Scroll to navigation



sources.list - List of configured APT data sources









Files in this format have the extension .sources. The format is similar in syntax to other files used by Debian and its derivatives, such as the metadata files that apt will download from the configured sources or the debian/control file in a Debian source package. Individual entries are separated by an empty line; additional empty lines are ignored, and a # character at the start of the line marks the entire line as a comment. An entry can hence be disabled by commenting out each line belonging to the stanza, but it is usually easier to add the field "Enabled: no" to the stanza to disable the entry. Removing the field or setting it to yes re-enables it. Options have the same syntax as every other field: A field name separated by a colon (:) and optionally spaces from its value(s). Note especially that multiple values are separated by whitespaces (like spaces, tabs and newlines), not by commas as in the one-line format. Multivalue fields like Architectures also have Architectures-Add and Architectures-Remove to modify the default value rather than replacing it.



The deb type references a typical two-level Debian archive, distribution/component. The distribution is generally a suite name like stable or testing or a codename like buster or bullseye while component is one of main, contrib or non-free. The deb-src type references a Debian distribution's source code in the same form as the deb type. A deb-src line is required to fetch source indexes.



Alternatively the equivalent entry in deb822 style looks like this:

     Types: deb deb-src
     URIs: uri
     Suites: suite
     option1: value1
     option2: value2






deb buster main contrib non-free
deb buster/updates main contrib non-free

or like this in deb822 style format:

Types: deb
Suites: buster
Components: main contrib non-free
Types: deb
Suites: buster/updates
Components: main contrib non-free











Signed-By (signed-by) is an option to require a repository to pass apt-secure(8) verification with a certain set of keys rather than all trusted keys apt has configured. It is specified as a list of absolute paths to keyring files (have to be accessible and readable for the _apt system user, so ensure everyone has read-permissions on the file) and fingerprints of keys to select from these keyrings. If no keyring files are specified the default is the trusted.gpg keyring and all keyrings in the trusted.gpg.d/ directory (see apt-key fingerprint). If no fingerprint is specified all keys in the keyrings are selected. A fingerprint will accept also all signatures by a subkey of this key, if this isn't desired an exclamation mark (!) can be appended to the fingerprint to disable this behaviour. The option defaults to the value of the option with the same name if set in the previously acquired Release file of this repository (only fingerprints can be specified there through). Otherwise all keys in the trusted keyrings are considered valid signers for this repository.



Check-Date (check-date) is a yes/no value which controls if APT should consider the machine's time correct and hence perform time related checks, such as verifying that a Release file is not from the future. Disabling it also disables the Check-Valid-Until option mentioned above.

Date-Max-Future (date-max-future) controls how far from the future a repository may be. Default to the value of the configuration option Acquire::Max-FutureTime which is 10 seconds by default.

InRelease-Path (inrelease-path) determines the path to the InRelease file, relative to the normal position of an InRelease file. By default, this option is unset and APT will try to fetch an InRelease or, if that fails, a Release file and its associated Release.gpg file. By setting this option, the specified path will be tried instead of the InRelease file, and the fallback to Release files will be disabled.


The currently recognized URI types are:

http (apt-transport-http(1))

The http scheme specifies an HTTP server for an archive and is the most commonly used method. The URI can directly include login information if the archive requires it, but the use of apt_auth.conf(5) should be preferred. The method also supports SOCKS5 and HTTP(S) proxies either configured via apt-specific configuration or specified by the environment variable http_proxy in the format (assuming an HTTP proxy requiring authentication) http://user:pass@server:port/. The authentication details for proxies can also be supplied via apt_auth.conf(5).

Note that these forms of authentication are insecure as the whole communication with the remote server (or proxy) is not encrypted so a sufficiently capable attacker can observe and record login as well as all other interactions. The attacker can not modify the communication through as APT's data security model is independent of the chosen transport method. See apt-secure(8) for details.

https (apt-transport-https(1))

The https scheme specifies an HTTPS server for an archive and is very similar in use and available options to the http scheme. The main difference is that the communication between apt and server (or proxy) is encrypted. Note that the encryption does not prevent an attacker from knowing which server (or proxy) apt is communicating with and deeper analysis can potentially still reveal which data was downloaded. If this is a concern the Tor-based schemes mentioned further below might be a suitable alternative.

mirror, mirror+scheme (apt-transport-mirror(1))

The mirror scheme specifies the location of a mirrorlist. By default the scheme used for the location is http, but any other scheme can be used via mirror+scheme. The mirrorlist itself can contain many different URIs for mirrors the APT client can transparently pick, choose and fallback between intended to help both with distributing the load over the available mirrors and ensuring that clients can acquire data even if some configured mirrors are not available.




The cdrom scheme allows APT to use a local CD-ROM, DVD or USB drive with media swapping. Use the apt-cdrom(8) program to create cdrom entries in the source list.


The ftp scheme specifies an FTP server for an archive. Use of FTP is on the decline in favour of http and https and many archives either never offered or are retiring FTP access. If you still need this method many configuration options for it are available in the Acquire::ftp scope and detailed in apt.conf(5).




rsh, ssh


adding more recognizable URI types

APT can be extended with more methods shipped in other optional packages, which should follow the naming scheme apt-transport-method. For instance, the APT team also maintains the package apt-transport-tor, which provides access methods for HTTP and HTTPS URIs routed via the Tor network.




Types: deb
URIs: file:/home/apt/debian
Suites: stable
Components: main contrib non-free



Types: deb
URIs: file:/home/apt/debian
Suites: unstable
Components: main contrib non-free

Sources specification for the above.


Types: deb-src
URIs: file:/home/apt/debian
Suites: unstable
Components: main contrib non-free


deb buster main
deb [ arch=amd64,armel ] buster main

Types: deb
Suites: buster
Components: main
Types: deb
Suites: buster
Components: main
Architectures: amd64 armel


Types: deb
Suites: hamm
Components: main

Uses FTP to access the archive at, under the debian directory, and uses only the buster/contrib area.

deb buster contrib

Types: deb
Suites: buster
Components: contrib


deb unstable contrib

Types: deb
Suites: unstable
Components: contrib


deb unstable/binary-$(ARCH)/

Types: deb
Suites: unstable/binary-$(ARCH)/


deb stable main contrib
deb-src stable main contrib
deb testing main contrib
deb-src testing main contrib
deb unstable main contrib
deb-src unstable main contrib

Types: deb deb-src
Suites: stable testing unstable
Components: main contrib


apt-get(8), apt.conf(5), /usr/share/doc/apt-doc/




Jason Gunthorpe

APT team


APT bug page
04 April 2019 APT 2.1.8