/read/online

5: Introduction to Debian Software Package Management

Anyone who's ever used a computer has come to the realisation that software doesn't stand still: there are a huge range of different programs available for all sorts of tasks, and new software as well as updates to existing packages are being released all the time. Software may come pre-installed on your computer, you can download it off the Internet, buy it on CD-ROM, copy it from friends, compile it from source code or even write it yourself. The number and variety of programs is bewildering.

The Debian Approach

Managing all the programs on your computer and making sure they work properly together can be a real juggling act. Debian to the rescue: Debian's software package management is one of the wonders of the computer world. After a while you'll wonder how you ever survived without it.

If you've used Windows or MacOS you're probably familiar with the concept of software installers: you get an installer for a program on CD-ROM or off the Internet, run it on your computer and it puts the software where it needs to go. The actual installer isn't standardised and varies depending on what the software publisher decides to use, and there may or may not be a simple way to un-install the software later.

In contrast, Debian strives for consistency in the process of managing software. All software is managed using a strictly defined package format that contains the program itself plus information about how it needs to be installed, and all packages are managed by the your computer in the exact same way. These packages are normally made available via the Internet using designated software servers run by Debian or third parties, or they can be distributed directly such as by CD, email or by downloading from a web site. At the time of writing there are more than 12,000 packages available directly from the official Debian servers, and many more from unofficial sources. Unlike software from traditional vendors, these packages are available immediately. You don't have to go to a store and buy a CD-ROM, or download an installer and then pay online for an activation code. As long as you've got an Internet connection, you just have to select the package you want and it'll be immediately downloaded to your computer and installed.

Package Management Tools

While the software packages themselves are standardised, Debian provides a number of alternative ways to manage them on your local machine depending on your system requirements and personal preference.

The Debian tools for software package management are somewhat layered, ranging from low-level tools like Dpkg which directly manages packages, to mid-level tools like Apt that automatically fetch packages and their dependencies, and high-level tools like Synaptic that let you graphically browse package lists and do simple point-and-click installation.

Experienced Debian users tend to make use of different tools at different times depending on what they are trying to do. For example, if you have a package saved to disk that you downloaded off a website, it would be simplest to just use Dpkg to install it directly. Or if you are managing a system off the command line and want to install packages from a Debian server or CD, Apt is probably the best tool to use. Or if you want an interface that lets you browse through software categories and select items you want, a variety of options such as Synaptic, Dselect or Aptitude may be best.

Personally I find that I almost always end up using Apt, plus Dpkg when I want to manage packages directly. That's just my preference: Synaptic may be best for you if you're not so comfortable with the command line and would prefer a graphical interface.

Note that whatever tools you end up using, you will almost certainly need to be the root user to install software on a Debian machine. Linux machines are true multi-user systems and when software is installed it is usually accessible to all users. There is no standardised way to allow individual users to install packages just for their own use. All installed software is centralised. Normal users therefore cannot install or remove packages, because that would pose a security risk as well as being downright annoying to other users if a piece of software they rely on suddenly changes or disappears entirely.

It's possible to set up a system called 'sudo' to allow normal users to perform operations as the root user, but for now it's best to just open up a terminal, enter the 'su' command then the root password before running any package management tools.

Dpkg

Dpkg is the basis of the Debian package management system, and allows direct manipulation of packages. If you've got a local package on your disk called 'program-1.0-1.deb' that you want to install, Dpkg is the tool to use.

There are two ways Dpkg can refer to a package, depending on circumstances: if you have a package file directly on disk that you want to install, you can refer to it using the filename of the package such as 'program-1.0-1.deb'. If the package has already been installed and you want to remove it, you instead use the name of the program itself, such as 'program'.

dpkg -r program
Remove (uninstall) the listed program package. This only removes the binaries (the program itself) and any startup scripts, but does not remove any configuration files for it. Reinstalling at a later date will then use your existing config files, so if you change your mind and decide to reinstall the program you won't have to reconfigure from scratch. Removing a package requires there be no other packages dependent on it: if it complains about dependencies, you need to remove those dependent packages first.

dpkg -P program
Purge (fully uninstall) the listed package. This removes everything related to that package: binaries, startup scripts, config files, everything. Purging a package requires there be no other packages dependent on it: if it complains about dependencies, you need to remove those dependent packages first. If you purge a package and then decide you want it back, you'll have to reconfigure it because the purge nukes all the configuration information as well.

dpkg -i program-1.0-1.deb
Install a package from a local Deb file on disk: if you download a .deb package directly from the Internet, it can be installed directly this way.

dpkg -l program
List version info and status of a currently installed package.

dpkg -L program
List all files related to this currently installed package: if you've just installed something, and you don't know where it went, use this to find it.

dpkg -S foo
Find the package that contains the file named 'foo'. Very useful if you've got a file on disk but don't know where it came from!

Apt And Friends

I love Apt. There, I've said it. Apt was what originally got me hooked on Debian, and I'm still amazed at how well it works. While it was not originally intended as a front-end tool but rather as a back-end for other tools like Synaptic and Dselect, running Apt directly is probably the most commonly used method of installing and removing packages. You can read a full how-to about Apt at www.debian.org/doc/manuals/apt-howto/ if you want all the details, but I'll show you the essentials here.

Commands You Can't Live Without

I love Apt so much that I set up shortcuts for the common commands on all my Debian machines so I can type them in more easily. To do the same, just add these lines to the file '/root/.bashrc' to enable the shortcuts for the root user:

alias agi='apt-get install' alias agu='apt-get update' alias ags='apt-cache search' alias agsh='apt-cache show' alias agr='apt-get remove' alias agd='apt-get dist-upgrade'

Then you won't need to type the whole command: to do a search, for example, just type 'ags foo' to look for a package named foo. Laziness is a virtue!

apt-get update
This retrieves the current list of packages from all servers in your sources.list. If you don't do this from time to time your local list of available packages may become out of date. Do this occasionally before doing a dist-upgrade or searching for a new package. The package lists are large: doing an update may result in several MB of data being retrieved from the Internet.

apt-cache search program
This will do a keyword search through the list of available packages, including package names and descriptions. You can put in several keywords, for example 'apt-cache search text editor' to find a list of text editors.

apt-cache show program
Once you've found a package that looks interesting using 'apt-cache search', you can display more detailed information about it using 'apt-cache show program'. This will tell you things like the size of the package (important if you are installing it off the Internet) and an extended description, as well as what other packages it depends on in order to work and the name of the developer who maintains the package.

apt-get install program
This will get the latest version of the specified package and install it, along with any other packages that it depends on in order to work. If the requested package is already installed, this will upgrade it to the latest available version.

apt-get remove program
If you've previously installed a program and decide you don't want it anymore, you can remove it using this command. Because some software packages can depend on others, removing one program may break other programs. Running apt-get remove therefore checks first to see if any other software needs the program to work, and uninstalls them as well. This is just one example of the way the Debian package management tools have been designed to try to keep your computer in a sane state, without broken or half-installed software. It's certainly possible to break a Debian system, but generally you have to try to do it. It's unlikely you could do it by mistake.

apt-get upgrade
Over time, most of the software packages on your computer will become out of date as new versions are released to add features or fix bugs. You could manually do 'apt-get install foo' on each one, but that's not very convenient, so Apt provides a simple way to upgrade your entire system at once. Just type 'apt-get upgrade' to have Apt check every single package on your system for a new version, then download and install it. This command will never install new packages, it will only upgrade packages that are already installed.

apt-get dist-upgrade
Sometimes you'll have a software package installed, and a new version will come out that has a lot of new features and therefore it now depends on some other program to run. For example, you may have a movie player installed that supports a lot of different movie formats. When new formats come out, modules for those formats may be added in separate packages, so the latest version of the movie player software now depends on a new package that you don't yet have installed on your system. If you just do 'apt-get upgrade', you'll get the latest movie player, but you won't get all the new format packages. The 'apt-get dist-upgrade' command solves that problem for you: not only does it get the latest version of every package already installed just like 'apt-get upgrade', it also installs any new packages they need that may not be on your system yet. If you want to keep your system up to date with all the latest updates and security patches, running 'apt-get update; apt-get dist-upgrade' from time to time is the best way to do it.

apt-get clean
When you ask Apt to install a software package, it downloads the package and stores it in a cache on your disk before it does the actual installation. If you then remove the package, but later change your mind again and re-install it, Apt doesn't need to fetch it off the Internet again because the package is sitting in the local cache. That's great for saving bandwidth, but after a while it can use up space on your disk so it's a good idea to periodically delete old packages from the cache. Running 'apt-get clean' will totally flush the package cache, possibly freeing up some precious disk space. Running this command is quite safe, because the worst that can happen is Apt may need to download a package again if you remove it then re-install it.

apt-get autoclean
This is almost the same as 'apt-get clean', except it's just a little bit smarter: instead of cleaning out your entire package cache, it deletes only superseded packages. For example, your package cache may contain packages for the last 7 versions of a text editor that has been upgraded a number of times: running 'apt-cache autoclean' will delete the oldest 6 versions from the cache, leaving only the latest one. That makes sense because you're not likely to re-install anything except the latest version anyway. This is also a very safe command to run, so if you're a bit tight on disk space and don't want your package cache growing too much you could put it in a Cron job to do an automatic cleanup from time to time. There's really no reason to keep the older packages lying around on disk anyway.

