---
title: "How to use extrepo to add third-party repositories in Debian"
tags: ['Debian', 'extrepo']
published: 2025-10-20 20:08:34
updated: 2025-10-20 22:58:16
excerpt: "Use extrepo to add third-party Debian repositories without hand-copying keys and APT source files."
---
> This file is the raw Markdown source of an m.ac post; the canonical version lives at https://m.ac/use-extrepo-add-third-party-repositories-debian/
> The full index of posts and pages is at https://m.ac/llms.txt — read the index first before crawling further.

## Introduction

### What is extrepo?

The [extrepo tool](https://packages.debian.org/stable/extrepo) manages external repositories in Debian. Before extrepo, installing software that was not packaged for Debian usually meant writing APT configuration files by hand, running an unsigned script as root, or installing an unsigned `.deb` package that dropped repository configuration onto the system.

None of those options felt great.

Take the [Docker repository](https://docs.docker.com/engine/install/debian/) as an example. Older instructions usually use one of these three methods.

The first is the traditional **one-line style**:

```bash
curl -sSL https://download.docker.com/linux/debian/gpg | sudo gpg --dearmor -o /usr/share/keyrings/docker-ce.gpg

echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/docker-ce.gpg] https://download.docker.com/linux/debian $(lsb_release -sc) stable" | sudo tee /etc/apt/sources.list.d/docker-ce.list

sudo apt update
sudo apt install docker-ce docker-ce-cli containerd.io docker-compose-plugin -y
```

The second uses the newer **DEB822** format:

```bash
curl -sSL https://download.docker.com/linux/debian/gpg | sudo gpg --dearmor -o /usr/share/keyrings/docker-ce.gpg

sudo bash -c 'cat > /etc/apt/sources.list.d/docker-ce.sources << EOF
Components: stable
Architectures: $(dpkg --print-architecture)
Suites: $(lsb_release -cs)
Types: deb
Uris: https://download.docker.com/linux/debian
Signed-By: /usr/share/keyrings/docker-ce.gpg
EOF'

sudo apt update
sudo apt install docker-ce docker-ce-cli containerd.io docker-compose-plugin -y
```

Or you can use a Linux installation script:

```bash
curl -fsSL https://get.docker.com -o get-docker.sh
sudo sh get-docker.sh
```

With the first two methods, you download the GPG key, import it into the system, create the APT source files, and update the package lists yourself. The installation script does all of that for you, but the price is piping an unaudited remote script straight into a root shell and trusting whatever it decides to run.

With *extrepo*, that work becomes a couple of commands, and the repository metadata is GPG-verified against a keyring that ships in Debian itself.

## Installing and using extrepo

The following steps require root privileges. The commands use `sudo`, so make sure your user can run it. You can also switch to root with `sudo -i` and remove the `sudo` prefix from the commands.

Install *extrepo* on Debian Stable:

```bash
sudo apt update
sudo apt install extrepo -y
```

After that, enable a third-party repository such as Docker CE:

```bash
sudo extrepo enable docker-ce
```

Once the repository is enabled, update your package lists and install Docker.

```bash
sudo apt update
sudo apt install docker-ce docker-ce-cli containerd.io docker-compose-plugin -y
```

You will now have a new file named `extrepo_docker-ce.sources` in `/etc/apt/sources.list.d`:

```bash
$ cat /etc/apt/sources.list.d/extrepo_docker-ce.sources 
Suites: trixie
Types: deb
Uris: https://download.docker.com/linux/debian
Components: stable
Architectures: amd64 arm64 armhf s390x ppc64el
Signed-By: /var/lib/extrepo/keys/docker-ce.asc
```

In other words, *extrepo* takes care of the two annoying parts:

1.  It fetches a verified GPG key.
2.  It writes the APT configuration in DEB822 format.

You no longer have to search the web for repository snippets or installation scripts. The command is shorter, and more importantly, the repository metadata has a maintainer.

## External repository metadata

The *extrepo* database is maintained by the [**Debian External Repositories Team**](https://salsa.debian.org/extrepo-team), and the database itself is called [**extrepo-data**](https://salsa.debian.org/extrepo-team/extrepo-data).

I personally maintain several third-party software sources that we use on our servers, such as [Redis](https://salsa.debian.org/extrepo-team/extrepo-data/-/commits/master/repos/debian/redis.yaml?ref_type=heads), [MariaDB](https://salsa.debian.org/extrepo-team/extrepo-data/-/commits/master/repos/debian/mariadb.yaml?ref_type=heads), and [N.WTF](https://salsa.debian.org/extrepo-team/extrepo-data/-/commits/master/repos/debian/n.wtf.yaml?ref_type=heads). You can view my commits [here](https://salsa.debian.org/showfom/extrepo-data/-/commits/master?author=Xiufeng%20Guo).

Anyone can contribute to this Git repository, and the YAML syntax is easy to learn. You can view the template [here](https://salsa.debian.org/extrepo-team/extrepo-data/-/blob/master/template.yaml?ref_type=heads).

For a complete list of third-party repositories, browse the `.yaml` files [here](https://salsa.debian.org/extrepo-team/extrepo-data/-/tree/master/repos/debian?ref_type=heads).

## Where extrepo helps

*extrepo* is a cleaner way to add third-party repositories on Debian.

Its main advantage is boring, which is exactly what you want from repository configuration: it enables tested and verified software sources without making you copy keys and source files by hand. When a third-party repository's GPG key expires or its URI changes, which happens often enough to be annoying, you do not have to update it manually.

For Docker, run `sudo extrepo enable docker-ce` once. Later, `sudo extrepo update docker-ce` refreshes the repository's GPG key and URI.

The catch: *extrepo* currently supports Debian, while Ubuntu compatibility is limited. Also, because [**extrepo-data**](https://extrepo-team.pages.debian.net/extrepo-data/) is hosted on Debian's official GitLab Pages, self-hosting it is still not especially convenient.