I've installed a package from multiverse and then disabled multiverse and restricted in apt sources (in all urls). I disabled them so I don't install any new non-free packages or dependencies by accident.

When I did apt update and then upgrade on the package, apt says it's "already the newest version". But I believe I won't actually get upgrades for that package, right?

Is there a way to get upgrades just for the installed packages while still preventing any new packages from being installed from restricted or multiverse (without having to edit apt sources on every installation)?

I thought about leaving multiverse enabled on focal-security and focal-updates, but I think that's probably not gonna do what I expect.

My other somewhat related question:
I want to get a warning when apt installing from certain sources, like restricted and multiverse

  • No, you will not get upgrades for those packages that come from those repositories once they are disabled. But, you might also get unmet dependencies if you install any application that might rely on dependencies from those repositories.
    – Terrance
    Feb 10, 2021 at 5:19
  • @Terrance Is it possible for a package in main/universe to have a dependency on a restricted/multiverse package if I have these enabled?
    – geekley
    Feb 10, 2021 at 6:05
  • Nevermind, I think I already got the answer for that in the linked question. It's possible only in "suggests" it seems.
    – geekley
    Feb 10, 2021 at 6:20

2 Answers 2


An installed package won't continue to automatically get upgrades if you disable the software source that the package was installed from (for example by commenting out the software source's line in your software sources by preceding it with a # character), however you can still manually upgrade that package by re-enabling its software source and reinstalling the package, and then disabling its software source again.

When you reinstall a package with sudo apt reinstall package-name, apt will try to locate that package in your software sources and install the latest available version of that package. When a package is upgraded by sudo apt upgrade it also upgrades it to the latest available version of that package.

Dependencies cross repositories only if you are also adding suggested packages with the --install-suggests option when running a sudo apt install command. Ubuntu installs only the package itself and its recommended packages by default. You will get an error message if you try to install a suggested package that is not available from your system's software sources.

Even if a package has been installed by apt there are commands that tell apt to treat that package like a manually installed package, so that it cannot be either automatically removed or automatically upgraded without toggling an option first. sudo apt-mark manual package-name is used to mark a package as being manually installed, which will prevent the package from being automatically removed if no other packages depend on it. sudo apt mark hold package-name hold is used to mark a package as held back, which will prevent the package from being automatically installed, upgraded or removed. unhold is used to cancel a previously set hold on a package to allow all actions again. apt reinstall --simulate package-name simulates the re-installation of a package the results of which will show whether reinstalling that package will also install any new packages or dependencies which may include non-free packages that aren't currently installed. Use sudo apt-mark hold to prevent these unwanted new packages from being installed.

  • So, the only way to get the behavior I want would be to leave it enabled (for auto-upgrade) and have some sort of wrapper script for apt install that would automatically disable these sources, apt update, install what I want and enable them again, then apt update again?
    – geekley
    Feb 10, 2021 at 6:01
  • 1
    I don't understand how hold can help me... it seems to do the opposite of what I want, no? Because I don't want to prevent the non-free package from upgrading, I want to allow that but prevent NEW non-free packages from being manually installed by accident (and if possible new non-free depencencies too). The root of the problem is that apt install won't let me know easily that a pkg is non-free (with a warning, for example), see my linked question.
    – geekley
    Feb 10, 2021 at 6:16
  • @geekley Afaik, ou have to install the package you want, then hold all unwanted multiverse packages.
    – Emoji
    Feb 10, 2021 at 7:04
  • @Emoji I get that, but hold doesn't help me because I don't have a "blacklist of packages I don't want", that blacklist would be everything on multiverse, except what I already installed. The other answer with apt pin seems to be on the right track though... I'll see if I can find a way to test that.
    – geekley
    Feb 10, 2021 at 18:02

Disabling the source won't work (the system won't ever find out about upgraded versions of your package). What might work (I haven't tested it myself for this usecase) is APT pins. Leave the sources enabled and add something like the following to /etc/apt/preferences:

Package: your-favorite-package
Pin: release o=Ubuntu
Pin-Priority: 990

Package: *
Pin: release c=multiverse
Pin-Priority: -1

Package: *
Pin: release c=restricted
Pin-Priority: -1

The second and third blocks mark all packages from multiverse and restricted as "do not install", and the first block restores the defalt priority to your-favorite-package.

  • Thanks! Not only does this work, but it also sort of solves the problem in my linked question (since I can still do tab-completion in apt install, but it won't actually install unless it's whitelisted). To whitelist pkgs that I want to upgrade, I only have to list them space-separated in this file. Not sure how it works for dependencies (do I need to list them too?). This method seems to only block the "version selection" of the restricted pkgs, so I can still bypass the restriction by installing a specific version (like apt install somepkg=1.2.3) if I don't want to upgrade it.
    – geekley
    Feb 10, 2021 at 21:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .