In the polished world of Debian-based Linux systems (Ubuntu, Debian, Mint, etc.), we take comfort in apt — the package manager that resolves dependencies, tracks versions, and keeps everything in harmony. But beneath the surface lies a wild west: the package. These are packages installed manually, bypassing the repository and dependency tracking systems.
If you’ve ever run dpkg -i some-package.deb without a repository behind it, you’ve invited an "uncontrolled deb" into your system. When left unmanaged, these packages can lead to dependency hell, broken upgrades, and mysterious conflicts.
apt-mark showmanual | grep -vFf <(apt-mark showauto) But for true "no repository origin" detection: ncontrol deb
sudo apt install deborphan deborphan # Finds packages with no dependencies and no repo origin For a friendly GUI, synaptic shows "Local or obsolete" packages in its "Custom Filters" section. | Risk | Consequence | |------|--------------| | No security updates | Vulnerabilities remain unpatched | | Dependency conflicts | Future apt upgrade may fail due to broken deps | | System inconsistency | Mixed versions of libraries cause crashes | | Uninstall issues | apt remove may not work cleanly | | Debian release upgrades | Major version upgrades (e.g., Bullseye→Bookworm) often abort | Taming the Uncontrolled Deb: 4 Strategies 1. Convert to a Local Repository (Best Practice) Create a simple APT repository for your manually installed packages:
sudo dpkg --purge package-name sudo apt update sudo apt install package-name # from official repo To a manually installed package into a controlled local repo, use dpkg-repack : In the polished world of Debian-based Linux systems
apt-cache policy $(dpkg -l | grep ^ii | awk 'print $2') | grep -B1 "None" | grep -v "^$" Better yet, use deborphan — a tool designed to find orphaned libraries and uncontrolled packages:
apt list --installed | grep -v "now" Or more precisely: If you’ve ever run dpkg -i some-package
cat <<EOF | sudo tee /etc/apt/preferences.d/pin-uncontrolled Package: your-package-name Pin: version * Pin-Priority: 1001 EOF This prevents APT from replacing your manual package during upgrades. If you must install an uncontrolled deb that has missing dependencies, you can force it: