Help

FAQ and troubleshooting for apt sources.

Common questions about the format of /etc/apt/sources.list, the difference between DEB822 and the legacy one-line style, and how this site is kept in sync with Debian and Ubuntu release data.

What's the difference between one-line and DEB822?

The one-line format is the classic deb http://… suite components syntax that has shipped since the very first apt releases. It lives in /etc/apt/sources.list and in .list files under /etc/apt/sources.list.d/.

DEB822 (named after RFC 822-style key/value fields) is the modern format used in .sources files under /etc/apt/sources.list.d/. One stanza can cover several suites and multiple URIs at once, and a Signed-By: field pins the stanza to a specific keyring. Debian 12+ and Ubuntu 24.04+ use DEB822 by default.

Why did Debian move security to codename-security?

Prior to Debian 11, security updates used the suite name <codename>/updates on security.debian.org. Debian 11 switched to the current <codename>-security convention to match the rest of the suite naming and avoid the slash/subdirectory confusion. The generator always emits the modern form for any supported release.

Why does Ubuntu on arm64 use ports.ubuntu.com?

Canonical only mirrors amd64 and i386 packages on archive.ubuntu.com. Every other architecture (arm64, armhf, ppc64el, riscv64, s390x) lives on ports.ubuntu.com/ubuntu-ports, including the security suite. Picking one of those architectures in the generator switches both primary and security URIs automatically.

Should I enable backports?

Only if you need a newer version of a specific package than the one in stable. Backports are opt-in per-package (you install with apt install -t bookworm-backports <pkg>) and come with looser testing than the main archive. Leave them disabled unless you have a concrete reason.

How do I verify a third-party GPG key?

Compare the key's full fingerprint (40 hex characters) against the vendor's official install documentation. Never trust a key that only appears on a fan-made tutorial or a copy-paste gist.

After downloading the key, you can print its fingerprint with: 

gpg --show-keys --with-fingerprint /tmp/their-key.gpg

Install it into /etc/apt/keyrings/ (not /usr/share/keyrings/, which is reserved for distro-shipped keyrings) and reference it from your .sources file via Signed-By:.

My apt update complains about Signed-By, what now?

Modern apt refuses to use a repository unless it can verify the signature against an explicit keyring. If you're seeing a "The following signatures couldn't be verified…" or "Repository is not signed" error:

  • Check that the keyring file exists at the path in your Signed-By: field and is world-readable.
  • Verify that the key inside it hasn't expired.
  • If you used apt-key add in the past, replace it with a keyring file — apt-key is deprecated and removed on recent releases.
Can I mix one-line and DEB822 on the same system?

Yes. apt reads every .list and .sources file under /etc/apt/sources.list.d/ in addition to the legacy /etc/apt/sources.list. Just avoid defining the same suite in two places — you'll see duplicate-sources warnings.

How are the supported releases kept up to date?

The generator's release list is auto-generated from the canonical distro-info-data CSVs that Debian publishes for itself and Ubuntu. A weekly GitHub Actions workflow runs scripts/update-releases.mjs, diffs the result, and opens a pull request when a release changes state.

Where does this site come from?

It's a small static site on GitHub, served via GitHub Pages. All generation happens in your browser — nothing is sent to a server.