Package managers install software, resolve dependencies, verify signatures and make upgrades and removals repeatable. Debian-family systems (Ubuntu) use apt on top of dpkg; Red Hat-family systems (CentOS 7) use yum on top of rpm.
Versions in use on this date. Ubuntu 18.04.2 LTS with apt 1.6, and CentOS 7.6 with yum 3.4. (CentOS 8 and dnf do not exist yet; the Red Hat Enterprise Linux 8 release in May 2019 is the base for it.) Ubuntu 18.04 receives security updates until 2023 under standard support.
Where packages come from
flowchart TB
A[Admin runs apt install or yum install] --> PM[Package manager]
PM --> CFG[Repository list<br/>sources.list or yum.repos.d]
CFG --> MIR[Mirror servers over HTTPS or HTTP]
MIR --> META[Signed metadata and packages]
META --> SIG{GPG signature valid?}
SIG -->|yes| DEP[Resolve dependencies]
SIG -->|no| ERR[Refuse and report]
DEP --> LOW[dpkg or rpm unpacks and runs scripts]
LOW --> DB[(Local package database)]
Daily commands side by side
| Task | Ubuntu (apt) | CentOS (yum) |
|---|---|---|
| Refresh index | sudo apt update |
sudo yum check-update |
| Upgrade all | sudo apt upgrade |
sudo yum update |
| Install | sudo apt install nginx |
sudo yum install nginx |
| Remove | sudo apt remove nginx |
sudo yum remove nginx |
| Remove with config | sudo apt purge nginx |
n/a (config files are kept as .rpmsave) |
| Search | apt search nginx |
yum search nginx |
| Details | apt show nginx |
yum info nginx |
| Files in package | dpkg -L nginx |
rpm -ql nginx |
| Which package owns a file | dpkg -S /usr/sbin/nginx |
rpm -qf /usr/sbin/nginx |
| Installed list | apt list --installed |
yum list installed |
| Clean cache | sudo apt clean |
sudo yum clean all |
| History | /var/log/apt/history.log |
yum history |
apt update only refreshes the list; apt upgrade installs newer versions. Forgetting update is why a package “cannot be found” on a fresh server.
Pin versions and avoid surprises
apt-cache policy nginx # candidate and installed versions
sudo apt install nginx=1.14.0-0ubuntu1.3 # exact version
sudo apt-mark hold nginx # stop upgrades of this package
yum list --showduplicates nginx
sudo yum install nginx-1.16.0
sudo yum install yum-plugin-versionlock && sudo yum versionlock add nginxProduction hosts should install the same versions as staging. Hold database and runtime packages so a routine upgrade cannot move a major version.
Unattended security updates (Ubuntu)
sudo apt install unattended-upgrades
sudo dpkg-reconfigure -plow unattended-upgrades
grep -v '^//' /etc/apt/apt.conf.d/50unattended-upgrades | head -20The default installs security updates only. On CentOS use yum-cron or yum update --security (needs the security plugin metadata).
Adding a third-party repository safely
Download the vendor key, check its fingerprint against the vendor’s website, and scope the key to that repository.
# Ubuntu: add the key, then a sources.list.d entry
curl -fsSL https://example.com/key.gpg | sudo apt-key add -
echo "deb https://example.com/apt bionic main" | sudo tee /etc/apt/sources.list.d/example.list
sudo apt update
# CentOS: a .repo file with gpgcheck on
sudo tee /etc/yum.repos.d/example.repo <<'EOT'
[example]
name=Example
baseurl=https://example.com/rpm/el7/$basearch
enabled=1
gpgcheck=1
gpgkey=https://example.com/key.gpg
EOTNever set gpgcheck=0 to “make it work”: that disables the only check that a package is genuine. Prefer HTTPS mirrors, and treat curl | sudo bash installers with the same caution as running an unknown program as root.
Troubleshooting
- Held broken packages / dependency errors:
sudo apt -f install,sudo dpkg --configure -a, orsudo yum-complete-transaction. - Lock error (
/var/lib/dpkg/lock): another update is running (oftenunattended-upgrades); wait instead of deleting the lock. - Disk full during upgrade: clean caches, and remove old kernels with
sudo apt autoremove. - Rollback:
yum history undo <id>on CentOS; on Ubuntu reinstall the earlier version shown inapt-cache policy(and take a snapshot before big upgrades).