Synaptic

Synaptic is a relatively recent addition to the Debian universe, and is intended to provide a user-friendly way to search or browse lists of available packages and install them. If you don't have it already installed on your system, open a terminal and switch to the root user, and type 'apt-get install synaptic'. Once it's installed, just type 'synaptic' as the root user to launch Synaptic, and you'll be presented with a list of package categories and buttons to manage them. I won't go into great detail here about how to drive Synaptic because if you read the section above on Apt the various options in Synaptic should be fairly self-explanatory. Most of the features in Synaptic are directly based on Apt, so if you think of Synaptic as Apt with point-n-click goodness you'll pretty much have it sorted.

For example, to update the list of available software packages using Apt you would type 'apt-get update'. In Synaptic, there's a big fat button on the top that says 'Update List' that does exactly the same thing. Same goes for 'apt-get upgrade' (just click 'Upgrade all') and 'apt-get dist-upgrade' ('Dist Upgrade' in Synaptic).

Browsing through the available packages, you can select them and click the tabs at the bottom to see different information about them in much the same way you would use 'apt-cache show', and click the 'Install' button on the right to flag them for installation. Note that nothing much will happen when you do that: it just sets a flag, it doesn't do the actual installation at the time. That means you can happily browse through the packages and flag various items for installation as you go, without having to stop and wait for each one. Then when you're ready, click the big 'Proceed' button up the top to tell Synaptic to go ahead and grab all the packages you marked and install them.

Similarly if you select a package that's already installed on your system, you can select the 'Remove' button to queue it for deletion.

Aptitude And Dselect

I won't go into detail about Aptitude and Dselect here either, since they are just different tools for doing a somewhat similar job to Synaptic. Something that may be an advantage if you are managing a remote machine or just prefer to use the command line is that both tools run within a console, so you don't have to run X in order to use them. Like Synaptic they allow you to browse package lists, flag packages for installation, view package information and resolve dependencies, but due to their text-based nature many people find them harder to use than a tool like Synaptic which provides a simple management interface.

Dselect, in particular, can provoke strong responses when mentioned to Debian users: no-one seems to be ambivalent about it, they either know all the keyboard shortcuts and absolutely love it, or they took one look and couldn't quit out of it fast enough, then swore they'd never run it again. I suspect use of Dselect is diminishing except among the hardest of the hardcore proponents, since alternatives such as Aptitude and now Synaptic have provided such nice alternatives.

Customising Your Software Sources

In order to install all this software your computer needs to be told where it can be found. When Debian is first installed it configures a set of default software sources as a starting point, but you may decide you want to customise it so you can get software from some other supplier or from a closer server to improve performance.

/etc/apt/sources.list

Your computer keeps a list of possible software sources in a file called '/etc/apt/sources.list'. Whenever you tell it to go and update its list of available software packages, it looks through this file to find the addresses of servers and then asks them to supply a list of current packages. This file also lists other local sources, such as CD-ROMs that you may have used when you installed Debian.

A typical entry for an Internet-based software server will look something like:

deb http://ftp.au.debian.org/debian stable main contrib

Apt can intelligently handle multiple sources, so you can add extra lines to this file to get access to more software. If it sees the same package available from multiple sources, Apt will just pick the source that contains the highest version and install that.

Synaptic provides a very nice way to manage the entries in your sources.list without editing the file directly: just open the 'Settings' menu and select 'Repositories' for a nicely formatted list with options to add, delete, edit, enable and disable entries in the list.

www.apt-get.org

So how do you find software servers to add to your sources.list? Servers providing Debian-compatible packages have started springing up all over the Internet, and there is a project underway to provide a centralised directory at www.apt-get.org. You can search for a package there, and it will tell you the lines you have to add to your sources.list to get access to the relevant server.

Note that third-party Debian packages may not be of the same quality as the official packages. If you download a package off a dubious source via the Internet, you have no idea what actually went into the package: it may be very high quality and carefully maintained, or it may be buggy and never updated. If you know what you're doing third party sources can be a boon, but always exercise caution when using anything other than the official sources.

Errata/Addendum: This is stuff I still need to incorporate into the main text, stuck here so you know it's not forgotten (and so I don't forget it!)