Linux: Package Management and Software
Master Linux package managers across Debian, Ubuntu, and RHEL. Learn apt, dpkg, dnf, third-party repositories, containerized Snaps, source builds, and automated security upgrades on Ubuntu 24.04 LTS.
6.1 How Package Managers Work
In early Unix computing, administrators downloaded raw source code, compiled binaries manually, and hunted missing shared libraries by hand (known as "dependency hell"). Modern package managers automate installation, dependency resolution, cryptographic signature verification, and system upgrades.
6.1.1 Packages, Repositories, and Dependencies
Package Management Fundamentals
- The Package Archive:A single compressed archive containing compiled executable binaries, configuration templates, manual pages, and installation scripts (pre-install, post-install, pre-remove, post-remove).
- Repositories (Repos):Centralized HTTP/HTTPS web servers hosting curated, tested software collections alongside cryptographic index manifests.
- Dependency Resolution (DAG):Package managers construct a Directed Acyclic Graph of prerequisites. If program A requires library B version 2.4, the package manager installs both in correct dependency sequence automatically.
6.1.2 Package Formats: .deb vs .rpm
The Linux world is primarily divided between two established binary packaging standards:
| Feature | Debian Ecosystem (.deb) | Red Hat Ecosystem (.rpm) |
|---|---|---|
| Distributions | Debian, Ubuntu, Linux Mint, Kali, Raspberry Pi OS | RHEL, Rocky Linux, AlmaLinux, Fedora, openSUSE |
| High-Level Manager | apt / apt-get | dnf / yum |
| Low-Level Manager | dpkg | rpm |
| Repository Config | /etc/apt/sources.list.d/ | /etc/yum.repos.d/ |
6.2 APT (Advanced Package Tool) on Ubuntu
The apt utility is the primary tool for installing, querying, and updating software on Debian and Ubuntu distributions. It handles remote repository synchronization and automatic dependency calculation.
6.2.1 Core Operations: update, upgrade, install, remove
| Command | Operation Description | Standard Practice |
|---|---|---|
| sudo apt update | Downloads fresh package lists and version indexes from remote repos | Always run before installing or upgrading software |
| sudo apt upgrade -y | Upgrades installed packages to their newest available repository versions | Applies security patches and maintenance releases |
| sudo apt install nginx | Resolves dependencies, downloads required .deb packages, and configures service | Specify multiple packages separated by space |
| sudo apt remove nginx | Removes binaries while preserving configuration files in /etc | Allows reinstalling without losing custom configurations |
| sudo apt purge nginx | Completely removes binaries along with all configuration files | Use when performing clean, fresh reinstalls |
6.2.2 Querying and Cleanup: search, show, autoremove
Information and Housekeeping
- apt search keyword:Searches package names and descriptions for matching programs (e.g.,
apt search postgresql). - apt show package_name:Displays detailed metadata: version, maintainer, disk size, dependencies, and project homepage.
- sudo apt autoremove:Identifies and deletes libraries installed automatically as dependencies that are no longer required by any active program.
- sudo apt clean:Empties the local package cache directory in
/var/cache/apt/archives/, recovering disk space from downloaded .deb files.
6.2.3 Low-Level Management with dpkg
dpkg interacts directly with the local package database without network connectivity. It does not download packages from the internet or fetch missing dependencies:
Essential dpkg Operations
- sudo dpkg -i package.deb:Installs a downloaded local .deb file directly.
- sudo apt install -f:Fixes missing dependencies by prompting apt to download whatever libraries dpkg reported missing.
- dpkg -l | grep package:Lists installed packages matching the search pattern.
- dpkg -L package_name:Lists every single file installed on the system by the specified package.
- dpkg -S /usr/bin/htop:Reverse lookup: identifies which installed package owns a specific file on disk.
6.2.4 Adding PPAs and Third-Party Repositories
When installing upstream software (Docker, Node.js, HashiCorp tools) not available in default Ubuntu mirrors:
Secure Third-Party Repository Architecture
- Modern GPG Keyrings (/etc/apt/keyrings/):Store ASCII-armored public GPG keys in dedicated files rather than using legacy deprecated
apt-key add. - Repository Sources (/etc/apt/sources.list.d/):Define repository URLs referencing the specific keyring file:
echo "deb [signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu noble stable" | sudo tee /etc/apt/sources.list.d/docker.list. - Personal Package Archives (PPAs):Ubuntu community archives added via
sudo add-apt-repository ppa:ondrej/php, which configures key and URL automatically.
