How to Use apt-offline for Debian Sneakernet Updates

This article explains how the apt-offline utility enables sneakernet software management on offline Debian systems by leveraging removable media like USB drives. It covers the end-to-end workflow, from creating a hardware-specific signature file on an air-gapped machine to downloading packages on an internet-connected host and applying those updates securely to the disconnected system.

Understanding Sneakernet and apt-offline

A "sneakernet" refers to the transfer of electronic information by physically moving removable storage media—such as USB flash drives, external hard drives, or SD cards—from one computer to another. In high-security environments, remote research stations, or areas with restricted connectivity, Debian systems are frequently kept entirely offline (air-gapped) to prevent unauthorized network access.

While air-gapping improves security, it disrupts Debian's native package manager (apt), which relies on direct HTTP/FTP connections to remote repositories. The apt-offline tool bridges this gap. It acts as an offline APT proxy, calculating dependencies and generating structured manifests that can be carried between disconnected and connected environments.

The Three-Step apt-offline Workflow

The process relies on a loop between two computers: the target machine (the offline Debian host) and the source machine (an online host, which can run Linux, Windows, or macOS, provided it has Python and apt-offline installed).

1. Generating the Signature File (Offline System)

On the disconnected Debian system, apt-offline evaluates the local APT database and determines what metadata or packages are missing.

To prepare for a full system upgrade, you generate a signature file (.sig):

sudo apt-offline set update-upgrade.sig --update --upgrade

To install a specific application (for example, nginx), you specify the package name:

sudo apt-offline set install-nginx.sig --install nginx

This .sig file contains raw metadata describing the current state of installed packages, repository definitions (sources.list), and the exact URLs and hashes of the files required. This file is then copied to a USB drive.

2. Fetching the Packages (Online System)

The USB drive is plugged into an internet-connected machine. Using the generated signature file, apt-offline downloads the required packages, dependency chains, and package lists, bundling them into a single archive:

apt-offline get update-upgrade.sig --bundle update-bundle.zip

During this step, apt-offline verifies the integrity of downloaded files against repository checksums. Because apt-offline is written in Python, the online machine does not necessarily have to run Debian; it only requires Python and the apt-offline package.

3. Applying the Updates (Offline System)

The USB drive containing update-bundle.zip is returned to the offline Debian machine. The bundle is installed using:

sudo apt-offline install /path/to/update-bundle.zip

This command synchronizes the downloaded APT metadata and injects the downloaded .deb packages directly into APT's local package cache (/var/cache/apt/archives/).

Once the installation of the bundle finishes, standard Debian package commands are executed offline:

sudo apt upgrade

or, if installing new software:

sudo apt install nginx

APT will recognize that all required packages already exist in the local cache, completing the installation or upgrade without attempting to establish external network connections.

Key Benefits of apt-offline

  • Air-Gap Security: The offline machine remains isolated from internet-facing vulnerabilities and attacks.
  • Exact Dependency Resolution: Because the signature is created on the target machine itself, only the missing dependencies are downloaded, saving external bandwidth and storage space.
  • Cryptographic Verification: File hashes and GPG signatures are preserved and evaluated, ensuring packages have not been tampered with in transit.