Skip to main content
Back to path

Welcome to a Grasp lesson

Create a free account to keep studying and create your own study path.

Lesson 37

Managing Package Repositories

Recommended resources

Hello! Welcome back to our module on Software and Package Management.

In our last lesson, we established the "why" behind modern package management. You learned that high-level tools like apt and dnf are "smart" because they connect to repositories to automatically resolve complex dependency chains. This saves you from the frustration of "dependency hell."

Today, we'll dive into the details of those repositories. This lesson directly addresses the learning outcome: Configure and manage package repositories. You will learn where the lists of these software sources are stored, how to read them, and, most importantly, how to add new ones to install software that isn't included in your distribution's default set. This is a fundamental skill for any Linux administrator.

1. What is a Repository?

A package repository is a centralized server that stores software packages and the metadata about them. Think of it as a massive, organized warehouse for software. When you ask your package manager to install something, it consults its list of configured warehouses to find the package and everything it depends on.

Let's break down the key components of a repository.

Package Management: APT, YUM, DNF

The following article, 'Package Management: APT, YUM, DNF,' gives a concise breakdown of what a repository contains and where to find its configuration files on your system. This is our theoretical foundation for today's lesson.

Please read the short section under the heading 'Repositories'. It's located within the main section 'Understanding Package Management'. Focus on the three components listed: software packages, metadata, and GPG keys, and note the different configuration locations for APT and DNF.

As you just read, a repository isn't just a folder of files. It's a structured system containing:

  • Software packages: The actual .deb (for Debian/Ubuntu) or .rpm (for Red Hat/Fedora) files.
  • Metadata: An index or a database that lists all available packages, their versions, and their dependencies. This is what your package manager downloads when you run a command like sudo apt update.
  • GPG Keys: These are cryptographic keys used to sign the packages and metadata. Your system uses the repository's public key to verify that the packages you're downloading are authentic and have not been tampered with.

Repository Configuration Files

The location of the configuration files that tell your system which repositories to use is one of the key differences between the two major Linux families.

For Debian-based systems (like Ubuntu):

  • The main configuration file is /etc/apt/sources.list.
  • More commonly, individual repository files are placed in the /etc/apt/sources.list.d/ directory. This is the preferred modern approach as it keeps repository configurations modular and easier to manage.

This image shows what a modern repository configuration file looks like on Ubuntu.

Ubuntu APT Repository Configuration File
Contents of an `/etc/apt/sources.list.d/ubuntu.sources` file. Notice how it specifies the type (`deb`), location (`URI`), distribution suite (`noble`, `noble-updates`), and components (`main`, `restricted`) for each software source.

For Red Hat-based systems (like Fedora, CentOS, RHEL):

  • Repository configuration files, which always end in .repo, are located in the /etc/yum.repos.d/ directory. (The directory is named yum.repos.d for historical reasons, even when using the modern dnf command).
  • Each .repo file can contain one or more repository definitions, each marked with a unique identifier in brackets, like [example-repo].

2. Managing Repositories on Debian-based Systems (APT)

Sooner or later, you'll need software that isn't in your distribution's official repositories. On Ubuntu, a common way to get this software is through a PPA (Personal Package Archive), which is a small, focused repository often maintained by an application's developer. For other Debian-based systems, you might add a developer's official repository directly.

The process involves three key steps:

  1. Add the new repository to your system's sources list.
  2. Import the repository's GPG key so your system trusts it.
  3. Update the package manager's local cache to include the packages from the new source.

Let's watch a video demonstrating how this is done.

Package Management (Debian & Ubuntu) - Bash Basics (Linux CLI)

This clip from Nerd on the Street shows how to add a third-party repository for the Vivaldi web browser on an Ubuntu system. It clearly demonstrates the process, including what happens when you forget to add the GPG key.

Watch the video from 31:31 to 35:32. Focus on the use of the add-apt-repository command, the resulting GPG error, and the subsequent commands (wget and apt-key add) used to download and import the public key to fix the error.

