Package Management

A package manager is the distro's real identity — apt makes Debian, pacman makes Arch, pkgtools makes Slackware. The package itself is simple: an archive of files + metadata (name, version, deps) + install hooks. The manager's work is resolving dependency graphs — installing foo pulls libfoo and libbar transitively — and tracking who owns every file on the system. This chapter covers the formats, the managers, and the operations every distro shares.

The formats

file package.deb          # Debian — ar archive of tarballs + control
file package.rpm          # Red Hat — cpio + metadata
file package-1.0-x86_64-1.txz  # Slackware — a tar.xz with install/doinst.sh
file package.pkg.tar.zst  # Arch — zstd tar

Each format is an archive + a control layer: name, version, arch, dependencies, install/uninstall scripts. dpkg-deb -x pkg.deb dir extracts a .deb by hand; rpm2cpio pkg.rpm | cpio -id does an rpm — the formats are inspectable.

The managers — the operations every distro shares

The four patterns map one-to-one — learn one, know them all.

The dependency graph — the manager's real job

apt-cache depends x        # what x needs
apt-cache rdepends x       # what needs x — the why-is-it-installed answer
apt autoremove             # orphans — deps nothing needs anymore

Every package declares Depends: — the manager topologically sorts them, installs in order, and tracks why each is present (explicitly-installed vs dependency). autoremove reaps the orphans — the housekeeping command worth knowing.

The repository layer

Managers fetch from repositories — signed, indexed collections: /etc/apt/sources.list + sources.list.d/ (Debian), /etc/yum.repos.d/ (Fedora), /etc/pacman.conf + mirrorlist (Arch), slackpkg's mirror. The repo is the distro's curated world — adding third-party repos (ppa, COPR, AUR-adjacent) is the standard way software outside the core arrives. apt update refreshes the index; the index is what search searches.

The deeper operations

# apt — the full surface
apt list --installed | wc -l         # how many packages
apt list --upgradable                # what would change
apt list --all-versions x            # every version available
apt depends x / apt rdepends x       # the graph both ways
apt download x                       # the .deb without installing
apt hold x / apt unhold x            # pin — never upgrade
apt-mark showmanual / showauto       # explicitly vs dep-installed
apt-cache policy x                   # versions + sources + pin weights
apt-get source x                     # the source
apt-get build-dep x                  # its build deps
apt-get -f install                   # the repair command
dpkg-reconfigure x                   # re-run a package's config
dpkg --listfiles x; dpkg --search /path
dpkg -i local.deb                    # manual install
dpkg --configure -a                  # fix interrupted
apt clean; apt autoremove --purge    # hygiene
apt purge x                          # remove + its configs

# dnf — same grammar
dnf list installed
dnf provides /path                   # who provides a file
dnf repoquery --requires x           # the deps
dnf history                          # every transaction — and undo
dnf history undo 5                   # REVERSE a transaction
dnf check-update
dnf config-manager --add-repo url
dnf remove --duplicates
dnf versionlock add x                # pin

# pacman
pacman -Qqe                          # explicitly installed
pacman -Qtd                          # orphans — the autoremove list
pacman -Rns x                        # remove + unneeded deps + configs
pacman -Qkk x                        # verify files vs manifest
pacman -F file                       # which package provides a file
pacman -Sc / -Scc                    # cache hygiene

The pinning + priority layer

# /etc/apt/preferences — Debian pinning:
Package: firefox
Pin: release a=stable
Pin-Priority: 900

apt policy                        # the weights
apt-mark hold pkg                 # freeze

Priorities decide which repo's version wins; hold freezes a package against upgrade — the tools for mixed-source setups.

The verify layer — trust

apt policy x               # versions + where from
apt-key / gpg keys         # repo signatures — apt verifies automatically; apt-key itself is DEPRECATED (use signed-by + keyrings)
rpm --checksig pkg.rpm     # verify an rpm's signature
pacman-key --verify pkg.sig # arch's signatures — pacman verifies automatically
sha256sum pkg.txz          # the checksum layer

Packages are signed; the manager verifies before installing. apt's "NO_PUBKEY" errors are the signature layer objecting — the fix is adding the repo's key, never --allow-unauthenticated.

The file-ownership queries — the underrated powers

dpkg -S /usr/bin/ls        # which package owns this file
dpkg -L coreutils          # every file this package installed
apt-file search libfoo.so  # which package WOULD provide it
rpm -Va                    # verify ALL installed files against the manifest

dpkg -S/rpm -qf/pacman -Qo answer "where did this file come from"; rpm -Va audits the whole system against its manifests — the forensic tool.

Source + foreign packages

apt source x               # fetch the source
apt build-dep x            # install everything needed to build it
alien pkg.rpm              # convert rpm→deb — last resort
checkinstall make install  # wraps source installs as packages
snap/flatpak/appimage      # the sandboxed universal formats

apt build-dep + apt source + make is the clean path from "installed" to "rebuilt myself" — the bridge between chapter 16's liturgy and the distro world.

Where package management goes wrong

Exercises

1. dpkg -S $(which ls) — who owns ls.
2. apt-cache rdepends a library — see who needs it.
3. apt policy a package — read the version weights.
4. apt source something small — read a Debian package's source.
5. rpm -qf/pacman -Qo/slackpkg equivalents on another family — same questions, different syntax.

See also

• Linux · Building from Source · Getting Linux · Inside a Linux System