Package Management and Software Installation

What Is a Package Manager?

On Ubuntu and other Debian-based Linux distributions, software is distributed in packages — compressed archives that contain program files, configuration templates, and metadata about dependencies. Rather than downloading and compiling source code by hand, you use a package manager to fetch, install, upgrade, and remove software in a controlled, repeatable way.

Ubuntu ships with two closely related tools:

• apt (Advanced Package Tool) — the high-level front end you use most often at the command line. It resolves dependencies automatically and pulls packages from configured repositories.
• dpkg — the low-level back end that actually unpacks and registers packages. You call dpkg directly when you need to inspect installed packages, install a local `.deb` file, or audit package state.

Repositories and Sources

A repository (or repo) is a server that hosts packages signed with a cryptographic key. Ubuntu ships with official repos that cover thousands of packages. When you run `sudo apt update`, apt downloads the current package index from every configured repository so it knows what versions are available.

Third-party software — such as a current release of Node.js — is often published in a Personal Package Archive (PPA) or a vendor-maintained repo. Before adding any external repo, verify the publisher's identity and check the signing key. Adding an untrusted repo is a security risk because it could supply malicious packages with root privileges during installation.

To add the NodeSource repository and install a specific Node.js version:

```bash

curl -fsSL https://deb.nodesource.com/setup_20.x | sudo -E bash -

sudo apt install -y nodejs

```

The setup script adds the repo and its signing key. Always read such scripts before running them with elevated privileges.

Core apt Commands

| Task | Command |

|---|---|

| Refresh package index | `sudo apt update` |

| Install a package | `sudo apt install package-name` |

| Upgrade all packages | `sudo apt upgrade` |

| Remove package (keep config) | `sudo apt remove package-name` |

| Remove package and config files | `sudo apt purge package-name` |

| Remove unused dependencies | `sudo apt autoremove` |

| Search for a package | `apt search keyword` |

| Show package details | `apt show package-name` |

Always run `sudo apt update` before installing or upgrading so apt works from a current index.

Installing a LAMP-Like Stack

A common web-development environment combines Apache2 (web server), PHP (server-side scripting), and a database such as MariaDB. Install all three in one command:

```bash

sudo apt update

sudo apt install -y apache2 php libapache2-mod-php mariadb-server

```

After installation, enable and start each service with systemctl:

```bash

sudo systemctl enable --now apache2

sudo systemctl enable --now mariadb

```

Verify each service is active:

```bash

sudo systemctl status apache2

sudo systemctl status mariadb

```

The output should show `active (running)`. If a service fails to start, check logs with `sudo journalctl -xe`.

Package Pinning and Holds

In production environments, an unintended upgrade can break an application that depends on a specific package version. Package pinning lets you lock a package at its current version so apt will not upgrade it automatically.

The simplest method uses `apt-mark`:

```bash

sudo apt-mark hold nodejs

```

To confirm which packages are held:

```bash

apt-mark showhold

```

To release a hold:

```bash

sudo apt-mark unhold nodejs

```

More granular control is available through `/etc/apt/preferences.d/` pin files, where you assign numeric priority values to specific versions or repositories.

Auditing with dpkg

When you need to verify what is installed, dpkg is your audit tool.

• List all installed packages: `dpkg -l`
• Check a specific package: `dpkg -l package-name`
• List files installed by a package: `dpkg -L package-name`
• Find which package owns a file: `dpkg -S /path/to/file`

After purging MariaDB, confirm no residual config files remain:

```bash

sudo apt purge mariadb-server

sudo apt autoremove

dpkg -l | grep mariadb

```

If the status column shows `rc` (removed, config present), config files are still on disk. Re-run `sudo apt purge` to clean them. A clean removal shows no `mariadb` entries or shows `un` (unknown, not installed).

Safety and Best Practices

Never run untrusted scripts as root. Review any curl-piped installer before executing it. Use a test or staging VM before applying changes to a production server.

Back up configuration files before major upgrades. Critical files such as `/etc/apache2/apache2.conf` and `/etc/mysql/` directories should be version-controlled or snapshotted.

Principle of least privilege: install only packages your application requires. Each additional package is an additional attack surface. Remove unused packages with `sudo apt purge` and `sudo apt autoremove`.

Verify package integrity: apt checks cryptographic signatures automatically. Do not bypass these checks with flags that disable signature verification in a production system.

On shared or multi-user systems, note that `sudo apt install` gives the invoking user effective root access for that operation. Restrict sudo rights carefully and audit `/etc/sudoers` with `sudo visudo`.