Day 2 - Package Management (2): DEB, APT, and Source Installation

📌 Key Takeaways

• In the Debian family, the low-level tool is dpkg and the high-level tool is apt.
• apt update refreshes the list, and apt upgrade does the actual upgrade. The names are confusing, but they do different jobs.
• Source installation has four steps: extract → ./configure → make → make install.
• tar only bundles; it does not compress. Compression is handled by the -z (gzip) · -j (bzip2) · -J (xz) options.
• Compression ratio is generally xz > bzip2 > gzip, and speed is the reverse.

dpkg — The Low-Level Tool

dpkg -i package.deb       # install
dpkg -r package-name      # remove (keeps config files)
dpkg -P package-name      # complete removal (purge — including config)
dpkg -l                   # list of installed packages
dpkg -L package-name      # list of files the package installed
dpkg -S /path/file        # which package owns this file

• Difference between -r and -P — -r (remove) keeps config files, and -P (purge) deletes the config too.
• dpkg also does not resolve dependencies. This is a trait common to low-level tools.
• Just like rpm, you give a .deb file for install (-i) and a package name for removal and queries.

The First Two Letters of dpkg -l

$ dpkg -l | grep -E 'apache2-bin|vsftpd'
ii  apache2-bin    2.4.52-1ubuntu4    amd64    Apache HTTP Server (modules and other binary files)
rc  vsftpd         3.0.5-0ubuntu1     amd64    lightweight, efficient FTP server written for security

• rc is exactly where the difference between -r and -P becomes visible. After dpkg -r vsftpd it remains as rc, and after dpkg -P vsftpd it disappears from the list.
• The reason for keeping config is so the old settings can be reused as they were when you reinstall. To start fresh and clean, purge.

Package File Names — How They Differ from RPM

   apache2 _ 2.4.52-1ubuntu4 _ amd64 . deb
      │            │             │
      │            │             └── architecture
      │            └──────────────── version-revision
      └───────────────────────────── package name

• Even for the same program, the package name can differ by distribution. The Apache web server is httpd in the Red Hat family and apache2 in the Debian family. The httpd in the apt examples below matches the name to yesterday's for easy comparison; on a real Ubuntu you install it with apt install apache2.

When dpkg Is Blocked by Dependencies

apt — The High-Level Tool

apt update                 # refresh package list (does not install!)
apt upgrade                # upgrade installed packages
apt install httpd          # install
apt remove httpd           # remove
apt purge httpd            # remove including config
apt search keyword         # search
apt show httpd             # info
apt list --installed       # installed list

⚠️ Always distinguish update from upgrade. apt update only fetches a fresh list of "which versions of which packages exist" from the repository. It does not actually install or change anything. apt upgrade looks at that list and actually upgrades. So you always use the order apt update && apt upgrade.

• Repository addresses are in /etc/apt/sources.list and /etc/apt/sources.list.d/.
• It is the same place as /etc/yum.repos.d/ in the RPM family.

Why apt update Exists Separately

   Repository server                    My computer
   package list  ── apt update ───────►  copy of the list (/var/lib/apt/lists/)
   package files ── apt upgrade ──────►  actual install · update
                    apt install

• apt works from the copy of the list stored on my computer. If the copy is stale, it does not know new versions have come out, and it fails trying to fetch old files that have already vanished from the repository.
• That is why you run apt update first even before installing. If apt install on a freshly installed Ubuntu says "package not found", you usually have never fetched the list.
• yum has no separate step for this. If the list is stale, yum fetches a fresh one on its own when it runs, and yum update goes straight to the actual upgrade. The same word update does different things in the two families.

The Remaining apt Commands

• In the past the commands were split: apt-get for installing, apt-cache for searching. apt gathers the frequently used features into one command.
• The difference between apt remove and apt purge is exactly the same as between dpkg -r and -P — whether config files are kept or deleted.

Reading One sources.list Line

   deb  http://archive.ubuntu.com/ubuntu  jammy  main restricted
    │                 │                     │         │
    │                 │                     │         └── components (areas)
    │                 │                     └──────────── codename of the distribution release
    │                 └────────────────────────────────── repository address
    └──────────────────────────────────────────────────── deb = binary, deb-src = source

• After editing a line, you must run apt update for the new repository's list to come in.
• Recent distributions sometimes put the same content in a file of a different format (.sources under /etc/apt/sources.list.d/). The location the exam asks about is /etc/apt/sources.list.

