How to Configure sources.list on Debian 9

configure debain sourcelist

This is a brief  on how to configure sources.list file on Debian 9, codenamed stretch. Debian is one of the, most popular Linux distributions and much of its strength comes from the core of Debian package management - apt. Everything in Debian, be it an application or any other component - is built into a package, and then that package is installed onto your system (either by the Installer or by you).

Understanding APT and sources.list

The package manager for Debian and its derivatives is apt. APT which stands for Advanced Package Tool is a set of tools for managing Debian packages, and therefore the applications installed on your Debian system. APT makes it possible to:

  • Install applications
  • Remove applications
  • Update applications
  • Fix broken packages e.t.c

Read Also : How to Install Debian Packages Offline

APT is capable of resolving dependency problems and retrieving requested packages from designated package repositories. It delegates the actual installation and removal of packages to dpkg. APT is primarily used by command-line tools, but there are GUI tools available which you can use.

The file /etc/apt/sources.list in Debian is used by Apt as part of its operation. This file contains a list of the 'sources' from which packages can be obtained. The entries in this file normally follow this format.

deb distribution component1 component2 component3
deb-src distribution component1 component2 component3

The entries shown above are fictitious and should not be used. Below are the contents of this file when split into different sections:

Archive type:

The first entry on each line -  deb or deb-src represent the type of archive.

  • deb means the URL provided contain pre-compiled packages. These are the packages installed by default when using package managers like apt-get or aptitude.
  • deb-src indicate sources packages with Debian control file (.dsc) and the diff.gz containing the changes needed for packaging the program.

Repository URL:

The next entry on the line is a URL to the repository where the packages will be downloaded from. You can find the main list of Debian repository packages from Debian Worldwide sources.list mirrors.


The 'distribution' can be either the release code name / alias (jessie, stretch, buster, sid) or the release class (old stable, stable, testing, unstable) respectively. If you mean to be tracking a release class then use the class name, if you want to track a Debian point release, use the code name.


There are normally three components which can be used on Debian, namely:

  • main - This contains packages that are part of Debian distribution. These packages are DFSG compliant.
  • contrib -The packages here are DFSG compliant but contains packages which are not in the main repository.
  • non-free - This contains software packages which do not comply with the DFSG.

Complete sources.list file on Debian 9 will look something like below:

deb stretch main
deb-src stretch main

deb stretch-updates main
deb-src stretch-updates main

deb stretch/updates main
deb-src stretch/updates main

Then to have the contrib and non-free components, add contrib non-free after main as shown below:

deb stretch main contrib non-free
deb-src stretch main contrib non-free

deb stretch-updates main contrib non-free
deb-src stretch-updates main contrib non-free

deb stretch/updates main contrib non-free
deb-src stretch/updates main contrib non-free

Once you have made changes to the sources.list file, you have to run the command:

$ sudo apt-get update

This will ensure your apt index is synchronized. Then you can install new packages from the repository.

Adding custom repositories

It is not always advisable to add custom and third-party repositories on the file /etc/apt/sources.list. Instead you can create a file under the /etc/apt/sources.list.d directory. For example, to install docker on Debian 9 from its upstream repository, you'll do:

$ sudo vim /etc/apt/sources.list

Add the content:

deb debian-stretch main

You can then proceed to update apt-cache and install docker package from it. This is a recommended way to add any other third party repositories.

Importing apt keys

When working with apt and sources.list repositories, at some point you are required to import gpg keys. This is usually done using the command apt-key, whose syntax is.

# apt-key adv --keyserver  <server-address>--recv-keys  <key-id>

As an example, to download docker repository gpg keys, you'll run:

# apt-key adv --keyserver hkp:// --recv-keys 58118E89F3A912897C070ADBF76221572C52609D


# apt-get update &&  apt-get install docker-engine

In general, working with sources.list file is relatively easy. The only thing you have to be keen on is putting the right Distribution. If on stable installation you add a sid repository with unstable packages, you may end up breaking your system or encountering many unresolved dependencies.

5 Comments... add one

  1. Hi, since 2 weeks I have the following problem when i try to update my debian system:

    INFO: pum is called with arguments: ['--list', '--repo-info', '--json'] 2018-07-26 10:06:00 ERROR: W:GPG error: production InRelease: The following signatures were invalid: DED6B1C40DEF61E82E1B39352D7DBF9D404D2E7A, E:The repository ' production InRelease' is not signed. 2018-07-26 10:06:00 ERROR: Exited with returncode 1.

    I'm sure that i have to update GPG key for the repository.
    How can i resolve this?


Leave a Comment