Microsoft Linux Package Repositories

The Microsoft Linux Package Repositories are hosted on PMC (packages.microsoft.com) service. The PMC service is intended to support package hosting for customers with clients running a distribution of Linux. Microsoft builds and supports a variety of software products for Linux systems and makes them available via standard APT and YUM package repositories.

The package.microsoft.com team (PMC) maintains the infrastructure and metadata at packages.microsoft.com. When reporting an issue, please make sure it is directed to the right place. PMC handles issues related to the repository service itself — if your issue is with installing or using the software, please reach out to the product team or customer support instead.

Examples of issues that should be reported against this repo:

• Network connection errors
• Unexpected HTTP response codes
• Issues fetching repository metadata
• Checksum mismatch issues
• GPG signature verification failures
• Rate limiting (429 responses) — see Rate limiting
• DNS resolution failures for packages.microsoft.com
• TLS/SSL certificate errors
• Package missing from repository

Issues to report to the product team or customer support (see How to submit feedback below):

• Runtime errors
• Missing dependencies
• Version conflicts
• Package configuration errors
• Feature requests for specific packages
• Software bugs or unexpected behavior

Requests to packages.microsoft.com are limited to 4,000 requests per 5 minutes. Triggering our rate limiting rule will result in 429 responses being returned. If you run into issues with rate limiting, you can report a new issue.

See how to host/install/upgrade Microsoft's Linux software using your distribution's standard package management tools.
In short you may enable Microsoft's Production repository for your distribution / version by installing the packages-microsoft-prod.[rpm|deb] package found at the appropriate /config/ subdirectory, and there may be additional / alternate repositories you can enable by making the .repo|.list files available to your package manager.

Microsoft's Linux Software Repository is comprised of multiple repositories:

• prod – These Production repositories (e.g. Ubuntu, Fedora, RHEL, etc.) are designated for packages intended to be used in production. These packages are commercially supported by Microsoft under the terms of the applicable support agreement or program that you have with Microsoft. The prod repositories can be located via hierarchical folder structure (e.g. https://packages.microsoft.com/fedora/36/prod/).

• insiders-fast/insiders-slow – These repositories provide a way to preview upcoming features for software released into the Production repos. Packages generally flow from insiders-fast -> insiders-slow -> prod, but note that some software in the prod repos may not use these repos, and not all versions released here will be promoted to the next stage. NOTE: Not intended for production use.

• product-specific – These repositories contain packages for specific products, for example Microsoft SQL Server on Linux. Consult the product's documentation for installation instructions, as there may be additional setup required.

Note: Packages in the Linux software repositories are subject to the license terms located in the packages. Please read the license terms prior to using the package. Your installation and use of the package constitutes your acceptance of these terms. If you do not agree with the license terms, do not use the package.

The packages.microsoft.com infrastructure uses Azure Front Door to serve a majority of its packages. Microsoft publishes a list of Azure IP Ranges with the Front Door IPs listed under the AzureFrontDoor.Frontend service tag:

https://www.microsoft.com/en-us/download/details.aspx?id=56519

SQL packages are served from different regions so depending on your location you will receive SQL packages from an IP address in one of the following Service Tags:

• AzureCloud.eastasia
• AzureCloud.eastus2
• AzureCloud.northeurope
• AzureCloud.southeastasia
• AzureCloud.westeurope
• AzureCloud.westus2

Historically, packages.microsoft.com content was available on a second domain name: apt-mo.trafficmanager.net. This is a historical artifact from a time when packages.microsoft.com was not yet an official public offering. In May of 2025, we will be deprecating support for this domain name. Requests sent to this domain will be redirected to packages.microsoft.com to prevent impact. But customers using apt-mo are encouraged to update their repo references to prevent any future issues. This change will bring performance improvements, including better cache efficiency and faster cache purging operations.

In general in rpm-based distributions it is common to sign the individual rpms but not the repository metadata, and in deb-based distributions it is common to sign the repository metadata but not the individual debs. Microsoft signs both the individual packages and the repository metadata for both types of distributions. The public keys used for verifying Microsoft signatures can be found at /keys/. Customers are encouraged to use the configuration packages, located under https://packages.microsoft.com/config/, to ensure they acquire the correct key for a given repository.

Microsoft-2025.asc

• Microsoft's latest GPG public key may be downloaded here: https://packages.microsoft.com/keys/microsoft-2025.asc
• This key is associated with repositories created after April 2025, including RHEL 10, Debian 13, and Ubuntu 25.10
• Public Key ID: Microsoft (Release signing) Microsoft Corporation - General GPG Signer <gpgsign@microsoft.com>
• Public Key Fingerprint: AA86 F75E 427A 19DD 3334 6403 EE4D 7792 F748 182B

Microsoft.asc

• Microsoft's original public GPG key may be downloaded here: https://packages.microsoft.com/keys/microsoft.asc
• This key is associated with repositories created before May 2025, including RHEL 9, Debian 12, and Ubuntu 25.04
• Public Key ID: Microsoft (Release signing) gpgsecurity@microsoft.com
• Public Key Fingerprint: BC52 8686 B50D 79E3 39D3 721C EB3E 94AD BE12 29CF

Set repo_gpgcheck=1 in your repo file.

debsig-verify can be used to manually check the signature of an individual DEB. dpkg-sig is a competing individual-DEB signing standard with a different internal implementation, and it will not work for verifying Microsoft DEBs.

To use debsig-verify you must first create a policy file for it and provide Microsoft's public key.

1. Install debsig-verify.

   $ sudo apt install debsig-verify
   

2. Install the binary formatted (not ascii-armored) version of Microsoft's public key.

   $ wget https://packages.microsoft.com/keys/microsoft.asc -O /tmp/microsoft.asc
   $ sudo mkdir -p /usr/share/debsig/keyrings/EB3E94ADBE1229CF/
   $ sudo gpg -o /usr/share/debsig/keyrings/EB3E94ADBE1229CF/microsoft.gpg --dearmor /tmp/microsoft.asc
   

3. Create a debsig-verify policy file.

   $ sudo mkdir -p /etc/debsig/policies/EB3E94ADBE1229CF/
   $ sudo tee /etc/debsig/policies/EB3E94ADBE1229CF/microsoft.pol > /dev/null <<'EOF'
   <?xml version="1.0"?>
   <!DOCTYPE Policy SYSTEM "https://www.debian.org/debsig/1.0/policy.dtd">
   <Policy xmlns="https://www.debian.org/debsig/1.0/">
   
     <Origin Name="Microsoft" id="EB3E94ADBE1229CF" Description="gpgsecurity@microsoft.com"/>
   
     <Selection>
       <Required Type="origin" File="microsoft.gpg" id="EB3E94ADBE1229CF"/>
     </Selection>
   
     <Verification MinOptional="0">
       <Required Type="origin" File="microsoft.gpg" id="EB3E94ADBE1229CF"/>
     </Verification>
   
   </Policy>
   EOF
   

4. You can now verify individual DEBs.

   $ wget https://packages.microsoft.com/config/ubuntu/22.04/packages-microsoft-prod.deb -O /tmp/packages-microsoft-prod.deb
   $ debsig-verify /tmp/packages-microsoft-prod.deb
   debsig: Verified package from 'gpgsecurity@microsoft.com' (Microsoft)
   

Preview support for repository snapshots is now available on PMC (packages.microsoft.com). With PMC Snapshots, you can explore historical versions of specific Ubuntu repositories. The snapshot feature allows users to view and install packages as they existed at specific points in time, enabling reproducible deployments and helping to identify changes in package behavior over time. By using snapshots, you can recreate environments from any given date and time, which is particularly useful for tracking down when changes or regressions were introduced. Snapshots ensure that a validated environment can be consistently replicated across different stages of development and production, supporting a structured update workflow. This feature is similar to snapshot.debian.org and snapshot.ubuntu.com.

Snapshots are created automatically when a repository is updated, provided the previous snapshot is at least 7 days old. Repository administrators can also manually create snapshots as needed.

To access repository snapshots, go to the repository's snapshot path (like https://packages.microsoft.com/snapshot/ubuntu/24.04/prod/). Snapshots are identified by a UTC timestamp in their URL, representing the time it was created, such as https://packages.microsoft.com/snapshot/ubuntu/24.04/prod/20250501T193230Z/ for the 2025-05-01T19:32:30Z UTC state. Snapshots can be accessed using an arbitrary timestamp. When requesting a snapshot with a specific timestamp, if an exact match isn't found, you'll be redirected to the latest snapshot created before that time. Requesting a future or pre-first-snapshot timestamp will return a 404 error.

This feature is currently in preview and is not recommended for production workloads. Currently, there is no ETA for moving beyond preview status or for expanding support to additional repositories. For more information, check Pulp's checkpoint documentation and blog post which is the basis of the snapshot support in PMC.

Report an issue: Help us improve our service by reporting issues you are experiencing

Request a feature: Request a new feature or enhancement

Report a security vulnerability: Please review our security policy for more details

This project welcomes contributions and suggestions. Most contributions require you to agree to a Contributor License Agreement (CLA) declaring that you have the right to, and actually do, grant us the rights to use your contribution. For details, visit https://cla.opensource.microsoft.com.

When you submit a pull request, a CLA bot will automatically determine whether you need to provide a CLA and decorate the PR appropriately (e.g., status check, comment). Simply follow the instructions provided by the bot. You will only need to do this once across all repos using our CLA.

This project has adopted the Microsoft Open Source Code of Conduct. For more information see the Code of Conduct FAQ or contact opencode@microsoft.com with any additional questions or comments.

This project may contain trademarks or logos for projects, products, or services. Authorized use of Microsoft trademarks or logos is subject to and must follow Microsoft's Trademark & Brand Guidelines. Use of Microsoft trademarks or logos in modified versions of this project must not cause confusion or imply Microsoft sponsorship. Any use of third-party trademarks or logos are subject to those third-party's policies.