DEBSUMS(1)

💖 DEBSUMS(1) 💖

okay bestie, pull up a chair, because debsums is literally the vibe-check tool for your Debian install ✨

debsums — check the MD5 sums of installed Debian packages. no cap, that's the whole job and it eats every time 💅

---

✨ SYNOPSIS ✨

debsums [options] [package|deb] ...

---

🦋 DESCRIPTION 🦋

So here's the tea, bestie: debsums verifies your installed Debian package files against the MD5 checksum lists that live in /var/lib/dpkg/info/*.md5sums. it's giving "did somebody touch my files or is this just the normal amount of file" 🌸

And here's the iconic part — debsums can generate checksum lists from deb archives for packages that don't include one. like, it'll make the receipts for you 🎀

---

👑 OPTIONS 👑

• -a, --all — also check configuration files (normally excluded). yes bestie, the config files get a vibe check too.
• -e, --config — only check configuration files. just the configs, nothing else, periodt.
• -c, --changed — report the changed file list to stdout (implies -s). heads up: this quietly turns on silent mode too.
• -l, --list-missing — list packages (or debs) which don't have an MD5 sums file. a little "who forgot their homework" list 📋
• -s, --silent — only report errors. no small talk, only problems.
• *-m, --md5sums=file* — read the list of deb checksums from file.
• *-r, --root=dir* — root directory to check (default /).
• *-d, --admindir=dir* — dpkg admin directory (default /var/lib/dpkg).
• *-p, --deb-path=dir[:dir...]* — directories in which to look for debs derived from the package name (default is the current directory).

a genuinely useful value here is /var/cache/apt/archives when you're using apt-get autoclean or not clearing the cache at all. so like, this command:

apt-get --reinstall -d install `debsums -l`

may be used to populate the cache with any debs not already in the cache. slay. 🔥

Note: this doesn't work for CD-ROM and other local sources as packages are not copied to /var/cache. simple file sources (all debs in a single directory) should be added to the -p list. iykyk 🙈

• -g, --generate=[missing|all][,nocheck] — generate MD5 sums from deb contents. if the argument is a package name rather than a deb archive, the program will look for a deb named package_version_arch.deb in the directories given by the -p option.
  • missing — generate MD5 sums from the deb for packages which don't provide one.
  • all — ignore the on disk sums and use the one supplied in the deb, or generated from it if none exists.
  • nocheck — the extracted/generated sums are not checked against the installed package.

for backward compatibility, the short option -g is equivalent to --generate=missing. 🧚

• --no-locale-purge — report missing locale files even if localepurge is configured.
• --no-prelink — report changed ELF files even if prelink is configured.
• --ignore-permissions — treat permission errors as warnings when running as non-root. we're being chill about it 💜
• --ignore-obsolete — ignore obsolete conffiles.
• --help / --version — print help and version information.

---

💀 EXIT STATUS 💀

debsums returns 0 on success, or a *combination** of the following values on error:

1. 1 — a specified package or archive name was not installed, invalid, or the installed version did not match the given archive.
2. 2 — changed or missing package files, or checksum mismatch on an archive.
3. 255 — invalid option.

*If both of the first two conditions are true, the exit status will be 3.

---

🌈 EXAMPLES 🌈

• debsums foo bar — check the sums for installed packages foo and bar.
• debsums foo.deb bar.deb — as above, using checksums from (or generated from) the archives.
• debsums -l — list installed packages with no checksums.
• debsums -ca — list changed package files from all installed packages with checksums.
• debsums -ce — list changed configuration files.
• debsums -cagp /var/cache/apt/archives — as above, using sums from cached debs where available.

and the big one, bestie — reinstalling packages with changed files:

apt-get install --reinstall $(dpkg -S $(debsums -c) | cut -d : -f 1 |
sort -u)

---

🍓 RESULTS 🍓

• OK — the file's MD5 sum is good. we love to see it 💖
• FAILED — the file's MD5 sum does not match. 😭
• REPLACED — the file has been replaced by a file from a different package.

---

🌸 SEE ALSO 🌸

md5sum(1), — go give it a little kiss too 🫶

---

✨ ENVIRONMENT ✨

• TMPDIR — directory for extracting information and contents from package archives (/tmp by default).

---

⭐ CAVEATS ⭐

ngl, there are some things you gotta know before you go off:

While in general the program may be run as a normal user, some packages contain files which are not globally readable so cannot be checked. privileges are of course also required when generating sums with the keep option set.

Files which have been replaced by another package may be erroneously reported as changed. so like, don't panic immediately 💀

debsums is intended primarily as a way of determining what installed files have been locally modified by the administrator or damaged by media errors and is of limited use as a security tool. read that again, bestie — it is not your security tool, okay?

If you are looking for an integrity checker that can run from safe media, do integrity checks on checksum databases and can be easily configured to run periodically to warn the admin of changes see other tools such as: aide, integrit, samhain, or tripwire.

---

🎀 AUTHOR 🎀

Written by Brendan O'Dea <bod@debian.org>. Based on a program by Christoph Lameter <clameter@debian.org> and Petr Cech <cech@debian.org>.

---

👑 COPYRIGHT 👑

Copyright © 2002 Brendan O'Dea <bod@debian.org> This is free software, licensed under the terms of the GNU General Public License. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

---

and that's the whole page, bestie 💅 this was User Commands realness from the Debian fam, filed under DEBSUMS(1) — go check your sums and stay iconic 👑✨🦋