Packages on Ubuntu: apt, dpkg, deb822 sources and unattended upgrades

Everything runs on ubu01 as student with sudo. You’ll install and remove a few small tools (ncdu, socat, lynx) and leave the system as you found it. Outputs were captured from apt 3.2 on Ubuntu 26.04; version numbers, sizes and IDs on your VM will differ as updates are released, which is why the labels say “something like this”.

1Read where apt gets its packages

Run this:

ls /etc/apt/sources.list.d/
cat /etc/apt/sources.list.d/ubuntu.sources | grep -v '^#'
cat /etc/apt/sources.list

You should see something like this:

ubuntu.sources
Types: deb
URIs: http://archive.ubuntu.com/ubuntu/
Suites: resolute resolute-updates resolute-backports
Components: main restricted universe multiverse
Signed-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg

Types: deb
URIs: http://security.ubuntu.com/ubuntu/
Suites: resolute-security
Components: main restricted universe multiverse
Signed-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg
# Ubuntu sources have moved to /etc/apt/sources.list.d/ubuntu.sources

Two stanzas: the main mirror with the release, updates and backports pockets, and the security mirror. Both trust only the Ubuntu archive keyring through Signed-By. Your URIs may name a country mirror chosen by the installer.

The old sources.list is empty apart from that comment, and a stanza can be switched off by adding Enabled: no instead of deleting it.

✅ Checkpoint: You can name the four suites, the four components and the keyring ubu01 trusts.

2Refresh the indexes and look for upgrades

Run this:

sudo apt update
apt list --upgradable

You should see something like this:

Hit:1 http://archive.ubuntu.com/ubuntu resolute InRelease
Get:2 http://archive.ubuntu.com/ubuntu resolute-updates InRelease [136 kB]
Hit:3 http://archive.ubuntu.com/ubuntu resolute-backports InRelease
Hit:4 http://security.ubuntu.com/ubuntu resolute-security InRelease
Fetched 136 kB in 1s (167 kB/s)
All packages are up to date.

Hit means the index hasn’t changed since last time; Get means a new one was downloaded. When updates exist, the last line says how many and apt list --upgradable lists them with the pocket they come from. Run update before every install, because apt only knows what the last update downloaded.

✅ Checkpoint: apt update finishes without any Err: or Warning: lines.

3Inspect a package before you install it

Run this:

apt search --names-only '^ncdu'
apt show ncdu

You should see something like this:

ncdu/resolute 1.22-1build1 amd64
  ncurses disk usage viewer

Package: ncdu
Version: 1.22-1build1
Priority: optional
Section: universe/admin
Origin: Ubuntu
Maintainer: Ubuntu Developers <ubuntu-devel-discuss@lists.ubuntu.com>
Installed-Size: 122 kB
Depends: libc6 (>= 2.34), libncursesw6 (>= 6), libtinfo6 (>= 6)
Homepage: https://dev.yorhel.nl/ncdu/
Download-Size: 51.0 kB
APT-Sources: http://archive.ubuntu.com/ubuntu resolute/universe amd64 Packages

The Section says universe, so this is a community package, not one Canonical supports in main. Depends lists what it needs, Download-Size and Installed-Size tell you the cost, and APT-Sources shows the exact pocket it would come from.

✅ Checkpoint: You can say which component ncdu comes from and how big the download is.

4Install, then ask dpkg about it

Run this:

sudo apt install -y ncdu

You should see something like this:

Installing:
  ncdu

Summary:
  Upgrading: 0, Installing: 1, Removing: 0, Not Upgrading: 0
  Download size: 51.0 kB
  Space needed: 122 kB / 15.8 GB available

Get:1 http://archive.ubuntu.com/ubuntu resolute/universe amd64 ncdu amd64 1.22-1build1 [51.0 kB]
Fetched 51.0 kB in 0s (333 kB/s)
Selecting previously unselected package ncdu.
(Reading database ... 91762 files and directories currently installed.)
Preparing to unpack .../ncdu_1.22-1build1_amd64.deb ...
Unpacking ncdu (1.22-1build1) ...
Setting up ncdu (1.22-1build1) ...
Processing triggers for man-db (2.13.1-1) ...

