dpkg-buildpackage(1)

📦
version 1.23.11 · 22 versions
, in arch rolling

🎀 dpkg-buildpackage(1) 🎀

from the dpkg suite, bestie — this is the manual page for dpkg-buildpackage, and we’re gonna make it make sense 💖

✨ NAME ✨

dpkg-buildpackage — build binary or source packages from sources. Slay, that’s the whole job 💅

🌸 SYNOPSIS 🌸

dpkg-buildpackage [option...] [--] [filename.dsc|directory]

🦋 DESCRIPTION 🦋

dpkg-buildpackage is a program that automates the process of building a Debian package. iconic behavior, honestly 👑

Support for the filename.dsc and directory arguments since dpkg 1.22.7, with experimental semantics. yes bestie, experimental — proceed with the vibe check 🫶

It consists of the following steps:

  1. It runs the preinit hook before reading any source file. If a .dsc file has been specified it unpacks it anew and changes directory to it, if a directory has been specified it changes directory to it, otherwise it expects the current directory to contain the source tree. It prepares the build environment by setting various environment variables (see ENVIRONMENT), runs the init hook, and calls dpkg-source --before-build (unless -T or --target has been used).
  2. It checks that the build-dependencies and build-conflicts are satisfied (unless -d or --no-check-builddeps is specified). dependency drama check ✅
  3. If one or more specific targets have been selected with the -T or --target option, it calls those targets and stops here. Otherwise it runs the preclean hook and calls fakeroot debian/rules clean to clean the build-tree (unless -nc or --no-pre-clean is specified).
  4. It runs the source hook and calls dpkg-source -b to generate the source package (if a source build has been requested with --build or equivalent options, and if no .dsc has been specified).
  5. It runs the build hook and calls debian/rules build-target, then runs the binary hook followed by fakeroot debian/rules binary-target (unless a source-only build has been requested with --build=source or equivalent options). Note that build-target and binary-target are either build and binary (default case, or if an any and all build has been requested with --build or equivalent options), or build-arch and binary-arch (if an any and not all build has been requested with --build or equivalent options), or build-indep and binary-indep (if an all and not any build has been requested with --build or equivalent options). okay that’s a lot of targets but we’re keeping track 🎯
  6. It runs the buildinfo hook and calls dpkg-genbuildinfo to generate a .buildinfo file. Several dpkg-buildpackage options are forwarded to dpkg-genbuildinfo. If a .dsc has been specified, then it will be referenced in the generated .buildinfo file, as we can ascertain the provenance of the source tree.
  7. It runs the changes hook and calls dpkg-genchanges to generate a .changes file. The name of the .changes file will depend on the type of build and will be as specific as necessary but not more; the name will be:
    • source-name_binary-version_arch.changes — for a build that includes any
    • source-name_binary-version_all.changes — otherwise for a build that includes all
    • source-name_source-version_source.changes. — otherwise for a build that includes source

Many dpkg-buildpackage options are forwarded to dpkg-genchanges.

  1. It runs the postclean hook and if -tc or --post-clean is specified, it will call fakeroot debian/rules clean again.
  2. It calls dpkg-source --after-build.
  3. It runs the check hook and calls a package checker for the .changes file (if a command is specified in DEB_CHECK_COMMAND or with --check-command).
  4. It runs the sign hook and signs using the OpenPGP backend (as long as it is not an UNRELEASED build, or --no-sign is specified) to sign the .dsc file (if any, unless -us or --unsigned-source is specified), the .buildinfo file (unless -ui, --unsigned-buildinfo, -uc or --unsigned-changes is specified) and the .changes file (unless -uc or --unsigned-changes is specified).
  5. If a .dsc file has been specified, it removes the extracted source directory.
  6. It runs the done hook. and that’s the pipeline, bestie — no cap 🫡

🌈 OPTIONS 🌈

All long options can be specified both on the command line and in the dpkg-buildpackage system and user configuration files. Each line in the configuration file is either an option (exactly the same as the command line option but without leading hyphens) or a comment (if it starts with a ‘#’).

  • --build=type — Specifies the build type from a comma-separated list of components. All the specified components get combined to select the single build type to use, which implies a single build run with a single .changes file generated. Passed to dpkg-genchanges.

Supported since dpkg 1.18.5.

The allowed values are:

  • source — Builds the source package.

Note: When using this value standalone and if what you want is to only (re-)build the source package from a clean source tree, using dpkg-source directly is always a better option as it does not require any build dependencies to be installed which are otherwise needed to be able to call the clean target.

  • any — Builds the architecture specific binary packages.
  • all — Builds the architecture independent binary packages.
  • binary — Builds the architecture specific and independent binary packages. This is an alias for any,all.
  • full — Builds everything. This is an alias for source,any,all, and the same as the default case when no build option is specified.
  • -g — Equivalent to --build=source,all.

Supported since dpkg 1.17.11.

