Mfcttrf

I'm currently working with Ubuntu and trying to install a Debian system on a VM, which means I have to deal with packages. Since I'm new to it, I've read a lot about it on the web and especially debian wiki (ubuntu wiki is useful too). In particular, I have learn how to make a local repository and how to properly edit the sources.list file.

However, I still have some questions about how it works, details I couldn't find on the web.

• First, when you use an online repository. I understood that apt-get will follow the link you wrote in the source.list file and search for a Packages.gz archive. What i don't understand is how this simple archive (which seem to be only a list of installable packages) allow the installation of the package? Does Packages.gz gives apt information about how to find the .deb file and then proceed the installation? Or is it something else?




• Second, about the Sources.gz archive. I've read it's the source code of the packages listed in Packages.gz, BUT in most cases it's not needed. So, if i add the link to this Sources.gz in my source.list file, what does it really gives to me? What's the point of it?




• Third, about local repository; this is related to the previous questions. I know how to make a local repository with .deb files, but let's say i only have this Packages.gz archive: it won't be enough, rigth? and if i have the Sources.gz archive, will it work?




• Finally, i've seen on Debian repository that, in addition to the dist repository, there is a pool repository with a lot of .deb in it. I know a way to install those (download the .deb and its dependencies, install them with dpkg -i), but is there an easier way? Something more automatic, which could find the .deb online, find its dependencies, and install everything ? (just like apt-get do, but as far as i've understood it, apt-get only works with the Packages.gz and Sources.gz archives, not directly with .deb)

I'm sorry this is not really a question, rather a list of questions ^^ but everything I found online was mostly "apt-get search for the package and its dependency in the online repository and install it through dpkg", and I would like more details about it.

1. The Packages.gz contains a Filename field with a value that probably looks something like pool/main/n/name-of-package/name-of-package_version_amd64.deb. This tells the package manager to look at that URL.
   
   For instance, if you have the following line in your sources.list(.d):
   deb https://some-domain.com/some-url some-distribution main
   
   You will have the following file: https://some-domain.com/some-url/dists/some-distribution/main/binary-amd64/Packages.gz
   
   That file will reference pool/main/n/name-of-package/name-of-package_version_amd64.deb, so your package manager will look at https://some-domain.com/some-url/pool/main/n/name-of-package/name-of-package_version_amd64.deb.




2. Sources.gz works the same way, but is optional. It works with apt source, which will fetch you the source if you wish to compile it yourself instead of using the pre-built binaries.
   
   This is mainly useful for system administrators who want to patch the exact version of the package used by a distribution, rather than contributors/curious people who would just go to the project's homepage and follow the build instructions there.




3. If a package is in the distribution's pool directory but not in Packages.gz, it is most probably in another Package.gz. Notice how you have several words in a typical sources.list line:
   deb http://archive.ubuntu.com/ubuntu precise main universe multiverse
main, universe and multiverse each have their own Packages.gz file. You may need to enable some, as debian for instance disables non-free by default. However, some packages still won't be available (not even in pool). You may choose to add untrusted repositories (such as PPAs on Ubuntu), package the missing program yourself (so you and other people can use their package manager to manage that program) or simply build and install it yourself (you should use the /usr/local prefix to avoid conflicts with your package manager).



4. When a new (version of a) package appears, the Release file for the distribution is updated. This allows apt update to know it has to re-download Packages.gz.