Modern apt sources with deb822

debian 13 / published / guide #4 / ≈ 2 min read

When Debian wants to know where to download software from, it reads files inside /etc/apt/sources.list.d/. There used to be only one format — a tight, one-line-per-source style that was hard to read and clumsy to extend. Debian 13 brings a tidier alternative called deb822 that's much friendlier once you see it.

What's a "source," anyway?

A source is just a server (called a "mirror") and a section of it (called a "component" — main, contrib, etc.) that apt can install from. Your sources file lists which servers and which components you trust.

The old format vs the new format

Old (one line per source):

deb http://deb.debian.org/debian trixie main contrib non-free-firmware

New (deb822, keyed fields):

Types: deb
URIs: http://deb.debian.org/debian
Suites: trixie trixie-updates trixie-backports
Components: main contrib non-free-firmware
Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg

Same information, but you can put multiple suites and components on one stanza, and it's clearer which key is being used to verify signatures.

Step 1: Switch your main Debian source

Create a new file:

sudo nano /etc/apt/sources.list.d/debian.sources

Paste:

Types: deb
URIs: http://deb.debian.org/debian
Suites: trixie trixie-updates trixie-backports
Components: main contrib non-free-firmware
Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg

Types: deb
URIs: http://security.debian.org/debian-security
Suites: trixie-security
Components: main contrib non-free-firmware
Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg

Save (Ctrl+O, Enter, Ctrl+X).

Then empty out the old file so you're not pulling from both:

sudo mv /etc/apt/sources.list /etc/apt/sources.list.bak
sudo apt update

If apt update runs cleanly, you're good. The old file is safely backed up in sources.list.bak in case you need it.

What backports buys you

The new file above includes trixie-backports — that's a special area where newer versions of selected packages are made available. You don't get them by default; you ask for one explicitly:

sudo apt -t trixie-backports install some-package

Adding a third-party repo (cleanly)

Adding software from outside Debian used to mean a mess of apt-key add commands. In deb822 it's tidier. Say you want to install something from a vendor — download their signing key once, drop it in a known place, then point a sources file at it.

sudo mkdir -p /etc/apt/keyrings
sudo curl -fsSL https://somevendor.example/key.asc 
     -o /etc/apt/keyrings/somevendor.asc

sudo nano /etc/apt/sources.list.d/somevendor.sources

Inside the new file:

Types: deb
URIs: https://somevendor.example/debian
Suites: stable
Components: main
Signed-By: /etc/apt/keyrings/somevendor.asc

Now only this one repo uses that key — no risk of the vendor's key being accepted for other repos. And removing the vendor is a single rm of the two files.

← back to index