6.3 DNF and YUM (RHEL Family)
Red Hat Enterprise Linux, Rocky Linux, AlmaLinux, and Fedora use DNF (Dandified YUM) as their high-level package manager over backend RPM databases.
6.3.1 DNF Command Equivalents
| Action | Ubuntu / Debian (APT) | RHEL / Rocky / Fedora (DNF) |
|---|---|---|
| Install Software | sudo apt install httpd | sudo dnf install httpd |
| Update All Packages | sudo apt update && sudo apt upgrade | sudo dnf upgrade (syncs metadata automatically) |
| Remove Software | sudo apt remove httpd | sudo dnf remove httpd |
| Search Repositories | apt search httpd | dnf search httpd |
| Transaction History | /var/log/dpkg.log | dnf history / dnf history undo <id> |
6.3.2 Querying RPMs on RHEL
RPM Query Flags
- rpm -qa:Queries all installed RPM packages on the operating system.
- rpm -ql package_name:Lists all files placed onto disk by the package.
- rpm -qf /usr/sbin/nginx:Identifies which package owns the specified binary.
6.4 Other Software Sources
6.4.1 Sandboxed Packages: Snap and Flatpak
Traditional .deb and .rpm packages share global system libraries. Universal packaging formats bundle application runtimes into sandboxed containers:
Universal Packaging Systems
- Snap (Canonical / Ubuntu):Confined squashfs packages mounted as virtual loop devices (
snap install certbot --classic,snap list,snap refresh). - Flatpak (Desktop Standard):Popular packaging model for desktop applications isolated via bubblewrap and ostree (
flatpak install flathub org.gimp.GIMP).
6.4.2 Compiling Software from Source
When software requires non-standard compile-time flags or custom modules:
The GNU Autotools Build Sequence
- 1. Install Toolchain:Run
sudo apt install build-essentialto acquire GCC compiler, G++, Make, and standard C library headers. - 2. Configure (./configure):Inspects operating system libraries, verifies compiler readiness, and generates customized
Makefilefiles tailored to your architecture. - 3. Compile (make):Compiles source code into executable binary objects using parallel CPU cores:
make -j$(nproc). - 4. Install (sudo make install):Copies finished binaries to
/usr/local/binand libraries to/usr/local/lib.
6.4.3 Verifying Package Signatures and Checksums
Integrity Verification
- SHA-256 Checksums:Verify uncorrupted downloads:
sha256sum software.tar.gzand compare with publisher hash. - GPG Signatures:Verify author authenticity using public key rings:
gpg --verify software.tar.gz.asc software.tar.gz.
6.5 Keeping Systems Updated
6.5.1 Security Updates and unattended-upgrades
Unpatched servers exposed to the public internet are rapidly vulnerable to automated vulnerability scanners:
Automated Security Patching
- sudo apt install unattended-upgrades:Installs background service that queries security mirrors daily and applies CVE patches automatically.
- Configuration (/etc/apt/apt.conf.d/50unattended-upgrades):Define allowed update origins, email alert notifications, and automatic reboot schedules for off-peak hours (e.g., 03:00 AM).
- Dry-Run Simulation:Test automated upgrade rules safely with
sudo unattended-upgrades --dry-run --debug.
6.5.2 Kernel Updates and Reboot Planning
Kernel Lifecycle Management
- /var/run/reboot-required:Ubuntu creates this sentinel file when a kernel or core library update requires a full system restart to take effect.
- Checking Pending Reboot in Scripts:
if [ -f /var/run/reboot-required ]; then echo 'Restart needed'; fi - Inspect Active vs Installed Kernel:
uname -rshows currently running kernel in RAM;dpkg -l | grep linux-imageshows all installed kernels on disk. - Canonical Livepatch:Applies critical Linux kernel CVE patches into active memory without rebooting the server, minimizing downtime on production databases.
Knowledge Check: Module 6 Package Management and Software
1. What does "apt update" do on Debian and Ubuntu?
2. Which package format is standard on Debian, Ubuntu, and Mint?
3. Which low-level utility manages local .deb files without resolving dependencies?
4. What command removes orphan dependencies left behind by uninstalled software?
5. Which file indicates that an Ubuntu server requires a reboot?
6. In source builds, which step checks system prerequisites and generates Makefiles?