Correspondence Table for the Two Families

Compression and Bundling

Bundling (archive) and compressing (compress) are different jobs.

   ratio   xz  >  bzip2  >  gzip
   speed   gzip  >  bzip2  >  xz

• tar itself does not compress. It only bundles. That is why names that go through two steps, like .tar.gz, are common.

Compression Tools Handle Only One File

$ ls
access.log  error.log
$ gzip access.log
$ ls
access.log.gz  error.log
$ gunzip access.log.gz
$ ls
access.log  error.log

• gzip deletes the original and replaces it with a .gz. The original and the compressed file do not remain together. The same goes for bzip2 and xz.
• All three tools compress one file at a time and cannot make multiple files into one lump. That is why to compress a whole directory you must bundle it with tar first.

• Decompression works with -d (decompress) for all three. gunzip does the same job as gzip -d.
• zip and unzip are a different family. They do bundling and compression in one go and are used when exchanging files with Windows (.zip).

tar Options

tar -cvf bundle.tar folder/        # bundle (create)
tar -xvf bundle.tar                # extract (extract)
tar -tvf bundle.tar                # list contents only (list)
tar -zcvf bundle.tar.gz folder/    # bundle and gzip-compress
tar -zxvf bundle.tar.gz            # gzip-decompress and extract
tar -jxvf bundle.tar.bz2           # bzip2
tar -Jxvf bundle.tar.xz            # xz

Mixing up -c (bundle) and -x (extract) can overwrite the original. The pairing -z is lowercase gzip, -j is bzip2, -J is uppercase xz also shows up as is.

The Order for Reading Option Letters

   tar  -z c v f  backup.tar.gz  /home/alice
         │ │ │ │        │             │
         │ │ │ │        │             └── what to bundle
         │ │ │ │        └──────────────── file name that -f takes
         │ │ │ └── f : what follows is the archive file name
         │ │ └──── v : show the files being processed on screen
         │ └────── c : action (exactly one of c · x · t)
         └──────── z : compression method (one of z · j · J)

• You pick exactly one of c, x, t as the action. To that you attach one compression method plus v and f.
• Put f last. The thing right after f is interpreted as the file name. Writing tar -cfv a.tar dir tries to create an archive named v.
• Writing without the hyphen, as tar zxvf file, means the same thing. Both notations appear in the choices.

tar -zxvf backup.tar.gz -C /tmp        # extract under /tmp
tar -ztvf backup.tar.gz                # only see what is inside, without extracting

• Recent GNU tar can sometimes detect the compression format on its own when extracting. But when bundling, nothing is compressed unless you give an option, and on the exam you pick as the answer the one with the option matching the extension.
• The habit of looking at the list first with -t is safe. Extracting an archive bundled without a top-level directory dumps hundreds of files into the current directory.

Installing from Source

When there is no package or you need to choose the options yourself, you compile the source.

   1  tar -zxvf program-1.0.tar.gz     extract
   2  cd program-1.0
   3  ./configure                      check environment · generate Makefile
   4  make                             compile
   5  make install                     install (usually with root privileges)

• You can specify the install location as in ./configure --prefix=/opt/myapp.
• With source installation, you must also take care of dependencies yourself, and removal is hard. Using packages whenever possible is recommended.
• If you do not give --prefix, it usually installs under /usr/local. That location keeps it from mixing with /usr, where packages install.
• The ./ before configure means "the one in the current directory". The current directory is not in PATH, so typing just configure will not find it. make, on the other hand, is a command installed on the system, so no ./ is attached.

Where Each Step Gets Stuck

• The three steps form a chain in which each step takes the output of the previous one. make reads the Makefile that ./configure made, and make install copies the executable that make built. That is why the order cannot be changed.
• By convention, ./configure and make are run as a regular user, and only make install as root.

Tomorrow we cover device files and the /dev directory.

📖 Glossary

• dpkg: The low-level package tool of the Debian family. It does not resolve dependencies.
• apt: The high-level tool of the Debian family. It uses repositories and handles dependencies too.
• apt update: The command that only fetches a fresh package list from the repository.
• apt upgrade: The command that actually updates packages to their latest versions.
• tar: A command that bundles multiple files into one. It has no compression of its own.
• gzip / bzip2 / xz: Compression tools. Their extensions are .gz, .bz2, and .xz respectively.
• ./configure: The step in source installation that checks the system and generates the Makefile.
• make install: The step that installs the compiled results onto the system.