3.4.1. Package Managers and Repository Management

💡 First Principle: Package managers operate in two layers: a low-level tool that installs .deb or .rpm files directly (no dependency resolution), and a high-level tool that fetches packages from repositories and resolves dependencies automatically. Always use the high-level tool for normal operations.

Debian/Ubuntu (apt + dpkg):

# apt — high-level (use for most operations)
apt update                       # Refresh package index from repositories
apt upgrade                      # Upgrade installed packages; never removes any (apt-get upgrade also never installs new ones)
apt full-upgrade                 # Upgrade with dependency changes (replaces dist-upgrade): may install new deps and remove packages
apt install nginx                # Install nginx and its dependencies
apt install nginx=1.24.0-1       # Install specific version
apt remove nginx                 # Remove package (keep config files)
apt purge nginx                  # Remove package AND config files
apt autoremove                   # Remove no-longer-needed dependencies
apt search "web server"          # Search packages by description
apt show nginx                   # Show package details
apt list --installed             # List installed packages
apt list --upgradable            # List packages with available upgrades

# dpkg — low-level (use for .deb files, inspecting installed packages)
dpkg -i package.deb              # Install .deb file directly
dpkg -r nginx                    # Remove package
dpkg -l                          # List all installed packages
dpkg -l | grep nginx             # Check if nginx is installed
dpkg -L nginx                    # List files installed by package
dpkg -S /usr/sbin/nginx          # Which package owns a file
apt install -f                   # Fix broken installs: fetch dependencies a failed dpkg -i left unmet
dpkg --configure -a              # Finish configuring packages an interrupted dpkg run left half-configured
DEBIAN_FRONTEND=noninteractive apt-get install -y pkg   # -y answers apt's own prompts; this also silences debconf configuration questions

RHEL/Fedora (dnf + rpm):

# dnf — high-level
dnf update                       # Update all packages
dnf check-update                 # List available updates without installing (empty = no newer, non-excluded version in the enabled repos)
dnf upgrade --security           # Only packages with security advisories, each to its newest version
dnf upgrade-minimal --security   # Security fixes only, each to the nearest version that fixes the advisory (old alias update-minimal)
dnf needs-restarting -r          # Is a reboot needed? A new kernel only runs after a reboot
dnf install httpd                # Install httpd (Apache on RHEL)
dnf install httpd-2.4.51         # Specific version
dnf remove httpd                 # Remove package (default clean_requirements_on_remove=True also drops its unneeded deps)
dnf autoremove                   # Remove dependencies nothing needs any more (given a package, removes it too)
dnf search "web server"          # Search
dnf info httpd                   # Package details
dnf list installed               # List installed
dnf list available               # List available in repos
dnf history                      # Transaction history
dnf history undo 15              # Undo transaction #15
dnf provides /usr/sbin/httpd     # Which package provides a file (searches repos: works for files not yet installed)
dnf group install "Development Tools"   # Install package group

# rpm — low-level
rpm -ivh package.rpm             # Install .rpm with verbose + progress
rpm -qa                          # Query all installed packages
rpm -qa | grep httpd             # Check if httpd is installed
rpm -ql httpd                    # List files in package
rpm -qf /usr/sbin/httpd          # Which INSTALLED package owns a file (local RPM database only)
rpm -qi httpd                    # Package info
rpm --verify httpd               # Verify package file integrity
rpm -Va                          # Verify ALL installed packages (size, mode, digest...) against the RPM database

Repository Management:

# Debian/Ubuntu
# Repository sources: /etc/apt/sources.list and /etc/apt/sources.list.d/*.list
# Add a repo:
add-apt-repository ppa:nginx/stable
# Or manually edit /etc/apt/sources.list.d/nginx.list:
# deb https://nginx.org/packages/ubuntu focal nginx

# Repo GPG signatures prove origin + integrity (not secrecy: packages are not encrypted)
# GPG key import (for third-party repos):
curl -fsSL https://nginx.org/keys/nginx_signing.key | apt-key add -
# Modern approach (no deprecated apt-key):
curl -fsSL https://nginx.org/keys/nginx_signing.key | \
  gpg --dearmor -o /etc/apt/keyrings/nginx.gpg

# RHEL/Fedora
# Repo files: /etc/yum.repos.d/*.repo
# Enable/disable:
dnf config-manager --enable epel
dnf config-manager --disable rpmfusion-free
# EPEL (Extra Packages for Enterprise Linux) — common third-party source
dnf install epel-release

# Package exclusions (prevent specific packages from being updated)
# In /etc/dnf/dnf.conf: exclude=kernel*
# Or per-repo in .repo file: exclude=php*
dnf versionlock add nginx-1.20.1  # Pin an exact version: blocks upgrades AND downgrades (python3-dnf-plugin-versionlock)

Language-Specific Package Managers:

pip install requests              # Python packages
pip install -r requirements.txt   # Install from requirements file
pip install --user requests       # User-local install (no root)
python3 -m venv .venv && . .venv/bin/activate   # Isolated per-project environment; pip installs stay inside .venv

cargo install ripgrep             # Rust packages (from crates.io)
npm install -g typescript         # Node.js packages (global)
npm install --save-dev webpack    # Node.js project dependency

Update Alternatives: Manages multiple versions of the same tool (e.g., multiple Python versions):

update-alternatives --list python
update-alternatives --install /usr/bin/python python /usr/bin/python3.11 2
update-alternatives --config python          # Interactive selection

⚠️ Exam Trap: On RHEL-family systems, the package name for Apache HTTP Server is httpd, not apache2. On Debian-family systems it's apache2. The exam frequently uses "Given a scenario" questions where the distro matters for the package name. Other notable differences: firewalld vs ufw, python3 vs python3.x, /etc/sysconfig/ vs /etc/default/.

Reflection Question: You need to install a .deb package that has unmet dependencies. dpkg -i package.deb fails. What single apt command fixes the unmet dependencies without reinstalling already-installed packages?