Debian Etch: play with backports

Debian Etch (4.0) is stable: packages are tested, versions are frozen and an application that depends on a library newer than Etch’s does not compile. Backports solve this problem: the Debian Backports project recompiles packages from Sid (unstable) for Etch’s dependencies and makes them available in a separate repository.

The backports repository

# /etc/apt/sources.list
deb http://www.backports.org/debian etch-backports main contrib non-free

The GPG key of the repository:

wget -O - http://backports.org/debian/archive.key | apt-key add -

Update:

apt-get update

Installing from backports

By default, apt-get prefers packages from the base distribution (Etch stable): backports are not installed automatically. To install a package from backports:

apt-get install -t etch-backports openssl

The -t etch-backports tells apt: “use the etch-backports repository as the target”. Without this option, apt installs the Etch version (older) if it exists.

Pinning: controlling priorities

APT pinning controls which repository has priority for each package:

# /etc/apt/preferences
Package: *
Pin: release a=etch-backports
Pin-Priority: 200

Package: openssl
Pin: release a=etch-backports
Pin-Priority: 900

Pin-Priority 200 : backports are less prioritized than Etch stable (priority 500)
Pin-Priority 900 : openssl from backports is MORE prioritized than Etch stable
The * applies to all packages, the openssl only to openssl

With this pinning, apt-get install openssl installs the backports version and all other packages stay in Etch stable.

The use case

Backports serve when an application needs a library newer than the stable distribution’s: PHP 5.3 on Etch (Etch has PHP 5.2), PostgreSQL 8.3 on Etch (Etch has 8.1), nginx (not in Etch at all). Backports provides the package compiled for Etch, without breaking Etch’s dependencies.

The risk

Backports are not tested like the stable distribution: they are compiled for Etch’s dependencies, but not tested in all configurations. A backports package may have bugs that do not exist in the Etch version. The risk is acceptable for a specific application, not for a global distribution upgrade.

[edit: 2026] Debian Backports still exists (backports.debian.org), APT pinning has not changed and the pattern “backports for recent packages on a stable distribution” remains the Debian pattern. Modern distributions (Ubuntu LTS) have adopted the concept with PPAs and HWE kernels. Pinning remains the finest-grained repository priority control mechanism and it has no equivalent in RPM/DNF/YUM (RHEL 8+ module streams come close).

[edit: 2026] The Ansible implementation of all this: the apt role .