What is the deb822 .sources format in apt?

A multi-line, named-field format for apt repositories, stored in /etc/apt/sources.list.d/ with a .sources extension. Instead of one line such as deb [signed-by=...] https://host/apt trixie main, it uses fields: Types, URIs, Suites, Components and Signed-By, each on its own line. Debian 13 Trixie and recent Ubuntu releases prefer it, and multi-value fields let one stanza replace several one-line entries.

Do .list files still work on Debian 13?

Yes. One-line .list entries are still read by apt on Debian 13 and there is no deadline to convert. The deb822 format is preferred for new configuration, not mandatory for existing configuration.

How do I convert sources.list to deb822 automatically?

Run sudo apt modernize-sources, available in apt 3.0 as shipped by Debian 13 and Ubuntu 25.04 and newer. It converts .list files into .sources stanzas, asks before making changes, and keeps the originals with a .bak extension. On older releases the command is unavailable and the stanza must be written by hand.

Why does apt warn that a target is configured multiple times?

Because the same repository is described in two files at once, typically a leftover .list file alongside its new .sources replacement. It is only a warning, but apt fetches the same index twice and the two entries can drift apart. Delete or rename the old .list file.

How do I put a GPG key in a deb822 .sources file?

Use Signed-By: followed by the path to a keyring, for example Signed-By: /etc/apt/keyrings/example.gpg. The armoured key can also be embedded inline as an indented block under Signed-By, which avoids a separate file, though a path is easier to audit and to replace when a key is rotated.

deb822 .sources on Debian 13: converting apt repositories

            ⚡ The short answer. Debian 13 “Trixie” ships apt 3.0, which
            prefers the deb822 format: multi-line stanzas in
            /etc/apt/sources.list.d/*.sources instead of one-line
            deb … entries in *.list. Old .list files
            still work (nothing breaks) and apt modernize-sources converts them
            for you, keeping backups. The one rule: never describe the same repository in both
            formats at once.
        

🆚 The same repository, both ways

One-line format, /etc/apt/sources.list.d/deb.griffo.io.list:

deb [signed-by=/etc/apt/keyrings/deb.griffo.io.gpg] https://deb.griffo.io/apt trixie main

deb822 format, /etc/apt/sources.list.d/deb.griffo.io.sources:

Types: deb
URIs: https://deb.griffo.io/apt
Suites: trixie
Components: main
Signed-By: /etc/apt/keyrings/deb.griffo.io.gpg

Both describe exactly the same thing. The gain is that each field is named, so nothing depends on the order of bracketed options, and multi-value fields stop needing a separate line per combination, Types: deb deb-src and Suites: trixie forky sid replace what would otherwise be six one-line entries.

🤖 Convert everything with one command

apt 3.0 (Debian 13, Ubuntu 25.04 and newer) ships a converter. It rewrites your .list files as .sources, and keeps the originals as .list.bak:

Run the commands

sudo apt modernize-sources
sudo apt update

apt modernize-sources
apt update

It asks before touching anything and tells you what it changed. On older releases the command does not exist, write the stanza by hand, as above.

✍️ Writing a third-party entry by hand

The full form, with everything a third-party repository typically needs:

Types: deb deb-src
URIs: https://deb.griffo.io/apt
Suites: trixie
Components: main
Architectures: amd64
Signed-By: /etc/apt/keyrings/deb.griffo.io.gpg
Enabled: yes

Field notes that matter in practice:

Signed-By: takes a path to a keyring, or the armoured key inline, indented, if you would rather not manage a separate file. A path is easier to audit. See apt GPG key errors if that key is giving you trouble.
Architectures: is how you stop apt fetching an index that does not exist for your machine, useful on arm64 hosts where a repository only ships amd64.
Enabled: no disables a repository without deleting the file, which is much nicer than commenting out a line.
Stanzas are separated by a blank line, so one file can hold several repositories. A stray blank line inside a stanza silently splits it in two.
The file must end in .sources. apt ignores any other extension in that directory, the same trap as .list.

🧩 Or let extrepo write the stanza

A repository registered with Debian's own extrepo needs none of this by hand. It writes the deb822 file for you, fetches the signing key into /var/lib/extrepo/keys/ and verifies it against signed metadata before using it. This repository is registered as griffo, and the always-free mirror as griffo-free:

sudo apt install extrepo
sudo extrepo enable griffo

apt install extrepo
extrepo enable griffo

What lands in /etc/apt/sources.list.d/extrepo_griffo.sources is the stanza above, with Suites: set to the Debian release you are running and Signed-By: pointing at the key it just installed. extrepo disable griffo turns it off again by adding Enabled: no rather than deleting the file, and extrepo update rewrites the stanza when the repository's published metadata changes, which is how a key rotation reaches you without editing anything. It covers Debian only: extrepo publishes metadata per Debian suite and none for Ubuntu, so on Ubuntu write the stanza yourself.

⚠️ The mistake to avoid

Converting by hand and forgetting to delete the old file leaves the repository configured twice:

W: Target Packages (main/binary-amd64/Packages) is configured multiple times in
   /etc/apt/sources.list.d/deb.griffo.io.list:1 and
   /etc/apt/sources.list.d/deb.griffo.io.sources:1

It is a warning rather than an error, and it is harmless in itself, but it means every apt update fetches the same index twice, and if the two entries ever drift apart, you will be debugging a repository that is configured two ways at once. Delete or rename the .list file.

🐧 Should you convert?

There is no deadline. One-line entries are still read by apt and will be for a long time. Convert when you want the clarity, particularly if you manage machines with a configuration tool, where a named-field format is far easier to template than a line of bracketed options. If you have a working .list file and no reason to touch it, leaving it alone is a perfectly good decision.

← All packages served by deb.griffo.io

📄 deb822 .sources on Debian 13