Moonbase

Update: Fixed sample /etc/apt/preferences; thanks to Sky Monkey for writing!

Second Update: Another fix to the sample /etc/apt/preferences; I’d typed Priority instead of Pin-Priority.

I installed Ubuntu this weekend as my ancient Debian installation just wasn’t making it through the sarge upgrade.

Even with Ubuntu universe and multiverse enabled, though, I still find I’m missing some packages I like.

Solution: point apt to Ubuntu and Debian sources at the same time. Here’s how.

Step 1:

This mostly just consists of adding the following lines to the end of your /etc/apt/sources.list:

deb http://ftp.us.debian.org/debian sarge main non-free contrib
deb http://non-us.debian.org/debian-non-US sarge/non-US main contrib non-free

Replace “sarge” with whatever Debian release you want, though things will work better if it’s relatively similar to the Ubuntu release you’re using (at the moment, Debian “sarge” is roughly equivalent to Ubuntu “hoary”).

Step 2: Preferential Treatment

Ubuntu and Debian are not the same; if you leave them on equal footing in your apt configuration, you’ll potentially end up with a mixture of base system packages that is neither Ubuntu nor Debian and doesn’t work right.

You really only want to be doing the mixing-and-matching for selected packages that e.g. aren’t available in Ubuntu yet. To pull this off, you need to tell apt about your preferences. Create an /etc/apt/preferences file that looks like this:

Package: *
Pin: release a=hoary
Pin-Priority: 700

Package: *
Pin: release a=sarge
Pin-Priority: 600

(If you’re using different Ubuntu or Debian releases, feel free to replace “hoary” and “sarge” in the above example accordingly.)

Once you’ve done this, apt will try to use packages from Ubuntu whenever possible, falling back to Debian only to fill in the gaps.

(On a side note, I’d recommend checking out the apt_preferences(5) manpage to get a better sense of what the various options and priority levels mean.)

Step 3: Keys to the Kingdom

One last step. Ubuntu’s apt checks digital signatures on the repository before it will accept package data. It knows Ubuntu’s signature, but not Debian’s.

If you try to do an apt-get update, you’ll get:

...
Reading package lists... Done
W: GPG error: http://ftp.us.debian.org sarge Release: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY F1D53D8C4F368D5D
W: GPG error: http://non-us.debian.org sarge/non-US Release: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY F1D53D8C4F368D5D
W: You may want to run apt-get update to correct these problems

While apt-get rather unhelpfully suggests that you run apt-get update again, what you really need to do is get a copy of Debian’s public key and then instruct apt to accept that key.

You can get the Debian key for the current year at:

http://ftp-master.debian.org/ziyi_key_<i>year</i>.asc

Currently, this will be ziyi_key_2005.asc.

You can grab the file with wget:

wget http://ftp-master.debian.org/ziyi_key_2005.asc

And then import it into your gpg keyring:

gpg --import ziyi_key_2005.asc

It’ll print the id of the key it imports (for 2005, the ID will be 4F368D5D), and you should use that to check the key fingerprint. For the 2005 key, run:

gpg --fingerprint 4F368D5D

And you should see:

pub  1024D/4F368D5D 2005-01-31 Debian Archive Automatic Signing Key (2005) <ftpmaster@debian.org>
Key fingerprint = 4C7A 8E5E 9454 FE3F AE1E  78AD F1D5 3D8C 4F36 8D5D

(You’ll need to find the fingerprints for newer keys elsewhere.)

Once you’re sure this is the right key, you can tell apt to accept the key by issuing the command:

gpg --armor --export 4F368D5D | sudo apt-key add -

Step 4: Ready to Go

Once you’ve done this you should be able to mix and match Debian and Ubuntu with impunity. If a package is in both Debian and Ubuntu, but you want the Debian version, you can ask for Debian via the -t option.

For example, to install the debian version of the GIMP:

sudo apt-get install -t sarge gimp