Now query the dpkg database:

dpkg -l ncdu
dpkg -L ncdu | grep -E 'bin|share/(doc|man)/'
dpkg -S /usr/bin/ncdu /etc/ssh/sshd_config.d/00-saat-hardening.conf

You should see something like this:

Desired=Unknown/Install/Remove/Purge/Hold
| Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend
|/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
||/ Name           Version      Architecture Description
+++-==============-============-============-=================================
ii  ncdu           1.22-1build1 amd64        ncurses disk usage viewer
/usr/bin/ncdu
/usr/share/doc/ncdu/changelog.Debian.gz
/usr/share/doc/ncdu/copyright
/usr/share/man/man1/ncdu.1.gz
ncdu: /usr/bin/ncdu
dpkg-query: no path found matching pattern /etc/ssh/sshd_config.d/00-saat-hardening.conf

dpkg -l prints the state letters (“ii” means wanted installed, is installed), -L lists the package’s files and -S finds the package that owns a path, like rpm -qf on Rocky. The 00-saat-hardening.conf you put in sshd_config.d in Lesson 33 isn’t owned by any package, which is how you spot local changes.

Try it yourself: build the install-and-check commands for apt or dnf in the Command Builder.

✅ Checkpoint: dpkg -l ncdu starts with ii and dpkg -S /usr/bin/ncdu names ncdu.

5Install an older version and see the upgrade waiting

Install socat at the version from the release pocket on purpose, then check:

apt policy socat | head -n 3
sudo apt install -y socat=1.8.1.1-1
apt policy socat
apt list --upgradable

You should see something like this (the install, then the policy and upgradable lines):

Installing:
  socat

Installing dependencies:
  libwrap0

Summary:
  Upgrading: 0, Installing: 2, Removing: 0, Not Upgrading: 0
  Download size: 451 kB
  Space needed: 1871 kB / 15.8 GB available

Get:1 http://archive.ubuntu.com/ubuntu resolute/main amd64 socat amd64 1.8.1.1-1 [402 kB]
...
Setting up socat (1.8.1.1-1) ...
socat:
  Installed: 1.8.1.1-1
  Candidate: 1.8.1.1-1ubuntu0.1
  Version table:
     1.8.1.1-1ubuntu0.1 500
        500 http://archive.ubuntu.com/ubuntu resolute-updates/main amd64 Packages
        500 http://security.ubuntu.com/ubuntu resolute-security/main amd64 Packages
 *** 1.8.1.1-1 500
        500 http://archive.ubuntu.com/ubuntu resolute/main amd64 Packages
        100 /var/lib/dpkg/status
socat/resolute-updates,resolute-security 1.8.1.1-1ubuntu0.1 amd64 [upgradable from: 1.8.1.1-1]

NAME=VERSION asks for an exact version; use the older version your own apt policy lists if it differs. The *** marks the installed version, and both the updates and security pockets offer the newer one. On a fresh install with no older version available, read along: the hold behaviour in the next step is the part that matters.

✅ Checkpoint: apt list --upgradable shows socat upgradable from the version you installed.

6Hold a package, watch upgrade skip it, then release it

Run this:

sudo apt-mark hold socat
apt-mark showhold
sudo apt upgrade -y

You should see something like this:

socat set on hold.
socat
Not upgrading:
  socat

Summary:
  Upgrading: 0, Installing: 0, Removing: 0, Not Upgrading: 1

A hold tells apt and unattended-upgrades never to change this package, which is useful while a vendor certifies a new version. The Summary says “Not Upgrading: 1”, and dpkg -l socat now starts with “hi”. Release it and upgrade:

sudo apt-mark unhold socat
sudo apt upgrade -y

You should see something like this:

Canceled hold on socat.
Upgrading:
  socat

Summary:
  Upgrading: 1, Installing: 0, Removing: 0, Not Upgrading: 0
  Download size: 403 kB
  Space needed: 3072 B / 15.8 GB available

Get:1 http://archive.ubuntu.com/ubuntu resolute-updates/main amd64 socat amd64 1.8.1.1-1ubuntu0.1 [403 kB]
...
Unpacking socat (1.8.1.1-1ubuntu0.1) over (1.8.1.1-1) ...
Setting up socat (1.8.1.1-1ubuntu0.1) ...

