sources.list - Package resource list for APT


The package resource list is used to locate archives of the package distribution system in use on the system. At this time, this manual page documents only the packaging system used by the Debian GNU/Linux system. This control file is /etc/apt/sources.list.

The source list is designed to support any number of active sources and a variety of source media. The file lists one source per line, with the most preferred source listed first. The format of each line is: type uri args The first item, type determines the format for args. uri is a Universal Resource Identifier (URI), which is a superset of the more specific and well-known Universal Resource Locator, or URL. The rest of the line can be marked as a comment by using a #.


The /etc/apt/sources.list.d directory provides a way to add sources.list entries in separate files. The format is the same as for the regular sources.list file. File names need to end with .list and may only contain letters (a-z and A-Z), digits (0-9), underscore (_), hyphen (-) and period (.) characters. Otherwise APT will print a notice that it has ignored a file if the file doesn't match a pattern in the Dir::Ignore-Files-Silently configuration list - in this case it will be silently ignored.


The deb type describes a typical two-level Debian archive, distribution/component. Typically, distribution is generally an archivename like stable or testing or a codename like squeeze or wheezy while component is one of main contrib or non-free. The deb-src type describes a debian distribution's source code in the same form as the deb type. A deb-src line is required to fetch source indexes.

The format for a sources.list entry using the deb and deb-src types is:

deb [ options ] uri distribution [component1] [component2] [...]

The URI for the deb type must specify the base of the Debian distribution, from which APT will find the information it needs. distribution can specify an exact path, in which case the components must be omitted and distribution must end with a slash (/). This is useful for when the case only a particular sub-section of the archive denoted by the URI is of interest. If distribution does not specify an exact path, at least one component must be present.

distribution may also contain a variable, $(ARCH) which expands to the Debian architecture (i386, m68k, powerpc, ...) used on the system. This permits architecture-independent sources.list files to be used. In general this is only of interest when specifying an exact path, APT will automatically generate a URI with the current architecture otherwise.

Since only one distribution can be specified per line it may be necessary to have multiple lines for the same URI, if a subset of all available distributions or components at that location is desired. APT will sort the URI list after it has generated a complete set internally, and will collapse multiple references to the same Internet host, for instance, into a single connection, so that it does not inefficiently establish an FTP connection, close it, do something else, and then re-establish a connection to that same host. This feature is useful for accessing busy FTP sites with limits on the number of simultaneous anonymous users. APT also parallelizes connections to different hosts to more effectively deal with sites with low bandwidth.

options is always optional and needs to be surounded by square brackets. It can consist of multiple settings in the form setting=value. Multiple settings are separated by spaces. The following settings are supported by APT, note though that unsupported settings will be ignored silently:

o arch=arch1,arch2,... can be used to specify for which architectures packages information should be downloaded. If this option is not set all architectures defined by the APT::Architectures option will be downloaded.

o trusted=yes can be set to indicate that packages from this source are always authenificated even if the Release file is not signed or the signature can't be checked. This disables parts of apt-
secure(8) and should therefore only be used in a local and trusted context. trusted=no is the opposite which handles even correctly authenificated sources as not authenificated.

It is important to list sources in order of preference, with the most preferred source listed first. Typically this will result in sorting by speed from fastest to slowest (CD-ROM followed by hosts on a local network, followed by distant Internet hosts, for example).

Some examples:

deb squeeze main contrib non-free deb squeeze/updates main contrib non-free


The currently recognized URI types are cdrom, file, http, ftp, copy, ssh, rsh.

file The file scheme allows an arbitrary directory in the file system to be considered an archive. This is useful for NFS mounts and local mirrors or archives.

cdrom The cdrom scheme allows APT to use a local CDROM drive with media swapping. Use the apt-cdrom(8) program to create cdrom entries in the source list.

http The http scheme specifies an HTTP server for the archive. If an environment variable http_proxy is set with the format http://server:port/, the proxy server specified in http_proxy will be used. Users of authenticated HTTP/1.1 proxies may use a string of the format http://user:pass@server:port/. Note that this is an insecure method of authentication.

ftp The ftp scheme specifies an FTP server for the archive. APT's FTP behavior is highly configurable; for more information see the apt.conf(5) manual page. Please note that a ftp proxy can be specified by using the ftp_proxy environment variable. It is possible to specify a http proxy (http proxy servers often understand ftp urls) using this method and ONLY this method. ftp proxies using http specified in the configuration file will be ignored.

copy The copy scheme is identical to the file scheme except that packages are copied into the cache directory instead of used directly at their location. This is useful for people using a zip disk to copy files around with APT.

rsh, ssh The rsh/ssh method invokes rsh/ssh to connect to a remote host as a given user and access the files. It is a good idea to do prior arrangements with RSA keys or rhosts. Access to files on the remote uses standard find and dd commands to perform the file transfers from the remote.

more recognizable URI types APT can be extended with more methods shipped in other optional packages which should follow the nameing scheme apt-transport-method. The APT team e.g. maintains also the apt-transport-https package which provides access methods for https-URIs with features similar to the http method, but other methods for using e.g. debtorrent are also available, see apt-


Uses the archive stored locally (or NFS mounted) at /home/jason/debian for stable/main, stable/contrib, and stable/non-free.

deb file:/home/jason/debian stable main contrib non-free

As above, except this uses the unstable (development) distribution.

deb file:/home/jason/debian unstable main contrib non-free

Source line for the above

deb-src file:/home/jason/debian unstable main contrib non-free

The first line gets package information for the architectures in APT::Architectures while the second always retrieves amd64 and armel.

deb squeeze main deb [ arch=amd64,armel ] squeeze main

Uses HTTP to access the archive at, and uses only the hamm/main area.

deb hamm main

Uses FTP to access the archive at, under the debian directory, and uses only the squeeze/contrib area.

deb squeeze contrib

Uses FTP to access the archive at, under the debian directory, and uses only the unstable/contrib area. If this line appears as well as the one in the previous example in sources.list a single FTP session will be used for both resource lines.

deb unstable contrib

Uses HTTP to access the archive at, under the universe directory, and uses only files found under unstable/binary-i386 on i386 machines, unstable/binary-amd64 on amd64, and so forth for other supported architectures. [Note this example only illustrates how to use the substitution variable; official debian archives are not structured like this]

deb unstable/binary-$(ARCH)/


apt-cache(8) apt.conf(5)


APT bug page[1]. If you wish to report a bug in APT, please see /usr/share/doc/debian/bug-reporting.txt or the reportbug(1) command.


Jason Gunthorpe

APT team


1. APT bug page