apt is the package manager on Debian, Ubuntu, and their derivatives, including Raspberry Pi OS and Mint. This apt commands cheat sheet covers updating, installing, and removing packages, repositories and keys, held packages, and the errors apt update likes to throw.
Installed version, candidate version, and which repo offers what
Every available version
Which installed package owns a file
Which package, installed or not, ships a file ( first, then )
Dependencies
Command
What it does
What the package needs
What depends on the package, the other direction
Reverse dependencies, limited to what is installed
The whole dependency tree
Packages pulled in as dependencies, not chosen by you
Mark as manually installed so leaves it alone
Install whatever satisfies a dependency string
Why a package is on the system (apt 3.1 and newer)
List Installed Packages
Command
What it does
Every installed package
Check whether a package is installed
Status and version of one package; non-zero exit if absent
The classic full listing with status flags
Files a package installed
Packages you installed on purpose, not as dependencies
Hold Packages
A held package keeps its current version through every upgrade until you release it.
Command
What it does
Pin the installed version
Release it
List held packages
Downgrade and Download
Downgrading only works while the repository still carries the older version; shows what is left. Hold the package afterwards or the next upgrade puts the new version straight back.
Command
What it does
Go back to an older version
Fetch the .deb into the current directory, install nothing
Fetch the package and its dependencies into the cache
Install a .deb you already have
Fetch the source package (needs a entry)
Install what is needed to build it from source
Repositories and Keys
Current releases (Debian 12+, Ubuntu 24.04+) use deb822 files under instead of one-line entries:
# /etc/apt/sources.list.d/example.sources
Types: deb
URIs: https://packages.example.com/apt
Suites: stable
Components: main
Signed-By: /etc/apt/keyrings/example.gpg
is deprecated and gone from the newest releases. Keys go into and are referenced by :
Use a proxy for one run, without touching the config
Bypass a configured proxy for one run
Print the download URLs so you can fetch them on another machine
Install from the local cache only, no network
apt vs apt-get
apt is the human-facing command: it merges the most used parts of apt-get and apt-cache and adds a progress bar. Its output can change between releases, so scripts should stick to apt-get and apt-cache, whose interfaces are stable.
apt
Script equivalent
History and Logs
apt has no subcommand the way dnf does. The record lives in .
Command
What it does
What was installed, upgraded, or removed, and when
Search the rotated history too
Full terminal output of past apt runs
dpkg's own log, one line per package action
Common apt update Errors
Error
Fix
Another apt is running, usually unattended-upgrades; wait, or find it with
The repo's signing key is missing: fetch it into and reference it with
The release left the mirror: fix the entry under , or point EOL Ubuntu at old-releases.ubuntu.com
Stale mirror or broken cache: , or switch mirrors
Usually a wrong system clock or an intercepting proxy: check first
A release moved from testing to stable:
apt, dnf and pacman
If the shell answers , the machine is almost certainly not Debian-based; says which one it is. The same tasks on RHEL and Fedora are in the DNF cheat sheet, and on Arch in the pacman cheat sheet.
Task
apt
dnf
pacman
Refresh and upgrade
Install
Remove with dependencies
Search
Who owns a file
List installed
Clean cache
Tips
Security patches can install themselves: , then . It is also the usual holder of the dpkg lock right after boot.
In scripts and Dockerfiles, use with so a config prompt cannot hang the run.
never removes packages, which means it can also silently hold some back; when it reports packages "kept back", will resolve them.
Removing a package does not stop its service first in every case; check with (see the systemctl cheat sheet).
apt FAQ
What does the apt update command do?
It downloads the current package lists from every repository in your sources and writes them to /var/lib/apt/lists. It installs and changes nothing, so it is safe to run at any time. apt upgrade is the step that installs the newer versions those lists describe, which is why the order matters: an upgrade run on stale lists installs stale versions, and on a machine that has been off for a month apt update alone can take longer than the upgrade.
Why does the shell say 'apt: command not found'?
apt ships only on Debian and its derivatives, so the usual cause is that the machine is not one. Run cat /etc/os-release to check. On Fedora, RHEL, Rocky, and Amazon Linux the equivalent is dnf; on Arch and Manjaro it is pacman; on Alpine apk; on macOS there is no apt at all, use Homebrew. WSL follows whichever distro image you installed, not Windows.
What is the apt-get command, and should I use it instead of apt?
apt-get is the older front end, and apt is a friendlier wrapper that merges the most used parts of apt-get and apt-cache and adds a progress bar. Both call the same library and leave you with the same packages. Use apt by hand and apt-get in scripts, Dockerfiles, and CI: apt-get keeps its options and output stable across releases, and apt prints a warning that its own interface does not.
How do I fix broken or held-back packages?
For a broken or interrupted install, sudo apt --fix-broken install, then sudo dpkg --configure -a to finish anything left half configured; add --fix-missing when the cause was a failed download. Packages reported as 'kept back' are a different thing: they are not held. apt upgrade refuses to remove packages, so it skips those, and apt full-upgrade resolves them. On Ubuntu they can also be a phased update, which holds the new version back for a few days on purpose. Real holds only come from apt-mark hold and show in apt-mark showhold.
What does apt stand for?
Advanced Package Tool. apt, apt-get, apt-cache, apt-mark, and apt-config are all front ends over the same library, which is why they share a cache and a configuration. dpkg sits underneath and does the actual unpacking of a single .deb; apt is the layer that knows about repositories, dependency resolution, and versions.