST.D 🎀

The /etc/apt/sources.list.d directory provides a way to add sources.list entries in separate files. Two different file formats are allowed as described in the next two sections. Filenames need to have either the extension .list or .sources depending on the contained format. The filenames may only contain letters (a-z and A-Z), digits (0-9), underscore (_), hyphen (-) and period (.) characters. Otherwise APT will print a notice that it has ignored a file, unless that file matches a pattern in the Dir::Ignore-Files-Silently configuration list—in which case it will be silently ignored. 🙈 No cap, it's that simple.

The suggested filename for new systems is /etc/apt/sources.list.d/vendor.sources, where vendor is the result of dpkg-vendor --query Vendor | tr A-Z a-z, in deb822-style format. For example, Ubuntu uses /etc/apt/sources.list.d/ubuntu.sources. Slay. 💖

💅 ONE-LINE-STYLE FORMAT 💅

Files in this format have the extension .list. Each line specifying a source starts with a type (e.g. deb-src) followed by options and arguments for this type. Individual entries cannot be continued onto a following line—no wrapping, bestie. Empty lines are ignored, and a # character anywhere on a line marks the remainder of that line as a comment. Consequently an entry can be disabled by commenting out the entire line. 💀

If options should be provided they are separated by spaces and all of them together are enclosed by square brackets ([]) included in the line after the type separated from it with a space. If an option allows multiple values these are separated from each other with a comma (,). An option name is separated from its value(s) by an equals sign (=). Multivalue options also have -= and += as separators, which instead of replacing the default with the given value(s) modify the default value(s) to remove or include the given values. Iconic. 🌟

This is the traditional format and supported by all apt versions. Note that not all options as described below are supported by all apt versions. Note also that some older applications parsing this format on their own might not expect to encounter options as they were uncommon before the introduction of multi-architecture support. Ngl, they're a bit ancient. 💀

This format is deprecated and may eventually be removed, but not before 2029. So like, it's not going anywhere for a minute, but keep it in mind. 👑

🌈 DEB822-STYLE FORMAT 🌈

Files in this format have the extension .sources. The format is similar in syntax to other files used by Debian and its derivatives, such as the metadata files that apt will download from the configured sources or the debian/control file in a Debian source package. 🧚 Individual entries are separated by an empty line; additional empty lines are ignored, and a # character at the start of the line marks the entire line as a comment. An entry can hence be disabled by commenting out each line belonging to the stanza, but it is usually easier to add the field Enabled: no to the stanza to disable the entry. Removing the field or setting it to yes re-enables it. Obsessed. 💖

Options have the same syntax as every other field: A field name separated by a colon (:) and optionally spaces from its value(s). Note especially that multiple values are separated by whitespaces (like spaces, tabs and newlines), not by commas as in the one-line format. Multivalue fields like Architectures also have Architectures-Add and Architectures-Remove to modify the default value rather than replacing it. 🎯

This is a new format supported by apt itself since version 1.1. Previous versions ignore such files with a notice message as described earlier. It is intended to make this format gradually the default format, deprecating the previously described one-line-style format, as it is easier to create, extend and modify for humans and machines alike especially if a lot of sources and/or options are involved. Developers who are working with and/or parsing apt sources are highly encouraged to add support for this format and to contact the APT team to coordinate and share this work. Users can freely adopt this format already, but may encounter problems with software not supporting the format yet. So like, it's the future, but not everyone's caught up yet. 🙈

🔥 THE DEB AND DEB-SRC TYPES: GENERAL FORMAT 🔥

The deb type references a typical two-level Debian archive, distribution/component. The distribution is generally a suite name like stable or testing or a codename like trixie or forky while component is one of main, contrib, non-free or non-free-firmware. The deb-src type references a Debian distribution's source code in the same form as the deb type. A deb-src line is required to fetch source indexes. 😤

The format for two one-line-style entries using the deb and deb-src types is:

deb [ option1=value1 option2=value2 ] uri suite [component1] [component2] [...]
deb-src [ option1=value1 option2=value2 ] uri suite [component1] [component2] [...]

