Debian now prefers the deb822 format in /etc/apt/sources.list.d/debian.sources, although older installations may still use /etc/apt/sources.list. Edit the format your system already uses unless you are intentionally modernizing it.
1. Identify your release and current files
. /etc/os-release
printf '%s\n' "$PRETTY_NAME"
find /etc/apt -maxdepth 2 -type f \( -name '*.sources' -o -name '*.list' \) -print
Use a Debian codename such as trixie or bookworm in examples below. Do not blindly change a production server from one release to another; that is a distribution upgrade, not a routine repository edit.
2. Back up the configuration
sudo cp -a /etc/apt/sources.list /etc/apt/sources.list.backup 2>/dev/null || true
sudo cp -a /etc/apt/sources.list.d /etc/apt/sources.list.d.backup
3. Edit the modern deb822 file
On Debian 13, a typical official configuration lives at:
sudo nano /etc/apt/sources.list.d/debian.sources
A minimal Debian 13 trixie example is:
Types: deb
URIs: https://deb.debian.org/debian
Suites: trixie trixie-updates
Components: main non-free-firmware
Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg
Types: deb
URIs: https://security.debian.org/debian-security
Suites: trixie-security
Components: main non-free-firmware
Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg
Add contrib and non-free only if you need packages from those components.
Legacy one-line format
Older systems may use /etc/apt/sources.list:
deb https://deb.debian.org/debian trixie main non-free-firmware
deb https://deb.debian.org/debian trixie-updates main non-free-firmware
deb https://security.debian.org/debian-security trixie-security main non-free-firmware
The one-line format still works, but Debian recommends deb822 and documents the old format as deprecated. Supported systems can propose a conversion with:
sudo apt modernize-sources
Read the proposed changes before accepting them.
4. Validate
sudo apt update
apt-cache policy
Do not proceed with upgrades until apt update finishes without signature, release-file, or suite errors.
Common failures
- does not have a Release file usually means the suite name or repository URL is wrong.
- Duplicate target warnings mean the same repository exists in more than one .list or .sources file.
- NO_PUBKEY on a third-party repository means its key configuration is missing. Do not fix this with trusted=yes or the deprecated global apt-key; use the vendor's keyring plus Signed-By.
- Release changed its Suite value can appear after a Debian release transition. Verify that the change is expected before accepting it.
Use the official Debian sources documentation and sources.list manual as the current reference. If this is a new server, continue with setting up SSH access.