How do I check which repository supplies a Linux package?
Repository origin helps explain unexpected versions, mixed releases and failed dependency resolution. Inspect the installed version alongside available candidates before changing repository configuration. A repository label is useful context, but it does not replace correctly configured signature verification and a trusted distribution source.
Before you start
- An authorised SSH session on the Linux server.
Instructions
1. Inspect APT policy for one package
On Debian/Ubuntu, policy shows the installed and candidate versions with their configured sources and priorities. The result uses locally cached metadata.
apt-cache policy openssh-serverCheck whether the candidate comes from the expected release and repository. An older cached index can produce an outdated view.
2. Inspect an RPM-family package
On DNF systems, view the installed package information and the enabled repositories relevant to future transactions. Do not publish private repository URLs or subscription identifiers.
dnf info --installed openssh-server
dnf repolistThe installed package’s source information and current repository list help trace the package path; neither command disables trust checks.
Check the result
- The package candidates and enabled repositories match the server’s approved distribution release and support channel. Investigate unexpected third-party sources before an upgrade.
Troubleshooting
- A newer version comes from an unfamiliar source
- Review how that repository was introduced and whether the application supports its build. Do not force an upgrade based on version number alone.
- A signature check fails
- Verify the configured source, clock and trusted signing-key lifecycle through official distribution documentation.
Official references
Use the documentation for your installed version when a flag, service name or platform feature differs.