Debian sources.list: Repository Lines for Debian 13 and 12

Applies to: Debian 13 trixie (13.7, apt 3.0.3) and Debian 12 bookworm (12.15, apt 2.6.1)

Debian's package sources live in two places. Newer systems use /etc/apt/sources.list.d/debian.sources (the deb822 format, the one Debian 13 recommends); older and upgraded systems often still use /etc/apt/sources.list (one line per repository). apt reads both, plus every .list and .sources file in /etc/apt/sources.list.d/. The standard repository lines for Debian 13 are:

Types: deb
URIs: http://deb.debian.org/debian
Suites: trixie trixie-updates
Components: main contrib non-free non-free-firmware
Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg

Types: deb
URIs: http://security.debian.org/debian-security
Suites: trixie-security
Components: main contrib non-free non-free-firmware
Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg

For Debian 12, use the same lines with bookworm, bookworm-updates and bookworm-security (one-line version further down). Leave out contrib non-free if you only want free software; keep non-free-firmware if the machine needs firmware for network cards or other hardware.

Where is the sources list on Debian?

Check which files exist on your server before you edit anything:

ls -l /etc/apt/sources.list /etc/apt/sources.list.d/

On the Debian 13 and 12 container images we tested, /etc/apt/sources.list did not exist and the repositories were in sources.list.d/debian.sources. A server installed or upgraded another way may have only sources.list, or both. To see every repository line apt will use, in either format:

$ grep -rhE '^(deb|URIs|Suites|Components)' /etc/apt/sources.list /etc/apt/sources.list.d/ 2>/dev/null
URIs: http://deb.debian.org/debian/
Suites: trixie
Components: main contrib non-free non-free-firmware
...

apt policy lists the repositories apt has actually loaded, each with its priority, after apt update.

Set the standard repositories on Debian 13

1. Back up what is there:

   cp -a /etc/apt/sources.list.d/debian.sources /root/debian.sources.bak

   (also copy /etc/apt/sources.list if it exists).
2. Write the lines from the top of this article into /etc/apt/sources.list.d/debian.sources with an editor such as nano. Each block is one repository; blocks are separated by an empty line.
3. If /etc/apt/sources.list holds the same repositories, empty it or move it away, otherwise apt warns about duplicates (see below).
4. Reload the package lists:

   $ apt-get update
   Get:2 http://deb.debian.org/debian trixie InRelease [140 kB]
   Get:3 http://deb.debian.org/debian trixie-updates InRelease [47.3 kB]
   Get:7 http://security.debian.org/debian-security trixie-security/main amd64 Packages [265 kB]
   Get:10 http://deb.debian.org/debian trixie/non-free-firmware amd64 Packages [6884 B]
   ...
   Reading package lists...

   (lab example, shortened). No E: or W: lines means every repository worked.

What the fields mean: URIs is the mirror (deb.debian.org holds no packages itself, it points apt to Debian's content delivery network), Suites are the release and its update channels, Components are the archive areas, and Signed-By is the key apt uses to check the repository. Add deb-src to Types: (Types: deb deb-src) only if you download source packages.

http or https? Debian's own container images use http://; apt still checks every download against the signed release files. Debian's release notes use https://, which also works, but only when the ca-certificates package is installed. Without it, our test failed with "SSL connection failed: ... certificate verify failed".

The same in the one-line format (sources.list)

This is the classic /etc/apt/sources.list format. Debian 13 still accepts it: apt 3.0.3 read it without any warning in our test. For Debian 12, these are the lines:

deb http://deb.debian.org/debian bookworm main contrib non-free non-free-firmware
deb http://deb.debian.org/debian bookworm-updates main contrib non-free non-free-firmware
deb http://security.debian.org/debian-security bookworm-security main contrib non-free non-free-firmware

For Debian 13, replace bookworm with trixie in all three lines. Debian 12 is now in its long-term support (LTS) phase. According to Debian, LTS updates arrive through the same bookworm-security line, so nothing needs to change.

What main, contrib, non-free and non-free-firmware mean

• main: free software (DFSG-compliant) that depends only on other free software. Everything you need for a typical server is here.
• contrib: free software that depends on something non-free.
• non-free: software that does not meet Debian's free software guidelines.
• non-free-firmware: non-free firmware for hardware such as network cards. It has been a separate component since Debian 12.

Add backports

Backports are newer versions of some packages rebuilt for the stable release. Put them in their own block or file, for example /etc/apt/sources.list.d/backports.sources:

Types: deb
URIs: http://deb.debian.org/debian
Suites: trixie-backports
Components: main contrib non-free non-free-firmware
Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg

apt gives backports priority 100, lower than the 500 of the normal repositories, so packages you already use are not switched to backports versions by apt upgrade. In our test the kernel from backports was listed, but the normal version stayed the candidate:

$ apt-cache policy linux-image-amd64
linux-image-amd64:
  Installed: (none)
  Candidate: 6.12.111-1
  Version table:
     7.2.6-1~bpo13+1 100
        100 http://deb.debian.org/debian trixie-backports/main amd64 Packages
     6.12.111-1 500
        500 http://security.debian.org/debian-security trixie-security/main amd64 Packages

Install from backports on purpose with apt install -t trixie-backports PACKAGE. On Debian 12 the suite is bookworm-backports.

Convert sources.list to debian.sources

On Debian 13, apt converts the old format for you. It saves the original as sources.list.bak:

$ apt modernize-sources --assume-yes
The following files need modernizing:
  - /etc/apt/sources.list
...
Rewrite 1 sources? [Y/n] Y
Modernizing /etc/apt/sources.list...
- Writing /etc/apt/sources.list.d/debian.sources
- Writing /etc/apt/sources.list.d/debian-backports.sources
Warning: Could not determine Signed-By for URIs: http://deb.debian.org/debian/, Suites: trixie-backports

Without --assume-yes it asks before writing. Run apt modernize-sources --assume-no first to see the result without writing anything. As the warning shows, in our test the backports file got an empty Signed-By: line; add /usr/share/keyrings/debian-archive-keyring.gpg there yourself. On Debian 12 (apt 2.6.1) the command does not exist: "E: Invalid operation modernize-sources".

Common errors

• "W: Target Packages (main/binary-amd64/Packages) is configured multiple times in /etc/apt/sources.list:1 and /etc/apt/sources.list.d/debian.sources:1": the same repository is in both files. Remove it from one of them.
• "E: The repository 'http://deb.debian.org/debian trixy Release' does not have a Release file.": a typo in the suite name (here "trixy"), or a release so old that it has left the normal mirrors. Debian 10 and older are only on archive.debian.org.
• Use codenames, not "stable": a line with stable follows whichever release is currently stable, so when a new Debian version comes out, your next update starts moving the server to it without any planning, as the Debian wiki warns. Write trixie or bookworm and upgrade when you choose to (see how to upgrade from Debian 12 to 13).
• Third-party repositories (Docker, PHP, Node.js and so on) belong in their own file in sources.list.d/ with their own key, not in debian.sources. How to add an APT repository shows how.

Related articles: Debian 13 trixie and upgrading from Debian 12, how to add an APT repository without add-apt-repository, repositories on Ubuntu (ubuntu.sources and PPAs), how to install a specific package version with apt.

Official documentation: Debian wiki: SourcesList, Debian releases.