Repositories are remote servers that host packages. Debian pulls from multiple sources configured in /etc/apt/sources.list and /etc/apt/sources.list.d/.

deb http://deb.debian.org/debian bookworm main contrib non-free-firmware
deb http://security.debian.org/debian-security bookworm-security main contrib non-free-firmware

Format: deb http://URL/ suite component [component...]

• deb: binary packages (not deb-src)
• http://URL/: repository URL
• suite: release name (bookworm, trixie, sid)
• component: package category

• main: free software (DFSG-compliant)
• contrib: free software that depends on non-free packages
• non-free: proprietary software
• non-free-firmware: firmware (often proprietary)

Simple method (Ubuntu):

add-apt-repository ppa:username/ppa
sudo apt update

Manual method (any distro):

echo "deb http://example.com/debian bookworm main" | sudo tee /etc/apt/sources.list.d/example.list
sudo apt update

Repositories sign packages with GPG keys. Import keys:

sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys KEYID

Or newer method (Ubuntu 20.04+):

sudo curl -fsSL https://example.com/gpg.key | sudo gpg --dearmor -o /usr/share/keyrings/example-archive-keyring.gpg
echo "deb [signed-by=/usr/share/keyrings/example-archive-keyring.gpg] http://..." | sudo tee /etc/apt/sources.list.d/example.list

• deb.debian.org: main archive
• security.debian.org: security updates
• deb.debian.org/debian-backports: backports (newer packages for stable)

• Docker: deb [signed-by=...] https://download.docker.com/linux/debian
• NodeSource: deb https://deb.nodesource.com/node_X.x bookworm main
• PostgreSQL: deb http://apt.postgresql.org/pub/repos/apt bookworm-pgdg main

Always trust the source and verify GPG keys before adding.