Alternatively the equivalent entry in deb822 style looks like this:

Types: deb deb-src
URIs: uri
Suites: suite
Components: [component1] [component2] [...]
option1: value1
option2: value2

The URI for the deb type must specify the base of the Debian distribution, from which APT will find the information it needs. suite can specify an exact path, in which case the components must be omitted and suite must end with a slash (/). This is useful for the case when only a particular sub-directory of the archive denoted by the URI is of interest. If suite does not specify an exact path, at least one component must be present. 🎯

suite may also contain a variable, $(ARCH) which expands to the Debian architecture (such as amd64 or armel) used on the system. This permits architecture-independent sources.list files to be used. In general this is only of interest when specifying an exact path; APT will automatically generate a URI with the current architecture otherwise. No cap. 💯

Especially in the one-line-style format since only one distribution can be specified per line it may be necessary to have multiple lines for the same URI, if a subset of all available distributions or components at that location is desired. APT will sort the URI list after it has generated a complete set internally, and will collapse multiple references to the same Internet host, for instance, into a single connection, so that it does not inefficiently establish a connection, close it, do something else, and then re-establish a connection to that same host. APT also parallelizes connections to different hosts to more effectively deal with sites with low bandwidth. Literally so efficient. ⚡

It is important to list sources in order of preference, with the most preferred source listed first. Typically this will result in sorting by speed from fastest to slowest (CD-ROM followed by hosts on a local network, followed by distant Internet hosts, for example). 💅

As an example, the sources for your distribution could look like this in the deprecated one-line-style format:

deb [signed-by=/usr/share/keyrings/debian-archive-keyring.gpg] http://deb.debian.org/debian trixie main contrib non-free non-free-firmware
deb [signed-by=/usr/share/keyrings/debian-archive-keyring.gpg] http://deb.debian.org/debian trixie-updates main contrib non-free non-free-firmware
deb [signed-by=/usr/share/keyrings/debian-archive-keyring.gpg] http://deb.debian.org/debian-security trixie-security main contrib non-free non-free-firmware

or like this in deb822 style format:

Types: deb
URIs: http://deb.debian.org/debian
Suites: trixie trixie-updates
Components: main contrib non-free non-free-firmware
Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg

Types: deb
URIs: http://deb.debian.org/debian-security
Suites: trixie-security
Components: main contrib non-free non-free-firmware
Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg

✨ THE DEB AND DEB-SRC TYPES: OPTIONS ✨

Okay bestie, this is the part where each source entry gets to customize how it does its thing — which source gets poked, and how the data comes back. 💅

The format, syntax and names of these options are different between one-line-style and deb822-style (obviously, they're different formats, that's the whole point), but plot twist: both formats have the exact same options available. For simplicity we list the deb822 field name and put the one-line name in brackets. 🫶

Also, reminder: besides setting multivalue options explicitly, you can also modify them based on the default — but we aren't listing those names explicitly here. (iykyk)

Unsupported options are silently ignored by all APT versions. No error, no drama, just... ignored. 🙈
  • Include (include) — a multivalue option defining which packages should be used from this repository. Others are not parsed. 👑
  • Exclude (exclude) — a multivalue option defining which packages should not be used from this repository. They will not be parsed. This option is mutually exclusive with Include — pick one, you can't have both, that's the vibe. 💀
  • Architectures (arch) — a multivalue option defining for which architectures information should be downloaded. If this option isn't set the default is all architectures as defined by the APT::Architectures config option. 🌈
  • Languages (lang) — a multivalue option defining for which languages information such as translated package descriptions should be downloaded. If this option isn't set the default is all languages as defined by the Acquire::Languages config option. 🦋
  • Targets (target) — a multivalue option defining which download targets apt will try to acquire from this source. If not specified, the default set is defined by the Acquire::IndexTargets configuration scope (targets are specified by their name in the Created-By field). Additionally, targets can be enabled or disabled by using the Identifier field as an option with a boolean value instead of using this multivalue option. 🎯
  • PDiffs (pdiffs) — a yes/no value which controls if APT should try to use PDiffs to update old indexes instead of downloading the new indexes entirely. The value of this option is ignored if the repository doesn't announce the availability of PDiffs. Defaults to the value of the option with the same name for a specific index file defined in the Acquire::IndexTargets scope, which itself defaults to the value of configuration option Acquire::PDiffs which defaults to yes. ✨
  • By-Hash (by-hash) — can have the value yes, no or force and controls if APT should try to acquire indexes via a URI constructed from a hashsum of the expected file instead of using the well-known stable filename of the index. Using this can avoid hashsum mismatches, but requires a supporting mirror. A yes or no value activates/disables the use of this feature if this source indicates support for it, while force will enable the feature regardless of what the source indicates. Defaults to the value of the option of the same name for a specific index file defined in the Acquire::IndexTargets scope, which itself defaults to the value of configuration option Acquire::By-Hash which defaults to yes. 🔥

