Manage Ubuntu Repositories from the Terminal

Ubuntu’s package repositories are organised collections of installable software and the metadata APT uses to choose between versions. The terminal gives you direct control over those collections: refresh their indexes, inspect package origins, install software and remove sources you no longer need. A key distinction is that sudo apt update refreshes package lists, while sudo apt upgrade changes installed packages.

That control is useful for everyday Australian users as well as administrators. A shared computer in a Melbourne home or a small Sydney office may need a security update without interrupting work, and Australian banking apps or the ABC iView catalogue may not offer a suitable Ubuntu package. APT can manage available software, but it cannot create a Linux release that the publisher has not provided.

The commands below use apt, Ubuntu’s usual command-line package manager, and assume you have administrator rights through sudo. They also use modern Ubuntu conventions while noting older files you may encounter. Read the proposed changes before confirming them, especially when a repository can remove or replace existing packages.

Understand how APT organises software

APT is the coordinator, not the installer of every file. It downloads .deb packages, checks their signatures and hands them to dpkg, Ubuntu’s lower-level package database. Use apt for interactive work and apt-cache for queries; apt-get remains useful in scripts and older instructions. The apt command warns that its interface can change, so automation should avoid depending on the exact wording of its output.

On modern Ubuntu, official entries usually live in /etc/apt/sources.list.d/ubuntu.sources, using the multi-line deb822 format. Older or manually added entries may appear in /etc/apt/sources.list or as .list files in sources.list.d. These files define where APT looks, which Ubuntu suites are eligible and which components, such as main, are offered. They also control whether source code is fetched, although ordinary desktop installations need binary packages.

Before changing anything, ask APT what it currently knows. apt-cache policy shows repository priorities and available versions, while apt list --upgradable identifies installed packages with newer candidates. Priorities are selection rules, not quality ratings: a lower-priority repository can still supply a version when preferred sources lack one. Keep a copy of custom source files before editing so you can compare or restore them.

Refresh indexes and upgrade packages

Refresh the indexes first, then inspect and apply upgrades:

sudo apt update
sudo apt list --upgradable
sudo apt upgrade

sudo apt update changes only cached metadata. sudo apt upgrade installs eligible updates without removing packages, whereas sudo apt full-upgrade may install new dependencies or remove obsolete ones. Read the removal list carefully, particularly on a shared family or workplace computer in Melbourne or Sydney.

A lock message such as Could not get lock /var/lib/dpkg/lock-frontend means another package process is active. Ubuntu’s unattended-upgrades service can legitimately hold that lock while applying security updates. Let it finish, or inspect running processes before retrying; deleting lock files just to get past the message can cause concurrent writes and database damage. If the machine is shared, agree on a quiet maintenance window rather than upgrading during a video call or client presentation.

APT evaluates repository freshness using UTC. Sydney and Melbourne use UTC+10 during standard time, Perth uses UTC+8, and Adelaide and Darwin use UTC+9:30; daylight-saving changes affect local clock times but not that underlying comparison. Check timedatectl when a Release file expired error appears, then confirm that the repository still supports your Ubuntu release. Changing time settings or bypassing expiry checks does not repair a retired release.

Add and remove repository sources

Official Ubuntu archives normally cover the compiler, desktop utilities and libraries needed for a working system. Extra software may come from a vendor repository or a Personal Package Archive (PPA), each maintained outside Canonical’s release process. If a publisher documents a PPA, install software-properties-common, then use the publisher’s exact path with sudo add-apt-repository ppa:team/project, replacing team/project with the published location. Check that the PPA supports your Ubuntu release before adding it.

Vendor repositories often have their own keys, paths and release names, so follow the vendor’s current Ubuntu instructions rather than copying an old setup. A one-line source entry can look like this:

deb [signed-by=/usr/share/keyrings/vendor-archive-keyring.gpg] VENDOR_UBUNTU_URL noble main

Replace VENDOR_UBUNTU_URL with the full HTTPS address from the vendor, and noble with your Ubuntu release codename. The signed-by option names the keyring APT should use to verify that repository.

