Can I install a multiverse package, then disable non-free sources, and still let it upgrade?

Question

I've installed a package from multiverse and then disabled multiverse and restricted in apt sources (in all urls). I disabled them so I don't install any new non-free packages or dependencies by accident.

When I did apt update and then upgrade on the package, apt says it's "already the newest version". But I believe I won't actually get upgrades for that package, right?

Is there a way to get upgrades just for the installed packages while still preventing any new packages from being installed from restricted or multiverse (without having to edit apt sources on every installation)?

I thought about leaving multiverse enabled on focal-security and focal-updates, but I think that's probably not gonna do what I expect.

---

My other somewhat related question:
I want to get a warning when apt installing from certain sources, like restricted and multiverse

Answer 1

An installed package won't continue to automatically get upgrades if you disable the software source that the package was installed from (for example by commenting out the software source's line in your software sources by preceding it with a # character), however you can still manually upgrade that package by re-enabling its software source and reinstalling the package, and then disabling its software source again.

When you reinstall a package with sudo apt reinstall package-name, apt will try to locate that package in your software sources and install the latest available version of that package. When a package is upgraded by sudo apt upgrade it also upgrades it to the latest available version of that package.

Dependencies cross repositories only if you are also adding suggested packages with the --install-suggests option when running a sudo apt install command. Ubuntu installs only the package itself and its recommended packages by default. You will get an error message if you try to install a suggested package that is not available from your system's software sources.

Even if a package has been installed by apt there are commands that tell apt to treat that package like a manually installed package, so that it cannot be either automatically removed or automatically upgraded without toggling an option first. sudo apt-mark manual package-name is used to mark a package as being manually installed, which will prevent the package from being automatically removed if no other packages depend on it. sudo apt mark hold package-name hold is used to mark a package as held back, which will prevent the package from being automatically installed, upgraded or removed. unhold is used to cancel a previously set hold on a package to allow all actions again. apt reinstall --simulate package-name simulates the re-installation of a package the results of which will show whether reinstalling that package will also install any new packages or dependencies which may include non-free packages that aren't currently installed. Use sudo apt-mark hold to prevent these unwanted new packages from being installed.

Answer 2

Disabling the source won't work (the system won't ever find out about upgraded versions of your package). What might work (I haven't tested it myself for this usecase) is APT pins. Leave the sources enabled and add something like the following to /etc/apt/preferences:

Package: your-favorite-package
Pin: release o=Ubuntu
Pin-Priority: 990

Package: *
Pin: release c=multiverse
Pin-Priority: -1

Package: *
Pin: release c=restricted
Pin-Priority: -1

The second and third blocks mark all packages from multiverse and restricted as "do not install", and the first block restores the defalt priority to your-favorite-package.