Using Old Debian Versions In Your sources.list

Version 1.0
Author: Falko Timme
Follow me on Twitter

You might be in a situation where you have a sytem with an old Debian version that has reached end of life, like Etch, Sarge, Woody, etc., and a distribution upgrade is not an option for you (maybe because you have customized the system so much that you fear breaking the system by doing a distribution upgrade). The "normal" repositories for these old versions do not exist anymore, which means you cannot install new software or update existing packages using apt. This tutorial shows how you can modify your /etc/apt/sources.list to still get packages for your old Debian version using apt.

I do not issue any guarantee that this will work for you!


1 Preliminary Note

Please don't get me wrong - I don't want to promote not upgrading your Debian system to the latest stable version - in fact, I do recommend to do this.! But sometimes life isn't just as easy as that, and there might be situations where an upgrade is not an option. For situations like these I provide this tutorial.


2 Modifying /etc/apt/sources.list

After a Debian version has reached EOL (end of life), its repositories go to the Debian archive. Therefore we can use this archive to get packags for our distribution. The syntax for our /etc/apt/sources.list is as follows:

deb <version> main non-free contrib
deb-src <version> main non-free contrib
deb <version>/updates main non-free contrib
deb-src <version>/updates main non-free contrib

So for Debian Etch, you'd comment out all other repositories in /etc/apt/sources.list and add the following lines:

vi /etc/apt/sources.list
deb etch main non-free contrib
deb-src etch main non-free contrib

deb etch/updates main non-free contrib
deb-src etch/updates main non-free contrib


apt-get update

afterwards to update the packages database.

If you get an error like

W: There is no public key available for the following key IDs:
W: GPG error: etch/updates Release: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 9AA38DCD55BE302B
W: You may want to run apt-get update to correct these problems

just install the debian-archive-keyring package...

apt-get install debian-archive-keyring

... and run

apt-get update



Share this page:

Suggested articles

14 Comment(s)

Add comment


By: Louis

I think this is a half complete howto, and yes how you are suggesting works ok.

Ik thinks you better use the folder /etc/apt/sources.list.d/  for adding files.
add a file like etch.list in this and put everything for etch in it.

i have for example.


each contains its ow lines which you can enable or disable.

when using multiple version ( like stable/testing/unstable) you need to be in control
which version is installed. this is done with /etc/apt/preferended.d
you also put files in here. for me it is.


this files contains these lines :
Package: *
Pin: release a=squeeze-backports
Pin-Priority: 300
Package: *
Pin: release a=stable
Pin-Priority: 990
Package: *
Pin: release a=stable-updates
Pin-Priority: 200
Package: *
Pin: release a=testing
Pin-Priority: 200
Package: *
Pin: release a=unstable
Pin-Priority: 50

I like to keep it separeted, but you can put it in one file. ( same for the sources files )
you can read more about pinning here : 
in above example only stable is installed, but if needed i can pull file of every tree.

Priorities (P) assigned in the APT preferences file must be positive or
negative integers.  They are interpreted as follows (roughly speaking):

 P > 1000
   causes  an  instance  to be installed even if this constitutes a
   downgrade of the package

 990 < P <=1000
   causes an instance to be installed even if it does not come from
   the target release, unless the installed instance is more recent

 500 < P <=990
   causes an instance to be installed unless there is  an  instance
   available  belonging to the target release or the installed ver-
   sion is more recent

 100 < P <=500
   causes an instance to be installed unless there is  an  instance
   available  belonging to some other distribution or the installed
   version is more recent

 0 <= P <=100
   causes an instance to be installed only if there is no installed
   instance of the package

 P < 0  prevents the instance from being installed

By: Anderson

This is what I have been looking for!


Thank you!

By: Thomas

Thank you very much ! I was struggling to find where the archived sources where located.

By: Anonymous

Thanks a lot! 

By: Roy

Thanks very much.

Solved the issue with an embedded system TS-7800 running Debian Etch.



By: Glen

Thank you :) Worked great!!!

By: Bastian

Try the solution from nenad here if you still use debian lenny and try to upgrade:


By: Rodrigo


I tried to do it but:

W: GPG error: squeeze Release: The following signatures were invalid: KEYEXPIRED 1520281423 KEYEXPIRED 1501892461

W: GPG error: squeeze/updates Release: The following signatures were invalid: KEYEXPIRED 1520281423

[email protected]:~# apt-get install debian-archive-keyringReading package lists... DoneBuilding dependency treeReading state information... Donedebian-archive-keyring is already the newest version.0 upgraded, 0 newly installed, 0 to remove and 41 not upgraded.


By: Terry Carlson

Sir, you are a scholar and a gentleman of the first order. Thank s for the excellent explanation!

By: Jorge

Sir, saved me!!! Awesome tutorial.

By: Landu Nsuka

Thank You.

i join with and you help me.


By: MaxiReglisse

i had to remove debian-security lines, and it worked !

# deb etch/updates main non-free contrib# deb-src etch/updates main non-free contrib

By: tahari abdeslam



i followed the steps to update a wheezy based install system but unfortunately it wont work


i think it is too old now

: Release file for is expired (invalid since 616d 0h 58min 31s). Updates for this repository will not be applied.


By: tisc0

Falko, my man, thanks again for the quantity AND the quality of your tips & tutos !! Been almost 20 years... I followed you, blind eyes, when I installed my first debian server, and knew NOTHING ! You made me, bro, extremely grateful again today, when spotting a so old debian 7 in one of my pools :)

Big respect for your enormous contribution.orz