Obtain the key from the vendor, save it as /tmp/vendor-key.asc, and inspect it with gpg --show-keys --with-fingerprint /tmp/vendor-key.asc. Compare the displayed fingerprint with the vendor’s independently published fingerprint. Once verified, convert it with gpg --dearmor --output /tmp/vendor-key.gpg /tmp/vendor-key.asc and install it with sudo install -m 0644 /tmp/vendor-key.gpg /usr/share/keyrings/vendor-archive-keyring.gpg. Then create the source file with sudoedit and run sudo apt update. A missing key or NO_PUBKEY warning means verification cannot proceed; it is not a reason to disable checks.

To remove a PPA added by add-apt-repository, run sudo add-apt-repository --remove ppa:team/project and refresh the indexes again. For a manual source, use sudoedit to remove only the file or stanza you created, or delete that exact .list or .sources file. Keep Ubuntu’s official entries intact. Review ls /etc/apt/sources.list.d/ and apt-cache policy afterwards, and remove an unused keyring only when no remaining source references it.

Check origins before trusting a source

Package metadata helps separate an upstream project from the repository supplying a particular build. apt show package-name displays the candidate version, description, maintainer and home-page field. apt-cache policy package-name adds the priority and versions offered by each source, while apt policy package-name presents a shorter, human-readable view. These commands are useful when a desktop search result offers a much newer version than the archive.

A home-page field can point to a site such as the Dynasty Brasil homepage. Such a link identifies a website, not an Ubuntu package mirror or evidence that Canonical maintains the software. Read the repository identifier, package origin and signing information together. A familiar website name is not a substitute for checking whether a repository has been configured for your exact Ubuntu release.

Repository signing protects integrity, not every aspect of safety. Use signed-by to limit trust to a particular key, and verify unusual fingerprints through a separate channel supplied by the vendor. The older apt-key workflow is deprecated; avoid --allow-unauthenticated or [trusted=yes] as a shortcut. For an Australian business, the Privacy Act 1988 may apply when covered organisations handle personal information, and the Australian Consumer Law may apply to consumer-facing goods or services. A PPA does not exempt software or its supplier from those obligations.

Install, troubleshoot and maintain packages

Install by package name with sudo apt install package-name, and use apt search or apt show first if you are unsure of the name. The Stellarium review for Ubuntu provides a practical look at astronomy software after installation, helping you assess the finished desktop application rather than only its package metadata. If APT cannot find a program, first refresh the indexes with sudo apt update, then confirm that its repository is enabled and supports your release.

Removal has several levels. sudo apt remove package-name normally leaves package-managed configuration files in place, while sudo apt purge package-name also removes those files; neither command automatically removes unrelated personal data outside package control. sudo apt autoremove proposes deleting automatically installed dependencies that are no longer required. Review every proposed removal, especially on systems running specialised local tools or development environments.

Common errors have different remedies. Unable to locate package points to missing indexes, the wrong release or an absent source; NO_PUBKEY points to key verification; a 404 can mean a repository has moved; and held broken packages indicate a dependency conflict. sudo apt -f install can propose repairs, while sudo dpkg --configure -a resumes an interrupted configuration. Read the plan before allowing removals, and never force packages through with --force-yes. The history in /var/log/apt/history.log and details in /var/log/apt/term.log help explain what changed.

A steady routine is safer than occasional large repairs. Keep unattended security upgrades enabled where appropriate, schedule manual maintenance outside busy hours, and record manually installed packages with apt-mark showmanual > ~/ubuntu-manual-packages.txt. Back up that file and your custom source files separately; a package list is not a backup of configuration or personal data. Review the periodic settings in /etc/apt/apt.conf.d/20auto-upgrades and the rules in 50unattended-upgrades before changing unattended-upgrade frequency or scope. At the next quiet maintenance session, run sudo apt update.