Learn Void Linux - Package Management with XBPS

#Introduction

XBPS — short for X Binary Package System — is the heart of Void Linux. Every package, from the kernel down to small applications, enters and leaves the system through XBPS. Episode 4 dissects XBPS thoroughly: install, upgrade, query, remove, all the way to the repository architecture and key signing.

One of XBPS's advantages over other package managers is its design, inspired by development experience at NetBSD. Its commands are grouped into several focused binaries — one binary for installing, one for querying, and so on — so every task has the right tool.

Let's master XBPS, from the most basic commands to its security mechanisms.

#Basic XBPS Operations

#Install and Synchronize

The first step is always to synchronize the repository index with the -S option. After that, install packages:

sudo xbps-install -S
sudo xbps-install git curl htop

Use xbps-install -Su to upgrade the entire system, and xbps-install -u to upgrade only a specific package:

sudo xbps-install -Su
sudo xbps-install -u curl

A full upgrade with -Su is a routine ritual for Void users, as we'll discuss in more depth in episode 16.

#Query: Search, Info, and Files

xbps-query is the package investigation tool. Here are the three modes you'll use most often:

xbps-query -s 'nginx'
xbps-query -p version nginx
xbps-query -f nginx | head -n 10

The xbps-query -s 'nginx' command searches for packages in the repository and on the system. Add -R to limit the search to repositories only:

xbps-query -Rs 'code editor'
xbps-query -Ro /usr/bin/nvim

The -Ro /usr/bin/nvim option answers the classic question: which package owns the file /usr/bin/nvim?

#Removing Packages

Remove packages with xbps-remove. To also remove dependencies that are no longer used, use -R (recursive) or -Rr (including orphans):

sudo xbps-remove htop
sudo xbps-remove -R htop
sudo xbps-remove -Rr htop

The xbps-remove -Rr htop command removes htop, its dependencies, and any packages left orphaned. Use -v if you want to see what gets removed.

#Repositories and Configuration

#The xbps.d Directory Structure

XBPS repository configuration lives in /etc/xbps.d/, while the system defaults are in /usr/share/xbps.d/. The list of default repositories:

ls -l /usr/share/xbps.d/
cat /usr/share/xbps.d/00-repository-main.conf

The output of cat /usr/share/xbps.d/00-repository-main.conf shows a line like:

repository=https://repo-default.voidlinux.org/current

The current repository is Void's main repository. To switch to another mirror, create a file in /etc/xbps.d/ that overrides the default value.

#Adding the Nonfree Repository

Void provides an additional nonfree repository for packages with non-free licenses. Add it via a configuration file:

repository=https://repo-default.voidlinux.org/current/nonfree

After adding that file, sync again and check the active repositories:

sudo xbps-install -S
xbps-query -R -l

The xbps-query -R -l command lists all recognized repositories. Episode 17 will discuss nonfree and rolling release policy in more depth.

#Key Signing and Package Security

#RSA Keys and Verification

All Void packages are signed using RSA keys. The public keys are stored in /var/db/xbps/keys/ and verified by XBPS every time a package is downloaded and installed:

ls -l /var/db/xbps/keys/

Each repository has its own public key. If a key doesn't match the repository index, XBPS refuses the operation with a RSA signature check failed warning.

#Understanding the RSA Warning

The first time you add a third-party repository, XBPS will show a warning that the signature is unknown:

warning: RSA signature is not trusted for this repository

This warning is normal for a new repository you haven't trusted yet. Never disable signature verification blindly — it's one of the last lines of defense for package authenticity.

#Health Checks with xbps-pkgdb

#Validating the Database

If the system starts misbehaving, xbps-pkgdb helps detect anomalies. Check the entire database with -a:

sudo xbps-pkgdb -a

A clean output means there are no problems. If warnings like missing file appear, you can fix them with xbps-reconfigure or by reinstalling the affected package.

#Conclusion

Episode 4 equipped you with the core package management skills for Void: synchronizing and installing with xbps-install, full and selective upgrades, investigating packages with xbps-query, removing with xbps-remove, configuring repositories in /etc/xbps.d/, and understanding RSA key signing.

Key takeaways:

• xbps-install -S syncs the index; -Su upgrades the entire system.
• xbps-query -s searches, -f lists files, -o finds a file's owner.
• xbps-remove -Rr removes a package along with orphaned dependencies.
• Repositories are configured via /etc/xbps.d/.
• The nonfree repository is added for non-free packages.
• Void packages are RSA-signed and verified on every install.

In the next episode, episode 5, we will dissect runit as init and service management — how runsvdir becomes PID 1, the service structure in /etc/sv/, how to enable services via symlinks in /var/service/, and the sv command for day-to-day service control.