# Debian Repositories

Repositories are remote servers that host packages. Debian pulls from multiple sources configured in `/etc/apt/sources.list` and `/etc/apt/sources.list.d/`.

## Sources List Format

```
deb http://deb.debian.org/debian bookworm main contrib non-free-firmware
deb http://security.debian.org/debian-security bookworm-security main contrib non-free-firmware
```

Format: `deb http://URL/ suite component [component...]`

- `deb` — binary packages (not `deb-src`)
- `http://URL/` — repository URL
- `suite` — release name (bookworm, trixie, sid)
- `component` — package category

## Components

- **main** — free software (DFSG-compliant)
- **contrib** — free software that depends on non-free packages
- **non-free** — proprietary software
- **non-free-firmware** — firmware (often proprietary)

## Adding Repositories

Simple method (Ubuntu):

```bash
add-apt-repository ppa:username/ppa
sudo apt update
```

Manual method (any distro):

```bash
echo "deb http://example.com/debian bookworm main" | sudo tee /etc/apt/sources.list.d/example.list
sudo apt update
```

## Package Verification

Repositories sign packages with GPG keys. Import keys:

```bash
sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys KEYID
```

Or newer method (Ubuntu 20.04+):

```bash
sudo curl -fsSL https://example.com/gpg.key | sudo gpg --dearmor -o /usr/share/keyrings/example-archive-keyring.gpg
echo "deb [signed-by=/usr/share/keyrings/example-archive-keyring.gpg] http://..." | sudo tee /etc/apt/sources.list.d/example.list
```

## Official Debian Repositories

- `deb.debian.org` — main archive
- `security.debian.org` — security updates
- `deb.debian.org/debian-backports` — backports (newer packages for stable)

## Common Third-Party Repos

- Docker: `deb [signed-by=...] https://download.docker.com/linux/debian`
- NodeSource: `deb https://deb.nodesource.com/node_X.x bookworm main`
- PostgreSQL: `deb http://apt.postgresql.org/pub/repos/apt bookworm-pgdg main`

Always trust the source and verify GPG keys before adding.