Restore Default Debian and Ubuntu Repositories

Last updated: November 21, 2023

Reviewed by: Michal Aibin

1. Introduction

Repositories hold data and metadata about packages on and available to a given Linux distribution. As such, they play a critical role when it comes to installing, updating, and upgrading software, as well as maintaining the system in general. Because of this, configuring the proper repositories in Linux is an important task. Considering this, it’s not rare that we might want to reinstate our original repositories after events like file corruption, accidental replacement, or simple misconfiguration.

In this tutorial, we’ll look at ways to acquire and apply the original apt repositories of Debian and the Debian-based Ubuntu installations. First, we explain the concept of sources and repositories in general. After that, we turn to Debian repositories and source files, as well as their structure. Finally, we cover Ubuntu, highlighting some differences between the two related distributions.

We tested the code in this tutorial on Debian 12 (Bookworm) and Ubuntu 22 (Jammy Jellyfish) with GNU Bash 5.1. It should work in most POSIX-compliant environments unless otherwise specified.

2. Sources and Repositories

Repositories are the source for many packages available for a system. They have a structure that encompasses index files and package data for the proper installation of software and its dependencies.

Software within a repository has different attributes:

Such attributes enable users to only allow packages of a certain kind on their system. This way, they can test new features or keep their system stable and secure, depending on the current needs and requirements. Further, location-based mirrors for repositories and localized packages are also available depending on the country and language.

Overall, metadata exists for sorting, filtering, and working with packages. Furthermore, custom repositories may introduce new metadata as well. In fact, not all repository sources have to be distribution-approved, just compatible.

This makes it fairly easy to fill our repository Universal Resource Identifier (URI) file with different, old, or unnecessary sources, even corrupting existing ones.

So, let’s explore this concept for two distributions.

3. Debian Repositories

When it comes to Debian, repositories have particular definitions, which can be specified in the file that lists the ones we use. Let’s begin by checking the sources file.

3.1. Source File

Under Debian, the default repository URI file resides at /etc/apt/sources.list:

$ ls -l /etc/apt/sources.list
-rw-r--r-- 1 root root 63 Jul 19 01:13 /etc/apt/sources.list

In this case, ls shows the [-l]ong list format for sources.list. Consequently, we see its permissions allow any user to read the file, but only superusers can write to it. The same is valid for the /etc/apt/sources.list.d/ directory with its preferably deb822-formatted files.

The usual /etc/apt/sources.list file format includes several fields:

Let’s see a very minimal example:

$ cat /etc/apt/sources.list
deb http://deb.debian.org/debian stable main non-free-firmware

Here, we use the main official stable packages and release in deb binary form through the http://deb.debian.org/debian URI, making non-free packages available for firmware.

Importantly, we can also add an offline URI, such as a CD or DVD of a specific release:

deb cdrom:[Debian GNU/Linux 12.0.0 _Bookworm_ - Official amd64 20230610-10:00]/ bookworm main non-free-firmware

Finally, custom repositories are also a possible source for package installation.

3.2. Repository Structure

APT repositories have a predefined format.

For example, if we visit the URI for one of the main Debian repositories at http://deb.debian.org/debian, among other information, we see a directory listing:

[ICO]          Name           Last modified     Size
[PDR]  Parent Directory                         -
[   ]  README                 2023-07-22 08:49  1.2K
[   ]  README.CD-manufacture  2010-06-26 09:52  1.3K
[TXT]  README.html            2023-07-22 08:49  2.8K
[TXT]  README.mirrors.html    2017-03-04 20:08  291
[TXT]  README.mirrors.txt     2017-03-04 20:08  86
[DIR]  dists/                 2023-07-22 22:52  -
[DIR]  doc/                   2023-08-25 01:53  -
[   ]  extrafiles             2023-08-25 02:23  233K
[DIR]  indices/               2023-08-25 02:22  -
[   ]  ls-lR.gz               2023-08-25 02:17  14M
[DIR]  pool/                  2022-10-05 17:09  -
[DIR]  project/               2008-11-17 23:05  -
[DIR]  tools/                 2012-10-10 16:29  -
[DIR]  zzz-dists/             2023-07-22 09:48  -

In particular, we can reference the README file of most repositories to see the different options we have in terms of package versions:

See http://www.debian.org/ for information about Debian GNU/Linux.
Four Debian releases are available on the main site:

Debian 10.13, or buster.  Access this release through dists/oldoldstable
Debian 10.13 was released Saturday, 10th September 2022.

Debian 11.7, or bullseye.  Access this release through dists/oldstable
Debian 11.7 was released Saturday, 29th April 2023.

Debian 12.1, or bookworm.  Access this release through dists/stable
Debian 12.1 was released Saturday, 22nd July 2023.