✅ Checkpoint: apt-mark showhold prints nothing and apt policy socat shows *** on the newer version.

7Look back with apt history, then undo

Run this:

apt history-list | tail -n 3
apt history-info 14

You should see something like this (use the ID of your ncdu install):

ID  Command line             Date and Time          Action    Changes

14  install -y ncdu          2026-10-27  11:12:41   Install   1
15  install -y socat=1.8.... 2026-10-27  11:15:03   Install   1
16  upgrade -y               2026-10-27  11:17:30   Upgrade   1

Transaction ID: 14
Start time: 2026-10-27  11:12:41
End time: 2026-10-27  11:12:42
Requested by: student (1000)
Command line: apt install -y ncdu
Packages changed:
    Install ncdu:amd64 (1.22-1build1)

apt 3.1 added history commands that work like dnf history, reading /var/log/apt/history.log. Undo the ncdu install:

sudo apt history-undo 14

You should see something like this:

REMOVING:
  ncdu

Summary:
  Upgrading: 0, Installing: 0, Removing: 1, Not Upgrading: 0
  Freed space: 122 kB

(Reading database ... 91773 files and directories currently installed.)
Removing ncdu (1.22-1build1) ...

Undo reverses installs and removals well. In our tests on apt 3.2 an undo of an upgrade answered “already the newest version” and didn’t downgrade, so for upgrades you still install the old version by hand (apt install NAME=VERSION) or restore a snapshot. On Ubuntu 24.04 and older these commands don’t exist; /var/log/apt/history.log and /var/log/dpkg.log are your record there.

✅ Checkpoint: dpkg -l ncdu no longer shows ii, and history-list has a new line for the undo.

8Remove, autoremove and purge

Install lynx (a text web browser), then take it away in three stages:

sudo apt install -y lynx
sudo apt remove -y lynx
dpkg -l lynx lynx-common | tail -n 2

You should see something like this:

REMOVING:
  lynx

Summary:
  Upgrading: 0, Installing: 0, Removing: 1, Not Upgrading: 0
  Freed space: 2056 kB

Removing lynx (2.9.2-2) ...
rc  lynx           2.9.2-2      amd64        classic non-graphical (text-mode) web browser
ii  lynx-common    2.9.2-2      all          shared files for lynx package

remove took the program away but left two things: its config (state “rc”, removed with config files left) and lynx-common, which was pulled in as a dependency. apt said so in a line telling you to use autoremove:

sudo apt autoremove -y
dpkg -l lynx lynx-common | tail -n 2
ls /etc/lynx

You should see something like this:

REMOVING:
  lynx-common

Summary:
  Upgrading: 0, Installing: 0, Removing: 1, Not Upgrading: 0
  Freed space: 5243 kB

Removing lynx-common (2.9.2-2) ...
rc  lynx           2.9.2-2      amd64        classic non-graphical (text-mode) web browser
rc  lynx-common    2.9.2-2      all          shared files for lynx package
lynx.cfg  lynx.lss

The config files in /etc/lynx are still there. purge removes those too:

sudo apt purge -y lynx lynx-common
ls /etc/lynx

You should see something like this:

REMOVING:
  lynx*  lynx-common*

Summary:
  Upgrading: 0, Installing: 0, Removing: 2, Not Upgrading: 0
  Space needed: 0 B / 15.8 GB available

Purging configuration files for lynx (2.9.2-2) ...
Purging configuration files for lynx-common (2.9.2-2) ...
ls: cannot access '/etc/lynx': No such file or directory

Use remove when you might reinstall and want your config kept, purge when you want a clean slate, and read the autoremove list before saying yes, because a package you rely on may only be there “automatically”.

✅ Checkpoint: dpkg -l lynx lynx-common no longer shows rc and /etc/lynx is gone.

