APT (Advanced Package Tool) installs and updates software from package repositories. On Debian 13 (Trixie), these software sources are defined in two formats: traditional one-line .list files and the newer deb822 .sources files. A fresh Trixie install uses the deb822 format by default.
Please note that a configured repository is not necessarily enabled, and an enabled repository is not necessarily working. This guide shows you how to list the enabled repositories on your Debian system, find the source files that define them, and troubleshoot a package that has no repository behind it.
Most of the steps also apply to Ubuntu, Linux Mint, and other Debian-based distributions, though default file names differ. This guide covers APT repositories only, not Flatpak remotes, Snap channels, or container registries.
Table of Contents
Quick Answer
To see the enabled APT repositories on Debian 13, 12 and older versions, run:
apt-get indextargets --format '$(REPO_URI) $(RELEASE) $(COMPONENT)' 'Created-By: Packages' | sort -u
You do not need root to run it. It prints one line per enabled repository, suite, and component.
Sample Output from Debian 13 Desktop:
https://deb.debian.org/debian/ trixie contrib
https://deb.debian.org/debian/ trixie main
https://deb.debian.org/debian/ trixie non-free
https://deb.debian.org/debian/ trixie non-free-firmware
https://deb.debian.org/debian/ trixie-updates main
https://dl.google.com/linux/chrome-stable/deb/ stable main
https://download.docker.com/linux/debian/ trixie stable
https://packages.microsoft.com/repos/edge-beta/ stable main
https://repo.protonvpn.com/debian/ stable main
https://security.debian.org/debian-security/ trixie-security main
https://security.debian.org/debian-security/ trixie-security non-free-firmware
The command reads APT's parsed configuration, so it works for both .list and .sources files. The rest of this guide explains other methods, how to read the source files, and what to do when something looks wrong.
Commands that need root: sudo apt update and sudo apt modernize-sources. Everything else here runs as a normal user.
1. List Enabled Repositories with APT
Reading files shows what is written down. APT can also tell you what it loaded, and it treats both file formats the same way.
Use apt-get indextargets
The apt-get indextargets command is the most direct way to list the enabled repositories in Debian and its derivatives like Ubuntu.
apt-get indextargets --format '$(REPO_URI) $(RELEASE) $(COMPONENT)' 'Created-By: Packages' | sort -u
Here:
Created-By: Packageslimits the output to binary (deb) package indexes. Without a filter, the output also includes entries forContentsandTranslations.sort -uremoves the duplicates that appear when a repository serves several architectures.- To list source-package (
deb-src) repositories instead, change the filter to'Created-By: Sources'.
Use apt policy
The another way to list repositories in Debian-based systems:
apt policy
Run without a package name, it prints the package sources APT currently uses, with their priorities. This is the modern form of apt-cache policy, and both work. An entry looks like this:
Package files:
100 /var/lib/dpkg/status
release a=now
.
.
.
500 https://security.debian.org/debian-security trixie-security/non-free-firmware amd64 Packages
release v=13,o=Debian,a=stable-security,n=trixie-security,l=Debian-Security,c=non-free-firmware,b=amd64
origin security.debian.org
500 https://security.debian.org/debian-security trixie-security/main amd64 Packages
release v=13,o=Debian,a=stable-security,n=trixie-security,l=Debian-Security,c=main,b=amd64
origin security.debian.org
500 https://deb.debian.org/debian trixie-updates/main amd64 Packages
release v=13-updates,o=Debian,a=stable-updates,n=trixie-updates,l=Debian,c=main,b=amd64
origin deb.debian.org
500 https://deb.debian.org/debian trixie/non-free-firmware amd64 Packages
release v=13.7,o=Debian,a=stable,n=trixie,l=Debian,c=non-free-firmware,b=amd64
origin deb.debian.org
500 https://deb.debian.org/debian trixie/non-free amd64 Packages
release v=13.7,o=Debian,a=stable,n=trixie,l=Debian,c=non-free,b=amd64
origin deb.debian.org
500 https://deb.debian.org/debian trixie/contrib amd64 Packages
release v=13.7,o=Debian,a=stable,n=trixie,l=Debian,c=contrib,b=amd64
origin deb.debian.org
500 https://deb.debian.org/debian trixie/main amd64 Packages
release v=13.7,o=Debian,a=stable,n=trixie,l=Debian,c=main,b=amd64
origin deb.debian.org
Pinned packages:
One caveat: apt policy reflects the package indexes APT has downloaded. If you just enabled or disabled a source, run sudo apt update first, or the output may not match your configuration. apt-get indextargets reads the configuration directly and doesn't have this limitation.
Note: Both commands show that a source is enabled. They do not show that its server is reachable or its signatures are valid. Section 4 covers that.
2. Find the APT Source Configuration Files
APT reads its repository list from these locations:
/etc/apt/sources.list/etc/apt/sources.list.d/*.list/etc/apt/sources.list.d/*.sources
Files in sources.list.d with any other extension are ignored. APT also ignores filenames that contain characters other than letters, digits, underscores, hyphens, and periods.
Debian 13 Defaults
A fresh Trixie install keeps its main Debian repositories in /etc/apt/sources.list.d/debian.sources. The file /etc/apt/sources.list typically contains only comments or does not exist.
If you upgraded from an earlier release, you may still have a traditional /etc/apt/sources.list. Both formats work side by side.
To convert legacy .list files to deb822, run:
sudo apt modernize-sources
The command lists the files it will convert and asks for confirmation before it changes anything. It writes the new .sources file and backs up the original, for example as /etc/apt/sources.list.bak.
More details about modernizing Apt sources in Debian can be found in the link below:
Show Non-comment Lines
grep -HvE '^[[:space:]]*(#|$)' \
/etc/apt/sources.list \
/etc/apt/sources.list.d/*.list \
/etc/apt/sources.list.d/*.sources 2>/dev/null
This prints every line that is neither blank nor a comment, prefixed with its filename. It shows what is configured, but it cannot tell you what is enabled in deb822 files, because a disabled stanza still contains non-comment lines. Use the rules in section 3, or the APT commands in section 1.
3. Interpret Enabled and Disabled Entries
Traditional .list Files
An active entry starts with deb or deb-src. A line starting with # is disabled. For example:
deb https://deb.debian.org/debian trixie main
# deb https://example.com/debian stable main
The first entry is enabled; the second is not. Entries can include options in square brackets, such as the architecture and the signing key:
deb [arch=amd64 signed-by=/usr/share/keyrings/example.gpg] https://example.com/debian stable main
To list only the active lines in .list files, run:
grep -hE '^[[:space:]]*deb(-src)?[[:space:]]' \
/etc/apt/sources.list /etc/apt/sources.list.d/*.list 2>/dev/null
This does not parse .sources files, and it does not check whether the repositories work.
Deb822 .sources Files
Deb822 files use named fields, and blank lines separate stanzas. A typical stanza looks like this:
Types: deb deb-src
URIs: https://deb.debian.org/debian
Suites: trixie trixie-updates
Components: main
Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg
Keep these rules in mind:
- A stanza is enabled by default. It is disabled only if it contains an
Enabledfield set to a false value, such asEnabled: no. Field names and values are case-insensitive, soenabled: Noalso disables a stanza. Typescan list bothdebanddeb-src. Source repositories are enabled ifdeb-srcappears there.URIs,Suites, andComponentscan each contain several space-separated values, so one stanza can define many repositories.Signed-Bycan be a path to a keyring file or an inline key block.- A file can hold several stanzas, and each one is enabled or disabled independently.
To print only the enabled stanzas from your .sources files, run:
for f in /etc/apt/sources.list.d/*.sources; do
[ -f "$f" ] || continue
printf '### %s\n' "$f"
awk -v RS= '
tolower($0) ~ /(^|\n)types:/ &&
tolower($0) !~ /(^|\n)enabled:[ \t]*(no|false|0)[ \t]*(\n|$)/ {
print $0 "\n"
}' "$f"
done
The filter prints each stanza that has a Types field and no false Enabled value. It is a convenience for reading, and the APT commands in section 1 remain the more reliable answer.
To find explicitly disabled stanzas, run:
grep -n -i 'Enabled:' /etc/apt/sources.list.d/*.sources
Check the surrounding stanza to see which repository each result belongs to.
4. Verify that Repositories Work
Run:
sudo apt update
APT tries to refresh the package indexes from every enabled source. Review the output for errors such as:
404 Not Found: the repository path or suite may be incorrect or no longer available.NO_PUBKEY: APT cannot find the public key needed to verify the repository.The repository is not signed: APT cannot verify the repository metadata as required.- Connection or DNS errors: APT cannot reach the repository server.
Read the warnings and notices too, not just the errors. They often reveal configuration problems:
Target Packages ... is configured multiple times: the same repository is defined in more than one file. Remove the duplicate.Skipping acquire of configured file ... doesn't support architecture: the repository does not provide packages for one of your configured architectures.Ignoring file ... invalid filename extension: APT skipped a file insources.list.dbecause of its name.
