How apt-forktracer Detects Foreign Packages in Debian

Maintaining a pristine Debian system requires knowing which packages originate from the official Debian archives and which come from third-party repositories, local installations, or personal package archives (PPAs). The apt-forktracer utility is a dedicated diagnostic tool designed to pinpoint these non-official or "forked" packages. It accomplishes this by comparing local package installation states against the package metadata provided by configured APT repositories, allowing system administrators to identify foreign, abandoned, or modified packages quickly.

Reading the Local Installation Database

The detection process begins by analyzing the current state of the system. apt-forktracer queries the local dpkg administrative directory—primarily /var/lib/dpkg/status—to obtain a complete list of every package currently installed on the machine. For each installed package, the utility extracts critical metadata, including the package name, architecture, and exact installed version number.

Querying the APT Cache and Repository Metadata

Once the installed packages are cataloged, apt-forktracer leverages the libapt-pkg library to inspect the local APT cache. This cache contains index lists (downloaded via apt update) from all repositories defined in /etc/apt/sources.list and /etc/apt/sources.list.d/.

Each configured repository provides signed release files (InRelease or Release) alongside package indices. These files contain origin metadata, defining:

  • Origin: The entity distributing the package (e.g., Debian).
  • Archive/Suite: The release tier (e.g., stable, bookworm, testing).
  • Component: The licensing section (e.g., main, contrib, non-free).

Cross-Referencing Versions and Origins

apt-forktracer cross-references each installed package against the versions available in the APT cache. It determines whether a package is foreign by evaluating three primary scenarios:

  1. Orphaned or Locally Installed Packages: If a package version exists in /var/lib/dpkg/status but has no matching package name or version across any repository in the APT cache, apt-forktracer flags it as an orphan. This typically happens when a package is installed manually via dpkg -i or when an upstream repository has removed the package.
  2. Third-Party Repository Packages: If a package is present in the APT cache but is only served by repositories whose Origin does not match official Debian origins, apt-forktracer marks it as non-official.
  3. Forked or Upgraded Packages: If a package exists in both official Debian repositories and an external repository (or was locally upgraded to a higher version than the official archive provides), apt-forktracer evaluates the version strings. If the installed version is higher than or diverges from the version provided by the official Debian archive, the utility labels the package as a "fork."

Filtering via Configuration

To reduce false positives, apt-forktracer checks its configuration file located at /etc/apt-forktracer.conf. Administrators can define rules in this file to specify non-standard origins that should be treated as official, or to explicitly ignore known, intentional divergences. Any package matching an exclusion rule is filtered out of the final report.

Output Classification

After comparing the local database against the cache and applying configuration filters, apt-forktracer outputs the results categorized into distinct states:

  • Packages installed from non-official sources.
  • Official packages superseded by an unofficial version (forked).
  • Packages that are no longer available in any configured repository (obsolete/local).

By relying on the underlying cryptographic trust and metadata of the APT ecosystem rather than simple heuristic guesses, apt-forktracer provides a deterministic audit of software provenance across the operating system.