Diff — Package Management

{{infobox

| title = Package Management

| chapter = Linux Handbook, chapter 20 — packages, dependencies, and the managers

| core | A package = files + metadata + install scripts; the manager resolves the graph

| managers | apt (Debian) · dnf (Fedora) · pacman (Arch) · pkgtools (Slackware) · xbps (Void)

| skills | install/remove/search · the dependency graph · the formats

| next | Disks & storage — where the packages land

}}

**A package manager is the distro's real identity** — apt makes Debian, pacman makes Arch, pkgtools makes Slackware. The package itself is simple: an archive of files + metadata (name, version, deps) + install hooks. The manager's work is resolving **dependency graphs** — installing `foo` pulls `libfoo` and `libbar` transitively — and tracking who owns every file on the system. This chapter covers the formats, the managers, and the operations every distro shares.

## The formats

```sh

file package.deb          # Debian — ar archive of tarballs + control

file package.rpm          # Red Hat — cpio + metadata

file package-1.0-x86_64-1.txz  # Slackware — a tar.xz with install/doinst.sh

file package.pkg.tar.zst  # Arch — zstd tar

```

Each format is an archive + a control layer: name, version, arch, dependencies, install/uninstall scripts. `dpkg-deb -x pkg.deb dir` extracts a .deb by hand; `rpm2cpio pkg.rpm | cpio -id` does an rpm — the formats are inspectable.

## The managers — the operations every distro shares

| Operation | apt (Debian/Ubuntu) | dnf (Fedora) | pacman (Arch) | pkgtools (Slackware) |

| --- | --- | --- | --- | --- |

| update indexes | `apt update` | `dnf check-update` | `pacman -Sy` | `slackpkg update` |

| upgrade all | `apt upgrade` | `dnf upgrade` | `pacman -Syu` | `slackpkg upgrade-all` |

| install | `apt install x` | `dnf install x` | `pacman -S x` | `installpkg x.txz` / `slackpkg install` |

| remove | `apt remove x` | `dnf remove x` | `pacman -R x` | `removepkg x` |

| search | `apt search x` | `dnf search x` | `pacman -Ss x` | `slackpkg search x` |

| info | `apt show x` | `dnf info x` | `pacman -Si x` | `slackpkg info x` |

| files owned | `dpkg -L x` | `rpm -ql x` | `pacman -Ql x` | `less /var/log/packages/x` |

| owner of a file | `dpkg -S /path` | `rpm -qf /path` | `pacman -Qo /path` | `grep /path /var/log/packages/*` |

| clean cache | `apt clean` | `dnf clean all` | `pacman -Sc` | — |

The four patterns map one-to-one — learn one, know them all.

## The dependency graph — the manager's real job

```sh

apt-cache depends x        # what x needs

apt-cache rdepends x       # what needs x — the why-is-it-installed answer

apt autoremove             # orphans — deps nothing needs anymore

```

Every package declares `Depends:` — the manager topologically sorts them, installs in order, and tracks *why* each is present (explicitly-installed vs dependency). `autoremove` reaps the orphans — the housekeeping command worth knowing.

## The repository layer

Managers fetch from **repositories** — signed, indexed collections: `/etc/apt/sources.list` + `sources.list.d/` (Debian), `/etc/yum.repos.d/` (Fedora), `/etc/pacman.conf` + mirrorlist (Arch), `slackpkg`'s mirror. The repo is the distro's curated world — adding third-party repos (`ppa`, COPR, AUR-adjacent) is the standard way software outside the core arrives. `apt update` refreshes the index; the index is what `search` searches.

