How APT works

Ubuntu repositories contain package files and signed metadata that describes their names, versions, dependencies, and checksums.

APT works with that metadata. It decides which packages and dependencies are needed, downloads them, verifies them, and asks dpkg to install the package files.

apt update updates the index

Your machine keeps a local package index. Refresh it with:

sudo apt update

This command does not upgrade installed software. It downloads current repository metadata so later commands know which versions are available.

Ubuntu 24.04 stores the default repository definition in /etc/apt/sources.list.d/ubuntu.sources. Older releases commonly use /etc/apt/sources.list. Do not replace repository files with examples written for a different release.

Inspect installed and candidate versions

Use apt policy to compare the installed version with the version APT would choose:

apt policy nginx

A typical result identifies an Installed version, a Candidate, and the repositories offering each version.

List pending upgrades with:

apt list --upgradable

Read this list before changing an important server. An update may affect a public service, a database client, or the kernel.

Dependencies are part of the change

Installing one package can add several dependencies. Removing one can make dependencies eligible for later cleanup.

APT prints a transaction summary before it acts. Read which packages will be installed, upgraded, or removed. Stop if the proposed change is broader than expected.

For scripts, prefer apt-get; the apt command is designed primarily for interactive use. In either case, avoid automatic -y confirmation until you trust and understand the transaction.

Try this: run apt policy for one installed package. Identify its installed version, candidate version, and repository without changing the system.