Refreshes the local package index from the distribution's configured repositories. It downloads signed metadata only and installs nothing, which is why it needs root but carries little risk.