Testing, or trixie.  Access this release through dists/testing.  The
current tested development snapshot is named bookworm.  Packages which
have been tested in unstable and passed automated tests propagate to
this release.

Unstable, or sid.  Access this release through dists/unstable.  The
current development snapshot is named sid.  Untested candidate
packages for future releases.

Older releases of Debian are at http://archive.debian.org/debian-archive

--- Other directories:
doc             Debian documentation.
indices         Various indices of the site.
project         Experimental packages and other miscellaneous files.
tools           Tools for creating boot disks and booting Linux.

Notably, there are usually different release versions of repositories, as we saw earlier:

+----------------------------------------------------+
| Type     | Description                             |
|==========|=========================================|
| old      | versions older than the current release |
| current  | current released version                |
| latest   | development version, current build      |
|----------|-----------------------------------------|
| secure   | security-tested packages                |
| stable   | stable packages, passed integration     |
| feature  | feature-rich packages                   |
| testing  | packages under test for future builds   |
| unstable | unstable packages, differing reasons    |
+----------------------------------------------------+

In practice, we often use a dists/stable path such as http://ftp.debian.org/debian/dists/stable/ to ensure we have the latest packages that provide the best security without risking instability.

Naturally, the structure above is similar for optical disk, custom, and local repositories.

3.3. Default Repositories

Most Linux distributions come with a default repository URI set as part of the original installation.

Its initial contents depend on the type of installation we perform:

  • CD or DVD
  • minimal
  • network

Still, with the majority of Debian installations, we can expect some base sources in the /etc/apt/sources.list file:

$ cat /etc/apt/sources.list
#deb cdrom:[Official Debian GNU/Linux Live 2023-06-26T06:56:00Z]/ bookworm main non-free-firmware

deb http://deb.debian.org/debian stable main
deb-src http://deb.debian.org/debian stable main

deb http://deb.debian.org/debian-security/ stable-security main
deb-src http://deb.debian.org/debian-security/ stable-security main

deb http://deb.debian.org/debian stable-updates main
deb-src http://deb.debian.org/debian stable-updates main

In this case, the first line is commented-out, so the system uses the updated online versions instead of the static optical medium.

If we replace stable with the relevant name, e.g., bookworm, we get the sane defaults for new installations. Naturally, how these defaults actually look depends on some choices we have during the installation:

  • Whether we choose to use a network mirror
  • Which network mirror we select, if any

While it’s rare to avoid network mirrors, the choice of one depends on the user. Still, there is a CDN-backed safe default: http://deb.debian.org. However, our final choice during installation can be location-specific or linked to one or another institution:

Finally, we might not really need the deb-src sources for our packages or the early releases of stable-security components and stable-updates in general. Thus, a possible minimal default for a stable sources.list file contains just one line:

$ cat /etc/apt/sources.list
deb http://deb.debian.org/debian stable main

This way, we ensure a current working system.

4. Ubuntu Repositories

Since it’s Debian-based, Ubuntu follows much of the formatting that Debian establishes.

4.1. Source File

Because of their shared package manager, the main repository URI file in Ubuntu is again /etc/apt/sources.list. In fact, the format of the file is mostly identical, with only the possible field values being different.

Ubuntu can even use the deb822 source format:

Types: deb deb-src
URIs: uri
Suites: suite
Components: [component1] [component2] [...]
option1: value1
option2: value2

Still, it’s worth noting that Ubuntu uses four types of repositories:

  • main: free and open-source packages supported by Canonical
  • universe: free and open-source packages maintained by the community
  • restricted: closed-source device drivers
  • multiverse: copyrighted and similarly legally restricted packages

Of course, these are akin to the component part values of Debian. In essence, there’s almost full compatibility.

4.2. Repository Structure

As it derives from it, Ubuntu adopts the Debian repository structure we already discussed:

[ICO]    Name              Last modified     Size
[PDR]    Parent Directory                    -
[DIR]    dists/            2023-04-25 12:34  -
[DIR]    indices/          2023-09-05 05:04  -
[ ]      ls-lR.gz          2023-09-05 05:05  25M
[DIR]    pool/             2010-02-27 06:30  -
[DIR]    project/          2013-06-28 11:52  -
[DIR]    ubuntu/           2023-09-05 05:11  -

Here, we see what a Web browser shows for the main http://archive.ubuntu.com/ubuntu/ repository URI. It’s comparable to the Debian repository structure we already saw.

Crucially, the testing, stable, unstable, and similar branches that Debian offers aren’t part of Ubuntu. Instead, Ubuntu administrators are expected to upgrade the whole system based on new releases. While this mechanism can be limiting, it often ensures a more stable system and workflow with less involvement.