🚨 the "applies to everything" options 🚨

So here's the thing — there are also options which, if set, affect all sources with the same URI and Suite. That means they have to be set on all such entries and can not be varied between different components. APT will try to detect and error out on such anomalies. Not me being strict, that's just how it is. 💅

  • Allow-Insecure (allow-insecure), Allow-Weak (allow-weak) and Allow-Downgrade-To-Insecure (allow-downgrade-to-insecure) — boolean values which all default to no. If set to yes they circumvent parts of apt-secure(8) and should therefore not be used lightly!
Genuinely, do not just casually flip these on. They disable security checks. Periodt. 😭
  • Trusted (trusted) — a tri-state value which defaults to APT deciding if a source is considered trusted or if warnings should be raised before e.g. packages are installed from this source. This option can be used to override that decision. The value yes tells APT always to consider this source as trusted, even if it doesn't pass authentication checks. It disables parts of apt-secure(8), and should therefore only be used in a local and trusted context (if at all) as otherwise security is breached. The value no does the opposite, causing the source to be handled as untrusted even if the authentication checks passed successfully. The default value can't be set explicitly. 👑
  • Signed-By (signed-by) — an option to require a repository to pass apt-secure(8) verification with a certain set of keys rather than all trusted keys apt has configured. It is specified as a list of absolute paths to keyring files (have to be accessible and readable for the _apt system user, so ensure everyone has read-permissions on the file). The recommended locations for keyrings are /usr/share/keyrings for keyrings managed by packages, and /etc/apt/keyrings for keyrings managed by the system operator. If no keyring files are specified the default is the trusted.gpg keyring and all keyrings in the trusted.gpg.d/ directory. All keys in the trusted keyrings are considered valid signers for this repository.

The option may also be set directly to an embedded OpenPGP public key block. Special care is needed to encode the empty line with leading spaces and .: 🧚

Types: deb
URIs: https://deb.debian.org
Suites: stable
Components: main contrib non-free non-free-firmware
Signed-By:
 -----BEGIN PGP PUBLIC KEY BLOCK-----
 .
 mDMEYCQjIxYJKwYBBAHaRw8BAQdAD/P5Nvvnvk66SxBBHDbhRml9ORg1WV5CvzKY
 CuMfoIS0BmFiY2RlZoiQBBMWCgA4FiEErCIG1VhKWMWo2yfAREZd5NfO31cFAmAk
 IyMCGyMFCwkIBwMFFQoJCAsFFgIDAQACHgECF4AACgkQREZd5NfO31fbOwD6ArzS
 dM0Dkd5h2Ujy1b6KcAaVW9FOa5UNfJ9FFBtjLQEBAJ7UyWD3dZzhvlaAwunsk7DG
 3bHcln8DMpIJVXht78sL
 =IE0r
 -----END PGP PUBLIC KEY BLOCK-----
  • Check-Valid-Until (check-valid-until) — a yes/no value which controls if APT should try to detect replay attacks. A repository creator can declare a time until which the data provided in the repository should be considered valid, and if this time is reached, but no new data is provided, the data is considered expired and an error is raised. Besides increasing security, as a malicious attacker can't send old data forever to prevent a user from upgrading to a new version, this also helps users identify mirrors which are no longer updated. However, some repositories such as historic archives are not updated any more by design, so this check can be disabled by setting this option to no. Defaults to the value of configuration option Acquire::Check-Valid-Until which itself defaults to yes. ⏳
  • Valid-Until-Min (valid-until-min) and Valid-Until-Max (valid-until-max) — can be used to raise or lower the time period in seconds in which the data from this repository is considered valid. -Max can be especially useful if the repository provides no Valid-Until field on its Release file to set your own value, while -Min can be used to increase the valid time on seldom updated (local) mirrors of a more frequently updated but less accessible archive (which is in the sources.list as well) instead of disabling the check entirely. Default to the value of the configuration options Acquire::Min-ValidTime and Acquire::Max-ValidTime which are both unset by default. ⭐
  • Check-Date (check-date) — a yes/no value which controls if APT should consider the machine's time correct and hence perform time related checks, such as verifying that a Release file is not from the future. Disabling it also disables the Check-Valid-Until option mentioned above. 🕰️
  • Date-Max-Future (date-max-future) — controls how far from the future a repository may be. Default to the value of the configuration option Acquire::Max-FutureTime which is 10 seconds by default. 🔮
  • InRelease-Path (inrelease-path) — determines the path to the InRelease file, relative to the normal position of an InRelease file. By default, this option is unset and APT will try to fetch an InRelease or, if that fails, a Release file and its associated Release.gpg file. By setting this option, the specified path will be tried instead of the InRelease file, and the fallback to Release files will be disabled. 📁
  • Snapshot (snapshot) — allows selecting an earlier version of the archive from the snapshot service. Supported values are: enable (default) to allow selecting a snapshot with the --snapshot option, ID, or disable to exclude the repository. 🕰️✨

Snapshot IDs are usually timestamps in the form of YYYYMMDDTHHMMSSZ, such as 20220102T030405Z which is the January 2nd, 2022 at 03:04:05 UTC, servers may however support additional types of IDs, and APT does not perform any checks so far. (no cap, it just trusts you) 💖

🎀 options for the girlies writing .sources files for other people 🎀

In the deb822 format, it can be useful to describe the sources in more detail. The following options are not directly used by APT, but suggested to be included by third-parties when providing .sources files to users. So they're like, metadata for the community, not for apt itself. 🫶

  • Contact — specifies the preferred addresses to reach the repository operators on one or more lines. It should be a comma-separated list of RFC5322 email addresses or URLs. 📬
  • Bugs — specifies an HTTPS URL to a public bug tracker or instructions on how to report bugs. 🐛
  • Description — specifies a description for the repository. This is a multi-line field, the first line is a summary, the remaining lines may add more description. 🌸

✨ URI SPECIFICATION ✨

So like, APT needs to know where your packages are coming from, right? These are the URI types it currently recognizes 💖

http (apt-transport-http(1))

The http scheme says "hey, there's an HTTP server over here holding an archive" and honestly it's the most commonly used method, no cap. The URI can literally include login info right in it if the archive needs that, but bestie, please use apt_auth.conf(5) instead — it's the whole vibe. This method also supports SOCKS5 and HTTP(S) proxies, either configured through apt-specific config or handed to it via the environment variable http_proxy, written like this (imagine an HTTP proxy that wants authentication):

http://user:pass@server:port/

Proxy auth details can also come in through apt_auth.conf(5). 🫶

⚠️ Okay so this next part matters: these forms of authentication are insecure, because the entire conversation with the remote server (or proxy) is not encrypted. A sufficiently capable attacker can sit there and observe and record your login and every other interaction. They cannot modify the communication though — because APT's data security model is independent of whichever transport method you picked. See apt-secure(8) for the details, iykyk.

https (apt-transport-https(1))

The https scheme is the encrypted glow-up — an HTTPS server for an archive, and it's very similar in use and available options to the http scheme. The main difference? The communication between apt and the server (or proxy) is encrypted ✨

But ngl, encryption does not stop an attacker from knowing which server (or proxy) apt is talking to, and deeper analysis can potentially still reveal which data was downloaded. If that's a concern for you, the Tor-based schemes mentioned down below might be your suitable alternative 🧚

mirror, mirror+scheme (apt-transport-mirror(1))

The mirror scheme specifies the location of a mirrorlist. By default the scheme used for that location is http, but any other scheme can be used via mirror+scheme. The mirrorlist itself can contain many different URIs for mirrors, and the APT client can transparently pick, choose and fallback between them — which is intended to help both with distributing the load over the available mirrors and making sure clients can still acquire data even if some of the configured mirrors are not available. Iconic behavior honestly 👑

file

The file scheme lets an arbitrary directory in the file system be treated as an archive. Super useful for NFS mounts and local mirrors or archives 🎀

cdrom

The cdrom scheme lets APT use a local CD-ROM, DVD or USB drive, with media swapping. Use the apt-cdrom(8) program to create those cdrom entries in the source list 💅

copy

The copy scheme is identical to the file scheme except that packages get copied into the cache directory instead of being used directly at their location. Great for people using removable media to copy files around with APT 🦋

adding more recognizable URI types

APT can be extended with more methods shipped in other optional packages, and those should follow the naming scheme apt-transport-method. For instance, the APT team also maintains the package apt-transport-tor, which provides access methods for HTTP and HTTPS URIs routed via the Tor network 🌈

🌸 EXAMPLES 🌸

💖 local archive, stable

Uses the archive stored locally (or NFS mounted) at /home/apt/debian for stable/main, stable/contrib, stable/non-free and stable/non-free-firmware.

deb file:/home/apt/debian stable main contrib non-free non-free-firmware
Types: deb
URIs: file:/home/apt/debian
Suites: stable
Components: main contrib non-free non-free-firmware

💖 same thing but unstable

As above, except this uses the unstable (development) distribution.

deb file:/home/apt/debian unstable main contrib non-free non-free-firmware
Types: deb
URIs: file:/home/apt/debian
Suites: unstable
Components: main contrib non-free non-free-firmware

🎀 sources specification for the above

deb-src file:/home/apt/debian unstable main contrib non-free non-free-firmware
Types: deb-src
URIs: file:/home/apt/debian
Suites: unstable
Components: main contrib non-free non-free-firmware

🦋 architectures, bestie

The first line gets package information for the architectures in APT::Architectures, while the second always retrieves amd64 and armel.

deb http://deb.debian.org/debian trixie main
deb [ arch=amd64,armel ] http://deb.debian.org/debian trixie main
Types: deb
URIs: http://deb.debian.org/debian
Suites: trixie
Components: main
Types: deb
URIs: http://deb.debian.org/debian
Suites: trixie
Components: main
Architectures: amd64 armel

🧚 hamm time

Uses HTTP to access the archive at archive.debian.org, and uses only the hamm/main area.

deb http://archive.debian.org/debian-archive hamm main
Types: deb
URIs: http://archive.debian.org/debian-archive
Suites: hamm
Components: main

💜 trixie contrib

Uses HTTPS to access the archive at deb.debian.org, under the debian directory, and uses only the trixie/contrib area.

deb https://deb.debian.org/debian trixie contrib
Types: deb
URIs: https://deb.debian.org/debian
Suites: trixie
Components: contrib

💜 unstable contrib (session reuse arc)

Uses HTTPS to access the archive at deb.debian.org, under the debian directory, and uses only the unstable/contrib area. And listen — if this line appears as well as the one in the previous example in sources.list, a single HTTPS session will be used for both resource lines. Efficiency queen ✨

deb https://deb.debian.org/debian unstable contrib
Types: deb
URIs: https://deb.debian.org/debian
Suites: unstable
Components: contrib

🍓 the substitution variable one

Uses HTTP to access the archive at ftp.tlh.debian.org, under the universe directory, and uses only files found under unstable/binary-i386 on i386 machines, unstable/binary-amd64 on amd64, and so forth for other supported architectures.

📌 Note: this example only illustrates how to use the substitution variable; official debian archives are not structured like this!
deb http://ftp.tlh.debian.org/universe unstable/binary-$(ARCH)/
Types: deb
URIs: http://ftp.tlh.debian.org/universe
Suites: unstable/binary-$(ARCH)/

🔥 binaries AND sources, all the suites

Uses HTTP to get binary packages as well as sources from the stable, testing and unstable suites and the components main and contrib.

deb http://deb.debian.org/debian stable main contrib
deb-src http://deb.debian.org/debian stable main contrib
deb http://deb.debian.org/debian testing main contrib
deb-src http://deb.debian.org/debian testing main contrib
deb http://deb.debian.org/debian unstable main contrib
deb-src http://deb.debian.org/debian unstable main contrib
Types: deb deb-src
URIs: http://deb.debian.org/debian
Suites: stable testing unstable
Components: main contrib

⭐ snapshot timestamp

Uses a specific timestamp for Snapshots.

Types: deb deb-src
URIs: http://deb.debian.org/debian
Suites: stable testing unstable
Snapshot: 20250311T030104Z
Components: main contrib

💀 snapshot disabled

Doesn't allow the optional parameter --snapshot.

Types: deb deb-src
URIs: http://deb.debian.org/debian-security
Suites: stable-security
Snapshot: disable
Components: main contrib non-free-firmware

👀 SEE ALSO 👀

apt-get(8), apt.conf(5), /usr/share/doc/apt/acquire-additional-files.md.gz

🐛 BUGS 🐛

APT bug page[1]. If you wish to report a bug in APT, please see /usr/share/doc/debian/bug-reporting.txt or the reportbug(1) command. Go off, file that bug 🫶

👑 AUTHORS 👑

Jason Gunthorpe

APT team

📝 NOTES 📝

  1. APT bug page https://bugs.debian.org/src:apt

And that's the whole page bestie, you literally read all of it 💅 This gorgeousness is from APT 3.3.5, dated 01 October 2026, and it lives at SOURCES.LIST(5) — go forth and configure your sources, periodt 🎀✨

📦 where this page comes from