APT Package Manager Explained: update vs upgrade for the Linux+ Exam

APT — the Advanced Package Tool — is the package manager on Debian, Ubuntu, and their derivatives. It installs software, resolves dependencies, and keeps systems patched, and it is examinable territory on Linux+.

A naming warning worth getting out of the way: in Linux, APT is a package manager. In security, APT means advanced persistent threat. They share nothing but three letters, and exam questions occasionally exploit the ambiguity.

What APT Actually Does

Underneath sits dpkg, the low-level tool that installs and removes individual .deb files. dpkg does exactly what it is told and nothing more — hand it a package whose dependencies are missing and it fails.

APT is the layer above. It reads configured repositories, works out the full dependency tree, downloads everything required, and hands the packages to dpkg in the right order. Dependency resolution is the entire reason APT exists.

The Commands

Command	What it does
apt update	Refreshes the package lists from the repositories. Installs nothing.
apt upgrade	Upgrades installed packages, without removing anything.
apt full-upgrade	Upgrades, and will remove packages if required to resolve dependencies.
apt install <pkg>	Installs a package and its dependencies.
apt remove <pkg>	Removes the package, leaving configuration files.
apt purge <pkg>	Removes the package and its configuration files.
apt autoremove	Removes dependencies no longer needed by anything.
apt search <term>	Searches package names and descriptions.
apt show <pkg>	Shows details for a package.
apt list --installed	Lists what is installed.

The single most tested point: apt update and apt upgrade are different commands doing different things. Update refreshes the catalogue; upgrade installs the software. Running upgrade without update first means upgrading against a stale list, which is why the two are almost always run together.

remove versus purge is the second. Remove leaves configuration behind — useful if you plan to reinstall, unhelpful if you wanted a clean slate.

apt Versus apt-get

Both exist and both work. apt-get, along with apt-cache, is the older interface with a stable, script-safe command-line contract. apt is the newer, friendlier front end that merges the most common operations from both and adds a progress bar and coloured output.

The practical guidance, and the correct exam answer: use apt interactively, use apt-get in scripts, because its output and options are guaranteed stable between releases while apt's are not.

Repositories and Trust

Sources are configured in /etc/apt/sources.list and in files under /etc/apt/sources.list.d/. Downloaded packages are cached in /var/cache/apt/archives/, which apt clean empties when disk space is short.

Packages are cryptographically signed, and APT verifies the signature against keys it holds. This is the security property that matters: it means a package cannot be tampered with in transit or served by an impostor mirror. Modern practice stores repository keys in /etc/apt/keyrings/ rather than the deprecated apt-key command.

That leads to the security point worth internalizing: adding a third-party repository extends your trust to whoever runs it. Every package they publish can install and run code as root on your systems. Adding a random PPA to get one newer application is a supply chain decision, not a convenience decision.

The Other Package Managers

Linux+ expects you to know the families, not just APT.

• Debian, Ubuntu, Mint: apt / apt-get over dpkg, .deb packages.
• RHEL, Fedora, CentOS, Rocky: dnf (formerly yum) over rpm, .rpm packages.
• SUSE: zypper over rpm.
• Arch: pacman.
• Universal formats: Snap, Flatpak and AppImage, which bundle dependencies and work across distributions.

The parallel worth memorizing: apt is to dpkg as dnf is to rpm — a dependency-resolving front end over a low-level installer.

Linux+ (XK0-005) Exam Tips

• apt update refreshes lists; apt upgrade installs. Highest-probability question.
• remove keeps config files; purge deletes them.
• apt sits above dpkg, and dpkg alone does not resolve dependencies.
• Know the distro-to-tool mapping for apt/dpkg, dnf/rpm, zypper and pacman.
• Know the file locations: sources.list, sources.list.d, the archive cache.
• Package signing and repository keys as the integrity mechanism.
• apt for interactive use, apt-get for scripts.

Security+ and CySA+ Angles

Security+ (SY0-701) treats package management as patch management, and third-party repositories as supply chain risk.

CySA+ (CS0-004) is interested in the vulnerability management side — using the package inventory to determine which systems carry an affected version, and in the detection side, since an unexpected repository appearing in a configuration file is a persistence indicator worth alerting on.

Key Takeaways

• APT resolves dependencies and manages packages on Debian-based systems, sitting above dpkg.
• update refreshes the package list; upgrade installs the updates. Different commands, run together.
• remove leaves configuration; purge removes it.
• Packages are signed, and APT verifies them — which is what makes repositories trustworthy.
• Adding a third-party repository grants it root-level trust on your systems.
• apt is to dpkg as dnf is to rpm.

Related reading: Linux permissions · ifconfig and ip