A clean update means APT could refresh the indexes it processed. It does not guarantee that a particular package is available.
Never fix a signature error by disabling authentication. Check the repository URL and follow the repository owner's official instructions for installing its signing key.
5. Troubleshoot a Package with No Repository
Use apt-cache policy to see which versions of a package APT can install and where they come from:
apt-cache policy firefox-esr
If the only source listed is the following, APT is showing the local package database rather than a repository:
100 /var/lib/dpkg/status
This does not automatically mean a repository is missing or broken. It means APT has no repository-backed version of that package in its current indexes.
Common causes include:
- The package was installed from a standalone
.debfile, and no repository was ever added. - The package added its own source file during installation, but that file was later removed, disabled, or renamed.
- A source entry exists but is commented out, has
Enabled: no, or points to a suite that no longer exists. - The last
apt updatefailed for that repository, so its index was never downloaded. - The package came from a repository that was removed or disabled, for example during a release upgrade.
To find every installed package that no repository currently provides, run:
apt list --installed 2>/dev/null | grep '\[installed,local\]'
Packages tagged local have no repository-backed version in APT's current indexes.
Example: Microsoft Edge Beta
Suppose Microsoft Edge Beta is installed, but apt-cache policy shows only the local version:
microsoft-edge-beta:
Installed: 145.0.3800.13-1
Candidate: 145.0.3800.13-1
Version table:
*** 145.0.3800.13-1 100
100 /var/lib/dpkg/status
Vendor packages such as Edge and Chrome are often installed from a downloaded .deb. Many of them add their own APT source during installation, though behavior varies by vendor and version. If that source file is missing or disabled, you get exactly this output.
Step 1: Find the existing source entry.
grep -RniE 'microsoft|edge' \
/etc/apt/sources.list /etc/apt/sources.list.d/ 2>/dev/null
Inspect the results carefully. A filename containing edge does not prove that it contains an active Edge repository. For example, a file might hold only this commented line:
#deb [arch=amd64] https://dl.google.com/linux/chrome/deb/ stable main
That entry is disabled, and it points to Google Chrome rather than Microsoft Edge.
Step 2: Verify the repository and signing key.
If no active Edge Beta entry exists, consult Microsoft's current official Linux installation instructions before adding one. Verify the exact repository URL, suite, architecture, and signing-key instructions.
If an existing entry refers to a missing keyring file, correct the path or install the key as those instructions describe. Do not guess a key filename or bypass signature verification.
Step 3: Refresh APT and recheck.
sudo apt update
apt-cache policy microsoft-edge-beta
Review the update output for repository and signature errors, then check whether a repository-backed version is listed. If only /var/lib/dpkg/status appears, APT still has no repository for that package.
Please note that an installed application does not prove that its repository is enabled or working. Verify the source entry, refresh the indexes, and inspect the policy output.
6. Quick Reference
| Task | Command |
|---|---|
| List enabled repositories (any format) | apt-get indextargets --format '$(REPO_URI) $(RELEASE) $(COMPONENT)' 'Created-By: Packages' \| sort -u |
| List all package sources APT has loaded | apt policy |
| Show non-comment lines in all source files | grep -HvE '^[[:space:]]*(#\|$)' /etc/apt/sources.list /etc/apt/sources.list.d/*.list /etc/apt/sources.list.d/*.sources 2>/dev/null |
Show active lines in .list files only | grep -hE '^[[:space:]]*deb(-src)?[[:space:]]' /etc/apt/sources.list /etc/apt/sources.list.d/*.list 2>/dev/null |
| Find disabled deb822 stanzas | grep -n -i 'Enabled:' /etc/apt/sources.list.d/*.sources |
Convert legacy .list files to deb822 | sudo apt modernize-sources |
| Check access and refresh indexes | sudo apt update |
| Check where a package comes from | apt-cache policy PACKAGE_NAME |
| Find installed packages with no repository | apt list --installed 2>/dev/null \| grep '\[installed,local\]' |
Conclusion
To list the enabled repositories on Debian 13, start with apt-get indextargets or apt policy. Both report what APT actually loaded from your .list and .sources files, which is more reliable than reading the files yourself. Use /etc/apt/sources.list and the files in /etc/apt/sources.list.d/ to find where each package source is defined, and apply the right enabling rules for each format.
Then run sudo apt update and read both the errors and the warnings. If a specific package has no repository-backed version, check its source file, its signing key, and whether it was installed from a standalone .deb. If you still have legacy .list files, consider running sudo apt modernize-sources so your APT repository list uses one consistent format.
Recommended Read:
