Package sources, repositories and PPAs

In short: A repository (package source) is a server that provides packages with an index and signature. The package manager reads its list and downloads from it.

In more detail: Distributions run official repositories and servers mirrored around the world (mirrors). Third-party sources are added.

In detail

• Debian components: main (free software), contrib, non-free, non-free-firmware. Ubuntu: main, universe, restricted, multiverse.
• Debian branches: stable, testing, unstable (sid), oldstable, backports.
• Ubuntu PPA: personal package archive at Launchpad: sudo add-apt-repository ppa:name/ppa. Practical, but use only trusted sources.
• Signature: every source has a GPG key. Without it the package manager refuses.
• Mirrors: a nearby mirror speeds up downloads (Arch: reflector).
• Risk: third-party sources can overwrite system packages and block updates.
• Local source: with a directory source or cache (apt-cacher-ng) for several machines.

See also: APT and dpkg (Debian, Ubuntu), Release models: fixed, LTS and rolling