## The deeper operations

```sh

# apt — the full surface

apt list --installed | wc -l         # how many packages

apt list --upgradable                # what would change

apt list --all-versions x            # every version available

apt depends x / apt rdepends x       # the graph both ways

apt download x                       # the .deb without installing

apt hold x / apt unhold x            # pin — never upgrade

apt-mark showmanual / showauto       # explicitly vs dep-installed

apt-cache policy x                   # versions + sources + pin weights

apt-get source x                     # the source

apt-get build-dep x                  # its build deps

apt-get -f install                   # the repair command

dpkg-reconfigure x                   # re-run a package's config

dpkg --listfiles x; dpkg --search /path

dpkg -i local.deb                    # manual install

dpkg --configure -a                  # fix interrupted

apt clean; apt autoremove --purge    # hygiene

apt purge x                          # remove + its configs

# dnf — same grammar

dnf list installed

dnf provides /path                   # who provides a file

dnf repoquery --requires x           # the deps

dnf history                          # every transaction — and undo

dnf history undo 5                   # REVERSE a transaction

dnf check-update

dnf config-manager --add-repo url

dnf remove --duplicates

dnf versionlock add x                # pin

# pacman

pacman -Qqe                          # explicitly installed

pacman -Qtd                          # orphans — the autoremove list

pacman -Rns x                        # remove + unneeded deps + configs

pacman -Qkk x                        # verify files vs manifest

pacman -F file                       # which package provides a file

pacman -Sc / -Scc                    # cache hygiene

```

## The pinning + priority layer

```sh

# /etc/apt/preferences — Debian pinning:

Package: firefox

Pin: release a=stable

Pin-Priority: 900

apt policy                        # the weights

apt-mark hold pkg                 # freeze

```

Priorities decide which repo's version wins; `hold` freezes a package against upgrade — the tools for mixed-source setups.

## The verify layer — trust

```sh

apt policy x               # versions + where from

rpm --checksig pkg.rpm     # verify an rpm's signature

pacman-key --verify pkg.sig # arch's signatures — pacman verifies automatically

sha256sum pkg.txz          # the checksum layer

```

Packages are signed; the manager verifies before installing. `apt`'s "NO_PUBKEY" errors are the signature layer objecting — the fix is adding the repo's key, never `--allow-unauthenticated`.

## The file-ownership queries — the underrated powers

```sh

dpkg -S /usr/bin/ls        # which package owns this file

dpkg -L coreutils          # every file this package installed

apt-file search libfoo.so  # which package WOULD provide it

rpm -Va                    # verify ALL installed files against the manifest

```

`dpkg -S`/`rpm -qf`/`pacman -Qo` answer "where did this file come from"; `rpm -Va` audits the whole system against its manifests — the forensic tool.

## Source + foreign packages

```sh

apt source x               # fetch the source

apt build-dep x            # install everything needed to build it

alien pkg.rpm              # convert rpm→deb — last resort

checkinstall make install  # wraps source installs as packages

snap/flatpak/appimage      # the sandboxed universal formats

```

`apt build-dep` + `apt source` + `make` is the clean path from "installed" to "rebuilt myself" — the bridge between chapter 16's liturgy and the distro world.

## Where package management goes wrong

| Symptom | Cause |

| --- | --- |

| `NO_PUBKEY` warnings | Missing repo signing key — add it, don't bypass |

| `E: unable to locate` | `apt update` stale — refresh the index |

| Broken after interrupted upgrade | `dpkg --configure -a` / `apt -f install` — repair |

| A file exists but no package owns it | Manually installed — `/usr/local` hygiene |

| `autoremove` wants to remove something needed | It's a dep — mark it explicitly-installed |

| Third-party repo broke upgrades | Pinning priorities — `apt policy` shows the weights |

## Exercises

1. `dpkg -S $(which ls)` — who owns `ls`.

2. `apt-cache rdepends` a library — see who needs it.

3. `apt policy` a package — read the version weights.

4. `apt source` something small — read a Debian package's source.

5. `rpm -qf`/`pacman -Qo`/`slackpkg` equivalents on another family — same questions, different syntax.

## See also

[[Category:Linux]]

[[Category:Handbook]]

[[Category:Packages]]

[[Category:Linux Handbook]]