4.3. Default Repositories

Let’s look at the /etc/apt/sources.list of a fresh Ubuntu installation:

$ cat /etc/apt/sources.list
#deb cdrom:[Ubuntu 22.04.3 LTS _Jammy Jellyfish_ - Release amd64 (20230808.8)]/ jammy main restricted

# See http://help.ubuntu.com/community/UpgradeNotes for how to upgrade to
# newer versions of the distribution.
deb http://fi.archive.ubuntu.com/ubuntu/ jammy main restricted
# deb-src http://fi.archive.ubuntu.com/ubuntu/ jammy main restricted

## Major bug fix updates produced after the final release of the
## distribution.
deb http://fi.archive.ubuntu.com/ubuntu/ jammy-updates main restricted
# deb-src http://fi.archive.ubuntu.com/ubuntu/ jammy-updates main restricted

## N.B. software from this repository is ENTIRELY UNSUPPORTED by the Ubuntu
## team. Also, please note that software in universe WILL NOT receive any
## review or updates from the Ubuntu security team.
deb http://fi.archive.ubuntu.com/ubuntu/ jammy universe
# deb-src http://fi.archive.ubuntu.com/ubuntu/ jammy universe
deb http://fi.archive.ubuntu.com/ubuntu/ jammy-updates universe
# deb-src http://fi.archive.ubuntu.com/ubuntu/ jammy-updates universe

## N.B. software from this repository is ENTIRELY UNSUPPORTED by the Ubuntu
## team, and may not be under a free licence. Please satisfy yourself as to
## your rights to use the software. Also, please note that software in
## multiverse WILL NOT receive any review or updates from the Ubuntu
## security team.
deb http://fi.archive.ubuntu.com/ubuntu/ jammy multiverse
# deb-src http://fi.archive.ubuntu.com/ubuntu/ jammy multiverse
deb http://fi.archive.ubuntu.com/ubuntu/ jammy-updates multiverse
# deb-src http://fi.archive.ubuntu.com/ubuntu/ jammy-updates multiverse

## N.B. software from this repository may not have been tested as
## extensively as that contained in the main release, although it includes
## newer versions of some applications which may provide useful features.
## Also, please note that software in backports WILL NOT receive any review
## or updates from the Ubuntu security team.
deb http://fi.archive.ubuntu.com/ubuntu/ jammy-backports main restricted universe multiverse
# deb-src http://fi.archive.ubuntu.com/ubuntu/ jammy-backports main restricted universe multiverse

deb http://security.ubuntu.com/ubuntu jammy-security main restricted
# deb-src http://security.ubuntu.com/ubuntu jammy-security main restricted
deb http://security.ubuntu.com/ubuntu jammy-security universe
# deb-src http://security.ubuntu.com/ubuntu jammy-security universe
deb http://security.ubuntu.com/ubuntu jammy-security multiverse
# deb-src http://security.ubuntu.com/ubuntu jammy-security multiverse

# This system was installed using small removable media
# (e.g. netinst, live or single CD). The matching "deb cdrom"
# entries were disabled at the end of the installation process.
# For information about how to configure apt package sources,
# see the sources.list(5) manual.

In this case, the repositories are localized to Finland as denoted by the fi subdomain prefix to most domains. We also have a lot of verbosity due to the aim of Ubuntu to have a user-friendly nature. Still, we see the overall structure and even URI composition being the same as the ones for Debian.

So, let’s remove the comments and see what we have as a sane default:

$ cat /etc/apt/sources.list
deb http://archive.ubuntu.com/ubuntu/ jammy main restricted

deb http://archive.ubuntu.com/ubuntu/ jammy-updates main restricted

deb http://archive.ubuntu.com/ubuntu/ jammy universe
deb http://archive.ubuntu.com/ubuntu/ jammy-updates universe

deb http://archive.ubuntu.com/ubuntu/ jammy multiverse
deb http://archive.ubuntu.com/ubuntu/ jammy-updates multiverse

deb http://archive.ubuntu.com/ubuntu/ jammy-backports main restricted universe multiverse

deb http://security.ubuntu.com/ubuntu jammy-security main restricted
deb http://security.ubuntu.com/ubuntu jammy-security universe
deb http://security.ubuntu.com/ubuntu jammy-security multiverse

As we can see, Ubuntu exhibits a couple of differences from Debian at this point:

  • No deb-src package use by default
  • Can’t replace jammy with stable

Still, we can reduce and configure the above to our liking. Even the mirror can be changed via a global search and replace.

5. Summary

In this article, we discussed the repositories of Debian and the Debian-based Ubuntu, as well as ways to restore the default repository list.

In conclusion, although they have the same roots, Debian and Ubuntu do exhibit some differences when it comes to repository and source configuration.

Comments are open for 30 days after publishing a post. For any issues past this date, use the Contact form on the site.