To summarize the video and connect it to our theory:

  • sudo add-apt-repository ...: This command is a convenient script that automates adding a repository source. For PPAs, you just need the PPA name (ppa:user/ppa-name). For other repos, you can provide the full source line as shown in the video. It creates a new file for that repo inside /etc/apt/sources.list.d/.
  • GPG Key Management: The video showed a GPG error because the repository was added without its key. The system couldn't verify the packages. The commands wget (to download the key) and sudo apt-key add (to add it to the system's keyring) resolved this.
    • Note: While apt-key is still common, it is being phased out. The modern, more secure method involves saving the key to /usr/share/keyrings/ and specifying it directly in the source file, as shown in the optional reading from resource [LINK](https://cubepath.com/docs/operating-systems/package-management-apt-yum-dnf) (section 4). For the exam, you should be aware of both methods.
  • sudo apt update: This final, crucial step tells apt to download the package lists from all configured repositories, including the one you just added. Without this, your system won't know about the new packages.

3. Managing Repositories on Red Hat-based Systems (DNF)

The process on a Red Hat-based system is conceptually similar but uses different tools. Instead of add-apt-repository, you'll typically use dnf config-manager.

One of the most common third-party repositories for the Red Hat family is EPEL (Extra Packages for Enterprise Linux), which provides many popular packages not included in the official RHEL/CentOS/Rocky Linux repositories.

Let's see the DNF equivalent of adding a third-party repository.

Package Management (Red Hat & Fedora) - Bash Basics (Linux CLI)

In this corresponding clip, Nerd on the Street demonstrates adding the same Vivaldi repository, but this time on a Fedora system using DNF.

Watch from 18:54 to 22:08. Pay close attention to the dnf config-manager --add-repo command. Notice how DNF handles the GPG key import differently—it prompts you the first time you try to install a package from the new repo.

The workflow on DNF systems is often more streamlined:

  • sudo dnf config-manager --add-repo <URL>: This is the primary command for adding a new repository. The URL can point directly to the repository's URL or to a .repo file. This command will create a new .repo file in /etc/yum.repos.d/.
  • GPG Key Management: As you saw, DNF conveniently asks if you want to import the GPG key the first time you download a package from the new repository. This simplifies the process compared to apt's manual key-handling. You can also import a key manually with sudo rpm --import <KEY_URL>.
  • Listing Repositories: To see which repositories are enabled on your system, you can use the command dnf repolist. To see all repositories (including disabled ones), use dnf repolist --all.
Test your understanding!

You are the administrator for two servers: one running Ubuntu 22.04 and the other running Rocky Linux 9. You need to install a monitoring agent from a third-party vendor on both.

  1. On the Ubuntu server, the vendor documentation tells you to run sudo add-apt-repository 'deb [arch=amd64] https://vendor.com/repo/ubuntu stable main'. After running this, what is the very next command you should run before trying to install the package?
  2. On the Rocky Linux server, the documentation gives you a URL: https://vendor.com/repo/el9/vendor.repo. What single command would you use to add this repository to your system?
  3. After adding the repository on the Rocky Linux server, you run sudo dnf install vendor-agent. The command works, but a prompt appears asking "Is this GPG key okay? [y/N]". What is happening and why is it important to verify this key?
Show answer
  1. You must run sudo apt update. This command downloads the package list from the newly added repository so that apt knows the vendor-agent package exists.
  2. You would use sudo dnf config-manager --add-repo https://vendor.com/repo/el9/vendor.repo.
  3. This is DNF's mechanism for importing the GPG key for a new repository. It's asking you to confirm that you trust the source. Verifying the key (ideally by comparing its fingerprint to one published by the vendor on a secure channel) ensures that the packages you are about to install are authentic and haven't been modified by a malicious third party.

Conclusion

You have now learned how to find, interpret, and manage the software sources your package manager uses. This moves you from being a user who can only install what's provided by default to an administrator who can securely extend the system's capabilities with third-party software.

Key Takeaways:

  • Repository configurations are stored in /etc/apt/sources.list.d/ on Debian-based systems and /etc/yum.repos.d/ on Red Hat-based systems.
  • GPG keys are crucial for security, verifying that packages are from a trusted source.
  • On Debian systems, use add-apt-repository and always follow up with apt update.
  • On Red Hat systems, use dnf config-manager --add-repo. DNF will typically handle the GPG key import for you.
  • Knowing how to manage repositories is essential for installing software not found in the official distribution channels.

Preview of the Next Lesson:

With your repositories configured, you're ready to start managing software. In our next lesson, we will focus on the Debian family and take a deep dive into using the apt and dpkg commands to install, update, query, and remove packages.