9Check automatic security updates

Run this:

cat /etc/apt/apt.conf.d/20auto-upgrades
grep -A 6 '^Unattended-Upgrade::Allowed-Origins' /etc/apt/apt.conf.d/50unattended-upgrades
systemctl list-timers 'apt-daily*'

You should see something like this:

APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Unattended-Upgrade "1";
Unattended-Upgrade::Allowed-Origins {
	"${distro_id}:${distro_codename}";
	"${distro_id}:${distro_codename}-security";
	"${distro_id}ESMApps:${distro_codename}-apps-security";
	"${distro_id}ESM:${distro_codename}-infra-security";
//	"${distro_id}:${distro_codename}-updates";

NEXT                            LEFT LAST                           PASSED UNIT                    ACTIVATES
Tue 2026-10-27 18:41:07 IST     7h Tue 2026-10-27 09:02:55 IST 2h 27min ago apt-daily.timer         apt-daily.service
Wed 2026-10-28 06:23:44 IST    19h Tue 2026-10-27 06:11:20 IST 5h 19min ago apt-daily-upgrade.timer apt-daily-upgrade.service

2 timers listed.

The two “1” lines switch on daily index updates and daily unattended upgrades. Only the release and security origins are allowed; the -updates line is commented out, so bug-fix updates wait for you. Now see what it would do today, without doing it.

Install socat at the old version again first so there’s something to find:

sudo apt install -y --allow-downgrades socat=1.8.1.1-1
sudo unattended-upgrade --dry-run -v

You should see something like this:

Starting unattended upgrades script
Allowed origins are: o=Ubuntu,a=resolute, o=Ubuntu,a=resolute-security, o=UbuntuESMApps,a=resolute-apps-security, o=UbuntuESM,a=resolute-infra-security
Initial blacklist:
Initial whitelist (not strict):
Option --dry-run given, *not* performing real actions
Packages that will be upgraded: socat
Writing dpkg log to /var/log/unattended-upgrades/unattended-upgrades-dpkg.log
/usr/bin/dpkg --status-fd 9 --no-triggers --unpack --auto-deconfigure /var/cache/apt/archives/socat_1.8.1.1-1ubuntu0.1_amd64.deb
/usr/bin/dpkg --status-fd 9 --configure --pending
All upgrades installed

Run it without --dry-run to apply the update now. Real runs log to /var/log/unattended-upgrades/unattended-upgrades.log, and ls /var/run/reboot-required tells you whether a reboot is waiting. To limit when the timer fires or let it reboot at 02:00, use a drop-in for the timer (Lesson 26) and the Automatic-Reboot options in 50unattended-upgrades.

Try it yourself: build the security-update commands for apt or dnf in the Command Builder.

✅ Checkpoint: The dry run lists socat under “Packages that will be upgraded”, and after a real run apt policy socat shows the newer version installed.

10See where repository keys belong now

Run this:

ls /etc/apt/keyrings /usr/share/keyrings
apt-key list

You should see something like this:

/etc/apt/keyrings:

/usr/share/keyrings:
ubuntu-archive-keyring.gpg
ubuntu-archive-removed-keys.gpg
ubuntu-cloudimage-keyring.gpg
ubuntu-cloudimage-removed-keys.gpg
ubuntu-master-keyring.gpg
-bash: apt-key: command not found

apt-key is gone in Ubuntu 26.04, so every old guide that starts with curl ... | sudo apt-key add - fails here. The current pattern for a vendor repo is two files, shown below for an imaginary vendor. Don’t run it; you’ll use the same pattern for real with Zabbix in Lesson 61:

# key, stored in binary form, readable by apt
curl -fsSL https://repo.vendor.example/key.asc | sudo gpg --dearmor -o /etc/apt/keyrings/vendor.gpg

# /etc/apt/sources.list.d/vendor.sources
Types: deb
URIs: https://repo.vendor.example/ubuntu
Suites: resolute
Components: main
Signed-By: /etc/apt/keyrings/vendor.gpg

Because of Signed-By, that key can only vouch for that one repo. If you inherit old .list files after an upgrade, sudo apt modernize-sources converts them to .sources, adds Signed-By where it can and keeps .bak copies.

✅ Checkpoint: You can explain why a vendor key belongs in /etc/apt/keyrings with a Signed-By line, and what replaced apt-key.