How to use extrepo to add third-party repositories in Debian

Introduction

What is extrepo?

The extrepo tool is used to manage external repositories in Debian. Before extrepo, users who wished to use software not packaged for Debian had to manually write the apt configuration files, run an unsigned script as root, or install an unsigned .deb package that contained all the configuration on their system.

None of these methods were very secure.

For example, when adding the Docker repository, there are typically three methods available.

The first is the traditional One-Line Style:

curl -sSL https://download.docker.com/linux/debian/gpg | sudo gpg --dearmor > /usr/share/keyrings/docker-ce.gpg

echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/docker-ce.gpg] https://download.docker.com/linux/debian $(lsb_release -sc) stable" | sudo bash -c 'cat > /etc/apt/sources.list.d/docker-ce.list'

sudo apt update
sudo install docker-ce docker-ce-cli containerd.io docker-compose-plugin -y

And the second uses the newer DEB822 format:

curl -sSL https://download.docker.com/linux/debian/gpg | sudo gpg --dearmor > /usr/share/keyrings/docker-ce.gpg

sudo bash -c 'cat > /etc/apt/sources.list.d/docker-ce.sources << EOF
Components: stable
Architectures: $(dpkg --print-architecture)
Suites: $(lsb_release -cs)
Types: deb
Uris: https://download.docker.com/linux/debian
Signed-By: /usr/share/keyrings/docker-ce.gpg
EOF'

sudo apt update
sudo apt install docker-ce docker-ce-cli containerd.io docker-compose-plugin -y

Or, you can also use a Linux installation script:

curl -fsSL https://get.docker.com -o get-docker.sh
sh get-docker.sh

In all three methods (including the installation script), we need to manually download the GPG key, import it into the system, create the necessary APT configuration files, and then update the package lists.

With extrepo, the entire process can be completed with just a few simple commands.

Installing and Using extrepo

Installing extrepo on Debian Stable is straightforward, simply run the following commands:

sudo apt update
sudo apt install extrepo -y

After that, you can add a third‑party repository such as Docker CE:

sudo extrepo enable docker-ce

Once the repository has been added, update your system and install the Docker package.

sudo apt update
sudo apt install docker-ce docker-ce-cli containerd.io docker-compose-plugin -y

You’ll notice that a new file named extrepo_docker-ce.sources has appeared in the /etc/apt/sources.list.d directory:

$ cat /etc/apt/sources.list.d/extrepo_docker-ce.sources 
Suites: trixie
Types: deb
Uris: https://download.docker.com/linux/debian
Components: stable
Architectures: amd64 arm64 armhf s390x ppc64el
Signed-By: /var/lib/extrepo/keys/docker-ce.asc

In other words, extrepo takes care of the following tasks for us:

1. Fetches a verified GPG key
2. Writes the APT configuration in the DEB822 format

Compared with the previous methods, you no longer have to search all over the web for configuration or installation scripts. Now, you can get everything done with just a few simple commands, why not give it a try?

External Repository Metadata

You might be wondering who maintains the extrepo database. It is maintained by the Debian External Repositories Team, and the database itself is called extrepo-data.

I personally maintain several third-party software sources that we use on our servers, such as Redis, MariaDB, and N.WTF. You can view my commits here.

Anyone can contribute to this Git repository, and the YAML syntax is easy to learn. You can view the template here.

For a complete list of third‑party repositories, you can browse all the .yaml files here.

Conclusion

In conclusion, using extrepo is both a safe and convenient way to add third‑party repositories.

Its main advantage is that it allows you to quickly enable tested and verified software sources without the hassle of manually searching for and copying repository information. In addition, when a third‑party repository’s GPG key expires or URI changes, which happens quite often, there is no longer a need to update it manually.

With extrepo, simply run extrepo enable docker-ce and extrepo update docker-ce, it will automatically refresh the Docker repository’s GPG key and URI.

However, extrepo currently supports only Debian, and its compatibility with Ubuntu remains limited. Furthermore, because extrepo‑data is hosted on Debian’s official GitLab Pages, self‑hosting options are still not very convenient.