184

On a Debian-based system, including Ubuntu, how can one tell which repository a package will be downloaded from, without actually beginning the download? aptitude show and apt-cache info will show the section (e.g., metapackage, base, graphics), but not the repository to which a package belongs (e.g., http://ppa.launchpad.net/mactel-support/ppa/ubuntu or http://us.archive.ubuntu.com/ubuntu/).

When installing the package, the actual repository appears during the download (it is printed out in the "downloading from ..." output from apt and similar programs), but how can one obtain information on the repository containing the package (or a specific version of a package) without downloading and installing it first?

Additionally, how can one determine the source repository for a package that is already installed?

1
  • 1
    i find this one of the deficiencies of Apt; it's just not easy to tell from which repository provides a certain package within the package installer tools. Feb 9, 2010 at 19:52

6 Answers 6

220

I run apt-cache policy <package name>:

$ apt-cache policy wajig
wajig:
  Installed: 2.1
  Candidate: 2.1
  Version table:
 *** 2.1 0
        100 /var/lib/dpkg/status
     2.0.47 0
        500 file:/home/wena/.repo_bin/ squeeze/main i386 Packages
        500 ftp://ftp.is.co.za/debian/ squeeze/main i386 Packages

That means that there are three wajig packages:

  • One that is installed (/var/lib/dpkg/status)

  • One that is available from a local repository (file:/home/wena/.repo_bin/)

  • One that is available from a remote repository (ftp://ftp.is.co.za/debian), which also happens to have the same version (2.0.47) as the one in a local repository


Additionally, apt-cache madison <package name> will display similar information in a tabular format.

 wajig |        2.2 | mirror://mirrors.ubuntu.com/mirrors.txt/ precise/universe amd64 Packages
 wajig |        2.2 | mirror://mirrors.ubuntu.com/mirrors.txt/ precise/universe Sources
5
  • But it doesn't show where the installed package came from, does it?
    – Adobe
    Apr 27, 2012 at 11:16
  • 2
    @Adobe In my case, the 2.1 version isn't available from any repository. It's locally-built.
    – tshepang
    Apr 29, 2012 at 9:26
  • 2
    What is sign of installed package? *** or /var/lib/dpkg/status ?
    – SuB
    Sep 19, 2013 at 17:39
  • Maybe both? Not sure.
    – tshepang
    Sep 19, 2013 at 20:24
  • When the package is not installed, apt-cache policy says: Installed: (none). Jul 19, 2018 at 20:16
29

Aha! Apparently, the proper apt command is not apt-cache info, but instead, apt-cache showpkg.

$ apt-cache showpkg linux-generic
Package: linux-generic
Versions: 
2.6.31.19.32 (/var/lib/apt/lists/us.archive.ubuntu.com_ubuntu_dists_karmic-updates_main_binary-amd64_Packages) (/var/lib/apt/lists/security.ubuntu.com_ubuntu_dists_karmic-security_main_binary-amd64_Packages) (/var/lib/dpkg/status)
 Description Language: 
                 File: /var/lib/apt/lists/us.archive.ubuntu.com_ubuntu_dists_karmic-updates_main_binary-amd64_Packages
                  MD5: 5d722da329763b9342d322f5a140005c

2.6.31.14.27 (/var/lib/apt/lists/us.archive.ubuntu.com_ubuntu_dists_karmic_main_binary-amd64_Packages)
 Description Language: 
                 File: /var/lib/apt/lists/us.archive.ubuntu.com_ubuntu_dists_karmic_main_binary-amd64_Packages
                  MD5: 5d722da329763b9342d322f5a140005c


Reverse Depends: 
Dependencies: 
2.6.31.19.32 - linux-image-generic (5 2.6.31.19.32) 
2.6.31.14.27 - linux-image-generic (5 2.6.31.14.27) 
Provides: 
2.6.31.19.32 - 
2.6.31.14.27 - 
Reverse Provides: 

The File: line provides the repository information after the /var/lib/apt/lists/.

There is a bug report that aptitude cannot display the source repository, but it seems at present the feature is still on the wish list.

1
  • 1
    That aptitude feature is still on whislist 8 years later and I don't know why this answer (apt-cache showpkg) is not marked as the correct one.
    – Csaba Toth
    Mar 24, 2018 at 18:20
10

I wonder why no one mentioned aptitude. I use it all the time.

Aptitude is:

  • Shipped by default with many Debian-based distributions. Can be installed to other (such as Ubuntu) via sudo apt install aptitude.

  • Does not require administrative privileges (at least for the command below).

  • Does have a nice ncurses GUI (but most of the time used without it).

  • Provides a really pretty output. To show versions of packages, use aptitude versions command:

     me@wheezy:~$ aptitude versions kde-standard
     Package kde-standard:                        
     i A 5:77+deb7u1     stable              500
     p A 5:84            testing,unstable    130
    
  • Does NOT have Super Cow Powers.

The letter in front of each string indicates the package's status, i is installed and p is purged (or never installed), stable, testing and unstable are repository definitions, the number in the end is a pin priority.

One caveat regarding recent versions of aptitude worth a mentioning here: by default it shows all the packages, which include the name you search, so use a regex magic a little to search by the strict name, for example aptitude versions ^kde-workspace$.

4
  • 1
    Nice command but it doesn't list the repository as requested.
    – bjhend
    Mar 15, 2017 at 11:56
  • Actually it does. Mar 15, 2017 at 14:23
  • You don't understand. Additional PPAs can be installed. It is important to know whether a package is from such a PPA. As a matter of fact, that's what I'm trying to figure out right now - if it is, I can remove the PPA, reducing the risk of problems. May 25, 2017 at 17:46
  • Yes, you're right, with versions you can simply check the apt pinning values of the given packages, not the associated repos. It is still useful though if you know all your repos and how they are pinned. Dec 4, 2017 at 11:10
8

This works for me (shows where the 2vcard package is):

$ grep 2vcard /var/lib/apt/lists/* | grep "Filename:"

/var/lib/apt/lists/us.archive.ubuntu.com_ubuntu_dists_karmic_universe_binary-i386_Packages:Filename: pool/universe/2/2vcard/2vcard_0.5-3_all.deb

You can apply additional filtering to check versions, etc., if multiple versions are available.

2
6

Sadly, this information is not recorded during package installation. You can make a decent guess if the repository is still in the source list and the repository still has the package:

grep -l PKG /var/lib/apt/lists/*

apt-cache showpkg is showing data from the repository database (not what is installed) so it's another form of the same information from the grep.

Even synaptic cannot tell (in the Origin screen) if you disable the repository and update.

1
  • fwiw (a decade later), in my case, I was trying to tell if a package was installed via a repo or deb file, which this approach would (obviously) not consider; however, the simple command apt-cache policy {package} does work as expected in both these cases to identify the source of the package. superuser.com/a/236605/73961
    – michael
    Feb 1, 2020 at 5:27
2

Or, inspired by Sunny you can try:

# list installed restricted packages
for i in `dpkg --get-selections | awk '{ print $1 }'`; do egrep -lRI "^Filename: .*/${i}_[^/]+.deb" /var/lib/apt/lists/ | grep -q 'restricted' && echo $i; done

# list installed multiverse packages
for i in `dpkg --get-selections | awk '{ print $1 }'`; do egrep -lRI "^Filename: .*/${i}_[^/]+.deb" /var/lib/apt/lists/ | grep -q 'multiverse' && echo $i; done

ps. not 100% accurate.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .