Debian apt¶

ID: apt
Links: Home page · Documentation · Repository · Wikipedia
Upstream stars: ⭐ 67
Last commit: 2026-09-24
Version requirement: >= 1
Platforms: 🅱️ BSD · 🐧 Linux · ⨂ Unix
Operations: installed · outdated · orphans · search · install · upgrade · upgrade_all · remove · sync · cleanup · doctor
purl types: pkg:apt/ · pkg:deb/
CLI name: apt
Every call: apt --quiet <command>
Issues and PRs: 📦 manager: dpkg-based
Source: apt.py

Base class for Debian’s apt front-end and its variants.

Command equivalences with other managers are listed in Pacman/Rosetta.

mpm drives the high-level apt binary, not apt-get or apt-cache, over system-wide packages. Mutations escalate through sudo and force --yes to stay non-interactive. APT_Mint retargets Linux Mint’s same-named but differently-behaved apt.

What `mpm` adds to `apt`¶

mpm reaches across every manager at once, not apt alone: mpm installed and mpm outdated cover apt alongside apt-mint, aptitude, nala and any other manager you run in one table, mpm upgrade --all updates them together, and mpm sbom exports the whole machine as one bill of materials.

Every mpm command also gains --dry-run and --plan previews, cross-scheme version comparison and purl identifiers. See manager augmentations for how each one is built.

Your `apt` commands, in `mpm`¶

You already know apt: each operation maps one-to-one onto mpm, in an interface shared by every manager.

To…	With `apt`	With `mpm`
List what’s installed	`apt list --installed`	`mpm --apt installed`
List outdated packages	`apt list --upgradable`	`mpm --apt outdated`
Search for a package	`apt search abc --names-only`	`mpm --apt search abc`
Install a package	`sudo apt --yes install git`	`mpm install pkg:apt/git`
Upgrade one package	`sudo apt --yes install --only-upgrade git`	`mpm --apt upgrade <pkg>`
Upgrade everything	`sudo apt --yes upgrade`	`mpm --apt upgrade --all`
Remove a package	`sudo apt --yes remove git`	`mpm remove pkg:apt/git`
List orphaned dependencies	`apt autoremove --simulate`	`mpm --apt orphans`
Clear caches	`sudo apt --yes clean`	`mpm --apt cleanup --cache`
Run health checks	`apt-get check`	`mpm --apt doctor`

Prefix any command above with --dry-run to simulate the underlying manager calls without touching the system: the safe way to watch what mpm would do before trusting it.

Operations¶

Operation	Supported	Notes
`installed`	✅
`outdated`	✅
`orphans`	✅
`search`	✅
`install`	✅	A package already installed as a dependency is marked explicit by `mpm`.
`upgrade`	✅
`upgrade_all`	✅
`remove`	✅	The `--orphans` flag also drops the package’s orphaned dependencies.
`sync`	✅
`cleanup`	✅	The `--orphans` flag runs the system-wide orphan sweep.
`doctor`	✅

Configuration¶

Ignore apt on the mpm CLI by passing the --no-apt option.
Ignore it for every run in your configuration:
```
[mpm]
apt = false
```
Raise the timeout of all apt calls:
```
[mpm.overrides.apt]
timeout = 900
```

Run mpm config-template apt to print all overridable settings for your configuration file:

[mpm.overrides.apt]
cli_names = [
    "apt",
]
cli_search_path = []
dry_run = false
ignore_auto_updates = true
plan = false
post_args = []
pre_args = [
    "--quiet",
]
pre_cmds = []
requirement = ">=1.0.0"
stop_on_error = false
unmaintained = false
version_cli_options = [
    "--version",
]
version_regexes = [
    "apt\\s+(?P<version>\\S+)",
]

The arguments and environment variables listed in the box atop this page are forced on every apt call, so runs stay quiet, non-interactive and reproducible: the defaults you would set in CI anyway.

Recipes¶

A few jobs you would otherwise script around apt, one mpm command each:

Snapshot and clone a machine: mpm --apt dump apt.toml, then mpm restore apt.toml on the next one.
Export a compliance SBOM: mpm --apt sbom (CycloneDX by default, --spdx for SPDX).
Gate CI on health: mpm --apt doctor relays Debian apt’s own diagnosis and exits non-zero on trouble.

Privilege escalation¶

System-wide manager: mpm wraps its privileged operations in sudo out of the box. Instead of letting the tool prompt mid-run, mpm primes the credential cache up-front, with a single branded password prompt at most. Turn escalation off for rootless setups with --no-sudo or the per-manager sudo override.

Its privileged operations are cleanup, install, remove, sync, upgrade, upgrade_all.

See privilege escalation for the full policy.

Concurrency¶

mpm never runs apt at the same time as apt-mint, aptitude, deb-get, nala or pacstall: they all install through dpkg and serialize on its /var/lib/dpkg/lock. Each mutating operation waits for the previous one, even with a higher --jobs, while managers outside this group keep running in parallel.

Only mutations are held back. The read-only queries (installed, outdated, search) take no backend lock and stay fully concurrent.

Cooldown¶

State of Debian apt’s release-age gating, from the cooldown support table:

Status: ➖ N/A (Debian’s unstable → testing → stable migration is functionally similar)
Reference: Nesbitt, Package managers need to cool down

A cooldown only pays off where a compromised release can be withdrawn while the clock runs, and can only be emulated where the registry dates its releases. From the retraction table:

Registry: Distro binary archives (pkg:deb, pkg:rpm, pkg:alpm, pkg:apk)
Retraction: Index revert: removal is an archive operation and the mirror is rebuilt without the package. Debian, for one, requires filing an RM: bug against ftp.debian.org (developers-reference)
Publish date: ❌ the version string is the distro maintainer’s build, carrying no upstream publication date

With --cooldown set, mpm skips this manager’s install and upgrade operations rather than run them unguarded (fail-closed); --cooldown best-effort opts back in.

Reference traces¶

A collection of raw native outputs captured from the manager’s own CLI and recorded in the manager source. If you know Debian apt well and a transcript below looks wrong, or a newer release changed its output format, report it.

$ apt --quiet list --installed
Listing...
adduser/xenial,now 3.113+nmu3ubuntu4 all [installed]
bc/xenial,now 1.06.95-9build1 amd64 [installed]
bsdmainutils/xenial,now 9.0.6ubuntu3 amd64 [installed,automatic]
ca-certificates/xenial,now 20160104ubuntu1 all [installed]
cron/xenial,now 3.0pl1-128ubuntu2 amd64 [installed]
debconf/xenial,now 1.5.58ubuntu1 all [installed]
debianutils/xenial,now 4.7 amd64 [installed]
diffutils/xenial,now 1:3.3-3 amd64 [installed]
e2fsprogs/xenial,now 1.42.13-1ubuntu1 amd64 [installed]
ethstatus/xenial,now 0.4.3ubuntu2 amd64 [installed]
file/xenial,now 1:5.25-2ubuntu1 amd64 [installed]
findutils/xenial,now 4.6.0+git+20160126-2 amd64 [installed]
libidn2-0/jammy,now 2.3.2-2build1 amd64 [installed,automatic]
libidn2-0/jammy,now 2.3.2-2build1 i386 [installed,automatic]

$ apt --quiet list --upgradable
Listing...
apt/xenial-updates 1.2.19 amd64 [upgradable from: 1.2.15ubuntu0.2]
nano/xenial-updates 2.5.3-2ubuntu2 amd64 [upgradable from: 2.5.3-2]

$ apt --quiet autoremove --simulate
NOTE: This is only a simulation!
      apt needs root privileges for real execution.
      Keep also in mind that locking is deactivated,
      so don't depend on the relevance to the real current situation!
Reading package lists...
Building dependency tree...
Reading state information...
The following packages will be REMOVED:
  libx11-dev libxcb1-dev
0 upgraded, 0 newly installed, 2 to remove and 0 not upgraded.
Remv libx11-dev [2:1.8.7-1]
Remv libxcb1-dev [1.15-1]

Version check¶

The version is probed by running:

$ apt --version
apt 2.0.6 (amd64)

and extracted with:

r"apt\s+(?P<version>\S+)"

Upstream project¶

Metrics	`apt-team/apt`
Activity
Popularity
Metadata

Changelog¶

8.0.0 (2026-09-20)
- Mark a package already installed as a dependency as explicitly installed when mpm install or mpm restore names it, so mpm cleanup --orphans keeps it.
7.4.0 (2026-07-25)
- Plain cleanup no longer removes orphaned packages: their native sweeps moved behind cleanup --orphans. This also stops emerge’s cleanup from triggering its pre-depclean world upgrade unless --orphans is given.
6.4.0 (2026-04-27)
- Add remove operation. Closes #1775.
5.18.0 (2024-08-02)
- Add architecture in package metadata.
5.13.1 (2023-05-06)
- Fix omission of the final result in an apt (non-mint) search.
5.13.0 (2023-04-04)
- Fix parsing of search results for apt and apt-mint. Closes #881 and #966.
5.0.1 (2022-04-28)
- Fix commands incompatible with --yes option. Closes #625.
4.13.1 (2022-04-17)
- Add missing sudo pre-commands for apt calls that requires it. Closes #496 and #579.
4.4.0 (2021-09-27)
- Add dedicated apt-mint manager to handle the special case of apt on Linux Mint.
3.0.0 (2020-03-25)
- Fallback on apt version apt when looking for version. Closes #57 and #52.
2.6.0 (2017-09-10)
- Add support for apt on Linux systems.