Repositories are remote servers that host packages. Debian pulls from multiple sources configured in /etc/apt/sources.list and /etc/apt/sources.list.d/.

deb http://deb.debian.org/debian bookworm main contrib non-free-firmware
deb http://security.debian.org/debian-security bookworm-security main contrib non-free-firmware

Format: deb http://URL/ suite component [component...]

• deb — binary packages (not deb-src)
• http://URL/ — repository URL
• suite — release name (bookworm, trixie, sid)
• component — package category

• main — free software (DFSG-compliant)
• contrib — free software that depends on non-free packages
• non-free — proprietary software
• non-free-firmware — firmware (often proprietary)

Simple method (Ubuntu):

add-apt-repository ppa:username/ppa
sudo apt update

Manual method (any distro):

echo "deb http://example.com/debian bookworm main" | sudo tee /etc/apt/sources.list.d/example.list
sudo apt update

Repositories sign packages with GPG keys. Import keys:

sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys KEYID

Or newer method (Ubuntu 20.04+):

sudo curl -fsSL https://example.com/gpg.key | sudo gpg --dearmor -o /usr/share/keyrings/example-archive-keyring.gpg
echo "deb [signed-by=/usr/share/keyrings/example-archive-keyring.gpg] http://..." | sudo tee /etc/apt/sources.list.d/example.list

• deb.debian.org — main archive
• security.debian.org — security updates
• deb.debian.org/debian-backports — backports (newer packages for stable)

• Docker: deb [signed-by=...] https://download.docker.com/linux/debian
• NodeSource: deb https://deb.nodesource.com/node_X.x bookworm main
• PostgreSQL: deb http://apt.postgresql.org/pub/repos/apt bookworm-pgdg main

Always trust the source and verify GPG keys before adding.