#Introduction
##What is extrepo?
The extrepo tool manages external repositories in Debian. Before extrepo, installing software that was not packaged for Debian usually meant writing APT configuration files by hand, running an unsigned script as root, or installing an unsigned .deb package that dropped repository configuration onto the system.
None of those options felt great.
Take the Docker repository as an example. Older instructions usually use one of these three methods.
The first is the traditional one-line style:
curl -sSL https://download.docker.com/linux/debian/gpg | sudo gpg --dearmor -o /usr/share/keyrings/docker-ce.gpg
echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/docker-ce.gpg] https://download.docker.com/linux/debian $(lsb_release -sc) stable" | sudo tee /etc/apt/sources.list.d/docker-ce.list
sudo apt update
sudo apt install docker-ce docker-ce-cli containerd.io docker-compose-plugin -y
The second uses the newer DEB822 format:
curl -sSL https://download.docker.com/linux/debian/gpg | sudo gpg --dearmor -o /usr/share/keyrings/docker-ce.gpg
sudo bash -c 'cat > /etc/apt/sources.list.d/docker-ce.sources << EOF
Components: stable
Architectures: $(dpkg --print-architecture)
Suites: $(lsb_release -cs)
Types: deb
Uris: https://download.docker.com/linux/debian
Signed-By: /usr/share/keyrings/docker-ce.gpg
EOF'
sudo apt update
sudo apt install docker-ce docker-ce-cli containerd.io docker-compose-plugin -y
Or you can use a Linux installation script:
curl -fsSL https://get.docker.com -o get-docker.sh
sudo sh get-docker.sh
With the first two methods, you download the GPG key, import it into the system, create the APT source files, and update the package lists yourself. The installation script does all of that for you, but the price is piping an unaudited remote script straight into a root shell and trusting whatever it decides to run.
With extrepo, that work becomes a couple of commands, and the repository metadata is GPG-verified against a keyring that ships in Debian itself.
#Installing and using extrepo
The following steps require root privileges. The commands use sudo, so make sure your user can run it. You can also switch to root with sudo -i and remove the sudo prefix from the commands.
Install extrepo on Debian Stable:
sudo apt update
sudo apt install extrepo -y
After that, enable a third-party repository such as Docker CE:
sudo extrepo enable docker-ce
Once the repository is enabled, update your package lists and install Docker.
sudo apt update
sudo apt install docker-ce docker-ce-cli containerd.io docker-compose-plugin -y
You will now have a new file named extrepo_docker-ce.sources in /etc/apt/sources.list.d:
$ cat /etc/apt/sources.list.d/extrepo_docker-ce.sources
Suites: trixie
Types: deb
Uris: https://download.docker.com/linux/debian
Components: stable
Architectures: amd64 arm64 armhf s390x ppc64el
Signed-By: /var/lib/extrepo/keys/docker-ce.asc
In other words, extrepo takes care of the two annoying parts:
- It fetches a verified GPG key.
- It writes the APT configuration in DEB822 format.
You no longer have to search the web for repository snippets or installation scripts. The command is shorter, and more importantly, the repository metadata has a maintainer.
#External repository metadata
The extrepo database is maintained by the Debian External Repositories Team, and the database itself is called extrepo-data.
I personally maintain several third-party software sources that we use on our servers, such as Redis, MariaDB, and N.WTF. You can view my commits here.
Anyone can contribute to this Git repository, and the YAML syntax is easy to learn. You can view the template here.
For a complete list of third-party repositories, browse the .yaml files here.
#Where extrepo helps
extrepo is a cleaner way to add third-party repositories on Debian.
Its main advantage is boring, which is exactly what you want from repository configuration: it enables tested and verified software sources without making you copy keys and source files by hand. When a third-party repository's GPG key expires or its URI changes, which happens often enough to be annoying, you do not have to update it manually.
For Docker, run sudo extrepo enable docker-ce once. Later, sudo extrepo update docker-ce refreshes the repository's GPG key and URI.
The catch: extrepo currently supports Debian, while Ubuntu compatibility is limited. Also, because extrepo-data is hosted on Debian's official GitLab Pages, self-hosting it is still not especially convenient.