There seems to be no record of the origin of an installed package.
If you are fine with getting the location from whence a package of the
same name would be downloaded from, this is available through
apt-cache policy. The following (rather ugly) script does the trick
for me:
LC_ALL=C dpkg-query --showformat='${Package}:${Status}\n' -W '*' \
| fgrep ':install ok installed' \
| cut -d: -f1 \
| (while read pkg; do
inst_version=$(apt-cache policy $pkg \
| fgrep Installed: \
| awk '{ print $2 }');
origin=$(apt-cache policy "$pkg" \
| fgrep " *** ${inst_version}" -C1 \
| tail -n 1 \
| cut -c12-);
echo $pkg $origin;
done)
Note that it's quite fragile, as it makes assumptions about the output
of apt-cache policy, which might change across versions...