Debian — philosophy, versions and social contract

Objective

Understand what Debian is, how its versions are organized and how long they are maintained. By the end, you will be able to tell in ten seconds whether a Debian server is still "within the rules" or needs an urgent upgrade.

Key points

• Debian is a community distribution: no company owns it. Thousands of volunteers have built it since 1993.
• There are always three branches: stable (for servers), testing (the future stable) and unstable, nicknamed sid.
• Each version has a number (12, 13…) and a code name taken from the film Toy Story (bookworm, trixie…).
• A stable version comes out about every two years and receives about five years of security updates (three normal years + two years of LTS).
• The social contract and the Debian Free Software Guidelines (DFSG) decide what goes into the distribution.

1. A project without a boss

Debian was created on 16 August 1993 by Ian Murdock. The name combines the first name of his girlfriend at the time, Debra, with his own, Ian.

Unlike Red Hat (a company) or Ubuntu (backed by the company Canonical), Debian belongs to its members:

• the Debian developers (more than a thousand) maintain the packages;
• every year they elect a project leader (the DPL, Debian Project Leader);
• major decisions go through votes (the "general resolutions").

The result: Debian evolves slowly, but it is very predictable. That is exactly what you expect from a server. Many other distributions are built from Debian: Ubuntu, Linux Mint, Kali Linux, Raspberry Pi OS…

Example: an SME in Casablanca that hosts its invoicing on a Debian server knows that nothing will change suddenly during the whole life of the version: no new major version of PHP or MariaDB along the way, only fixes.

2. The social contract and the DFSG

In 1997, Debian published two founding documents.

The social contract is a promise made to users. In summary:

1. Debian will remain 100% free.
2. Debian will give back its improvements to the free software community.
3. Debian will not hide its problems: the bug database is public.
4. The priorities are users and free software.
5. Software that is not free is tolerated separately, in separate sections, for those who need it.

The DFSG (Debian Free Software Guidelines) are the checklist used to decide whether a license is "free": right to redistribute, access to the source code, right to modify, no discrimination against people or uses, and so on.

This is why the Debian archive is split into sections:

Remember: before Debian 12, firmware was mixed with the rest of non-free. Since Debian 12, the official installer includes it and automatically enables the non-free-firmware section if your hardware needs it. A machine whose network card requires firmware can finally be installed without workarounds.

3. The three branches: stable, testing, unstable

A new package always follows the same path:

  developer ──► unstable (sid) ──► testing ──► stable
                « just            « survived    « frozen
                 arrived »         2 to 10       and tested »
                                   days »

About every two years, testing is frozen (freeze): no more new features, only bug fixes. When it is ready, it becomes the new stable, and a new testing starts.

Sid never changes its name. In Toy Story, Sid is the neighbor who breaks toys: a well-chosen name for the branch where anything can break.

Never put testing or unstable on a production server. These branches do not have organized security tracking like stable (unstable has none at all).

4. Numbers and code names

Each version carries the name of a Toy Story character:

Before stretch, the versions were already called buzz (1.1, in 1996), rex, bo, hamm, slink, potato, woody, sarge, etch, lenny, squeeze, wheezy and jessie (Debian 8).

The words stable, oldstable and testing are moving labels: the day Debian 13 came out, "stable" stopped meaning bookworm and started meaning trixie. The code name, however, never moves.

Administrator tip: in a server's repository configuration, write the code name (bookworm, trixie) rather than stable. Otherwise, on the day of a new release, a simple apt full-upgrade could start a major version upgrade without you deciding it.

5. How long is a version maintained?

 release               +3 years approx.                       +5 years
   │── normal support (Debian security team) ──│──── LTS ────│
   │   security updates + point                 │ LTS team:   │
   │   releases (12.1, 12.2, …)                 │ security    │
   │                                            │ only        │

• Normal support: the Debian security team publishes fixes for about three years; the previous version therefore stays covered for a few months after the next one comes out, giving you time to migrate.
• LTS (Long Term Support): a team funded by companies extends security support to about five years in total, for the most common architectures (amd64, arm64…).
• Beyond that, some companies sell extended support (ELTS), which is no longer part of Debian.

Point releases (12.1, 12.2… 13.1…) are not new versions: they are "snapshots" of stable that gather fixes already published. An up-to-date server moves from 12.5 to 12.6 on its own, with a simple apt upgrade.

6. Recognizing a server's version

cat /etc/debian_version      # exact number, e.g. 12.7
cat /etc/os-release          # full identity card: NAME, VERSION_ID, VERSION_CODENAME…
grep VERSION_CODENAME /etc/os-release   # just the code name

Example output on a Debian 12 server:

PRETTY_NAME="Debian GNU/Linux 12 (bookworm)"
VERSION_ID="12"
VERSION_CODENAME=bookworm
ID=debian

On a machine running testing or unstable, /etc/debian_version often contains something like forky/sid instead of a number: this is the immediate sign that it is not a stable release.

By version

Common pitfalls

• Confusing "stable" with "the version on my server". A Debian 12 server installed in 2023 has no longer been "the stable" since August 2025: it is the oldstable.
• Putting testing on a server to get newer software. You lose stability and organized security tracking. Look for backports instead (covered later in the course).
• Believing that a point release (12.4 → 12.5) is a version upgrade. It is only a bundle of fixes: it arrives through a normal update.
• Forgetting the end-of-support date. A Debian 10 server has received no fixes since mid-2024: every vulnerability found since then remains open.

Lab

The lab is a Debian 12 machine. You will identify it the way an administrator does when discovering a server:

1. record the exact version number;
2. find its code name in /etc/os-release;
3. show that you know what "sid" corresponds to.

Start by exploring:

cat /etc/debian_version
cat /etc/os-release

Quiz

1. Who founded Debian, and in what year?
2. Which branch should you use on a production server? Why not testing?
3. What is the code name of Debian 12? And of Debian 13?
4. Which section has contained non-free firmware since Debian 12?
5. Why is it better to write trixie rather than stable in the repository configuration?

Reference sources: Debian Reference, The Debian Administrator's Handbook, Debian Installation Guide (free licenses). Original MasterLinux text.