# Debian repositories

Repositories are remote servers that host packages. Debian pulls from multiple sources configured in `/etc/apt/sources.list` and `/etc/apt/sources.list.d/`.

## Sources list format

```
deb http://deb.debian.org/debian bookworm main contrib non-free-firmware
deb http://security.debian.org/debian-security bookworm-security main contrib non-free-firmware
```

Format: `deb http://URL/ suite component [component...]`

- `deb`: binary packages (not `deb-src`)
- `http://URL/`: repository URL
- `suite`: release name (bookworm, trixie, sid)
- `component`: package category

## Components

- **main**: free software (DFSG-compliant)
- **contrib**: free software that depends on non-free packages
- **non-free**: proprietary software
- **non-free-firmware**: firmware (often proprietary)

## Adding repositories

Simple method (Ubuntu):

```bash
add-apt-repository ppa:username/ppa
sudo apt update
```

Manual method (any distro):

```bash
echo "deb http://example.com/debian bookworm main" | sudo tee /etc/apt/sources.list.d/example.list
sudo apt update
```

## Package verification

Repositories sign packages with GPG keys. Import keys:

```bash
sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys KEYID
```

Or newer method (Ubuntu 20.04+):

```bash
sudo curl -fsSL https://example.com/gpg.key | sudo gpg --dearmor -o /usr/share/keyrings/example-archive-keyring.gpg
echo "deb [signed-by=/usr/share/keyrings/example-archive-keyring.gpg] http://..." | sudo tee /etc/apt/sources.list.d/example.list
```

## Official Debian repositories

- `deb.debian.org`: main archive
- `security.debian.org`: security updates
- `deb.debian.org/debian-backports`: backports (newer packages for stable)

## Common third-party repos

- Docker: `deb [signed-by=...] https://download.docker.com/linux/debian`
- NodeSource: `deb https://deb.nodesource.com/node_X.x bookworm main`
- PostgreSQL: `deb http://apt.postgresql.org/pub/repos/apt bookworm-pgdg main`

Always trust the source and verify GPG keys before adding.