Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I would like to set up an APT repository on a server that will provide a couple of packages.

Is there a way to set one up without installing any software on the server?

How do the files have to be organized?

Edit: I must be doing something wrong... can someone please help me? I have the repository at

I'm not sure where or what, but something's misconfigured. I only currently have one package and it's for all architectures.

Here's what's been added to my /etc/apt/sources.list:

deb stable main

share|improve this question
Can you edit and add what kind of license the applications you downloaded are in? Is this for private use or do you plan to distribute them, etc.? – Jorge Castro Oct 13 '10 at 14:25
@Jorge: What do you mean? What applications? – Nathan Osman Oct 14 '10 at 0:10
I was trying to determine if the package was OSS you could just use launchpad. – Jorge Castro Oct 14 '10 at 0:59
@Jorge: No, it isn't OSS. (In fact, it's pretty much the only app I've written that isn't.) – Nathan Osman Oct 14 '10 at 18:27
up vote 18 down vote accepted

Setting up a trivial repository is very easy using dpkg-scanpackages. This page explains how to set up a trivial repo, and this one explains how to use it (scroll down to example 4).

share|improve this answer
Having a bit of trouble getting it to work. Please see my update to the question. – Nathan Osman Jul 31 '10 at 5:18
It looks like you're trying to set up an "automatic" repo. For one (or just several) package(s), you'll be much better off using a trivial repo. Try moving your Packages.gz and deb all the way up to Then your source will be deb binary/. – mac9416 Jul 31 '10 at 10:58
Trivial repos present problems when pinning, but yes, they are the quickest / easiest way to set up a repo for just a few packages. It would seem silly to set up a pooled repo just for 2 - 3 packages. – Tim Post Jul 31 '10 at 15:21
George, were you ever able to make this work? – mac9416 Aug 9 '10 at 23:32
@mac: Well.... I haven't had time to try it yet :) I ended up just uploading everything to a PPA. – Nathan Osman Aug 23 '10 at 0:26

Just set up a simple but signed repository on a webserver. Because most other tutorials are somewhat dated or cumbersome, I'll try to replicate the procedure here. The initial configuration takes a bit of effort, but the simple build script keeps it easy to manage. And you can just drop in new *.deb files, then update, or let a cron job handle that.

Generate some signing keys

First you need to create a gpg signing key for packages and your repository. Make it a (4) RSA signing key, no password, and give it a unique $KEYNAME when asked for. (Further examples assume "dpkg1" as keyname.)

 gpg --gen-key
 gpg -a --export-secret-key dpkg1 > secret.gpg
 gpg -a --export dpkg1            > public.gpg

I said no password, because your webserver has no builtin monkey to type it in repeatedly. And the signed packages and repository are only meant to satisfy the update-managers complaints about that. Just upload both keys to the new /apt/ repository directory on your webserver, but delete the secret.gpg key after initialization.

Update CGI script

This is the simple update shell/CGI script for it:

echo Status: 200 Okay
echo Content-Type: text/plain
echo Rebuilding APT repository:

  #-- settings
  export GNUPGHOME=/var/www/usr12345/files
  export KEYNAME=dpkg1
  #-- one-time setup
  if [ ! -e "$GNUPGHOME/secring.gpg" ] ; then
     gpg --import -v -v ./secret.gpg
     gpg --import -v -v ./public.gpg
     gpg --list-keys

  #-- symlink .deb files from adjacent sub-directories
  find .. -name '*.deb' -exec ln -s '{}' . \;

  #-- build Packages file
  apt-ftparchive packages . > Packages
  bzip2 -kf Packages

  #-- signed Release file
  apt-ftparchive release . > Release
  gpg --yes -abs -u $KEYNAME -o Release.gpg Release

} 2>&1

The three gpg lines only need to be executed once, to initialize the GPG setup in some directory $GNUPGHOME (above the document root). Delete only the secret.gpg after success.

One unique feature of this small shell script is that it accepts any *.deb files that you drop in, but also searches recursively (starting from one level up) for others, and symlinks them in. (Needs .htaccess Options FollowSymLinks eventually.)

You can either execute this script manually as CGI or per cron-job. But hide it, or better yet move it out of the document root.

Because it's a "trivial" apt repository it needs the following apt-sources.list entry:

deb  ./    # Simple signed repo

That's suitable for single-architecture repositories, and if you don't expect hundreds of packages.

Package signing

Signing your individual packages is also trivial, once you've set up your gpg keys:

dpkg-sig -k dpkg1 -s builder *.deb

(This should be done on the workstation where packages are built, not on the repository webserver.)

Unsigned repository

If you don't need signed packages, then you could slash the update script down to just:

  dpkg-scanpackages . > Packages
  bzip2 -kf Packages

Which can still be used by average users, but needs a custom flag for apt.sources:

deb trusted=yes ./

But please don't use the trusted=yes flag habitually for everything, or if you're not actually sure about the package origin.

For usability

For end users, just drop a HEADER.html into the repository directory. Apaches mod_auto_index will prepend that note:

<dt>Add this repository to /etc/apt/sources.list as:
 <dd><kbd>deb ./  # example repo</kbd>
<dt>Import verification key with:
 <dd><kbd>wget -q http:// -O- | sudo apt-key add -</kbd>


There are a few tools to automate repository management these days. And there are even repository online hosters and package build services (gemfury, packagecloud, bintray etc.)

  • A rather convenient alternative is prm. It's a Ruby script, which builds complex APT and YUM repos. (But let's just hope RPM finally dies out sometime soon..) - It's best installed per gem install prm.

  • And I've also written a small script to automate this similarly: - Please not that it's not overly robust and written in PHP (for once, this is coincidental), and was originally meant for DEB, and RPM-over-APT and Phar bundles.

Since this is closely related to the original question, there are also tools to build Debian packages more easily. Somewhat outdated: EPM. Much more contempoary: FPM. And my personal fork thereof: XPM (more lazy approach for packaging scripting language apps.)

share|improve this answer
This approach failed for me. Failed to fetch Unable to find expected entry 'Packages' in Release file (Wrong sources.list entry or malformed file) – teknopaul Nov 20 '15 at 21:49

Yes. You can do this. You just need to organize the files in the right way and create the index files. If you put the directory structure inside the document root of your web server the packages can just be accessed via the web server.

Here is a detailed description how the files need to be organized and how the index files are created.

You can also use a tool called reprepro if you are willing to install that one package. This will make the administration a little more convenient.

share|improve this answer
@txwikinger: The reason I can't install packages is because the server is running centOS :) – Nathan Osman Jul 31 '10 at 1:12
Well. you don't need to. You can create everything on a different computer and just rsync the whole tree to the centos server – txwikinger Jul 31 '10 at 1:40
Yeah, I would definitely second the use of reprepro. It will make your life so much easier. Creating the repo on a different computer might even be a feature, in case it allows you to protect your signing key better. – andol Jul 31 '10 at 5:48
@andol & @txwikinger: I'm trying but running into problems. Please see my updated question. – Nathan Osman Jul 31 '10 at 5:51
For your dists file you will still need ./binary-<specific arch>. – andol Jul 31 '10 at 6:18

You can perhaps also consider a Launchpad PPA

share|improve this answer

For anyone facing this error after following mario's answer:

Unable to find expected entry 'Packages' in Release file (Wrong sources.list entry or malformed file)

do the following:

dpkg-scanpackages debs /dev/null > Packages
gzip -k Packages
apt-ftparchive release . > Release
gpg --default-key $KEYID -abs -o Release.gpg Release

I put my *.deb files in debs folder.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.