  • -G — Equivalent to --build=source,any.

Supported since dpkg 1.17.11.

  • -b — Equivalent to --build=binary or --build=any,all.
  • -B — Equivalent to --build=any.
  • -A — Equivalent to --build=all.
  • -S — Equivalent to --build=source.
  • -F — Equivalent to --build=full, --build=source,binary or --build=source,any,all.

Supported since dpkg 1.15.8.

  • --target=target[,...], --target target[,...], -T, --rules-target=target[,...] — Calls debian/rules target once per target specified, after having setup the build environment (except for calling dpkg-source --before-build), and stops the package build process here. If --as-root is also given, then the command is executed as root (see --root-command). Note that known targets that are required to be run as root do not need this option (i.e. the clean, binary, binary-arch and binary-indep targets).

Support for short option since dpkg 1.15.0. Support for long option since dpkg 1.18.8. Support for multiple targets since dpkg 1.18.16.

  • --as-root — Only meaningful together with --target. Requires that the target be run with root rights.

Supported since dpkg 1.15.0.

  • -si — Passed unchanged to dpkg-genchanges. See its manual page.
  • -sa — Passed unchanged to dpkg-genchanges. See its manual page.
  • -sd — Passed unchanged to dpkg-genchanges. See its manual page.
  • -vversion — Passed unchanged to dpkg-genchanges. See its manual page.
  • -Cchanges-description — Passed unchanged to dpkg-genchanges. See its manual page.
  • -mmaintainer-address — Passed unchanged to dpkg-genchanges. See its manual page.
  • -emaintainer-address — Passed unchanged to dpkg-genchanges. See its manual page.
  • --build-by=maintainer-address — Pass as -m to dpkg-genchanges. See its manual page.

Support for --build-by since dpkg 1.18.8.

  • --source-by=maintainer-address — Pass as -m to dpkg-genchanges. See its manual page.

Support for --source-by since dpkg 1.21.10.

  • --release-by=maintainer-address — Pass as -e to dpkg-genchanges. See its manual page.

Support for --release-by since dpkg 1.18.8.

  • --changed-by=maintainer-address — Pass as -e to dpkg-genchanges. See its manual page.

Support for --changed-by since dpkg 1.21.10.

  • -a, --host-arch architecture — Specify the Debian architecture we build for. The architecture of the machine we build on is determined automatically, and is also the default for the host machine.

Support for long option since dpkg 1.17.17.

  • -t, --host-type gnu-system-type — Specify the GNU system type we build for. It can be used in place of --host-arch or as a complement to override the default GNU system type of the host Debian architecture.

Support for long option since dpkg 1.17.17.

  • --target-arch architecture — Specify the Debian architecture the binaries built will build for. The default value is the host machine.

Supported since dpkg 1.17.17.

  • --target-type gnu-system-type — Specify the GNU system type the binaries built will build for.

It can be used in place of --target-arch or as a complement to override the default GNU system type of the target Debian architecture.

Supported since dpkg 1.17.17.

  • -P, --build-profiles=profile[,...] — Specify the profile(s) we build, as a comma-separated list. The default behavior is to build for no specific profile. Also sets them (as a space separated list) as the DEB_BUILD_PROFILES environment variable which allows, for example, debian/rules files to use this information for conditional builds.

The exclamation marks are not part of the build profile names, and thus not accepted in this option.

Support for short option since dpkg 1.17.2. Support for long option since dpkg 1.18.8.

  • -j, --jobs[=jobs|auto] — Specifies the number of jobs allowed to be run simultaneously. The number of jobs matching the number of online processors if auto is specified (since dpkg 1.17.10), or unlimited number if jobs is not specified. The default behavior is auto (since dpkg 1.18.11) in non-forced mode (since dpkg 1.21.10), and as such it is always safer to use with any package including those that are not parallel-build safe. Setting the number of jobs to 1 will restore serial execution.

Will add parallel=jobs or parallel to the DEB_BUILD_OPTIONS environment variable which allows debian/rules files to opt-in to use this information for their own purposes. The jobs value will override the parallel=jobs or parallel option in the DEB_BUILD_OPTIONS environment variable. Note that the auto value will get replaced by the actual number of currently active processors, and as such will not get propagated to any child process. If the number of online processors cannot be inferred then the code will fallback to using serial execution (since dpkg 1.18.15), although this should only happen on exotic and unsupported systems.

Support for short option since dpkg 1.14.7. Support for long option since dpkg 1.18.8.

  • -J, --jobs-try[=jobs|auto] — This option is equivalent to the -j above.

Since the behavior for -j changed in dpkg 1.21.10 to the opt-in mode, you can use this option instead if you need to guarantee semantics across dpkg release series.

Support for short option since dpkg 1.18.2. Support for long option since dpkg 1.18.8.

  • --jobs-force[=jobs|auto] — basically --jobs but with the volume cranked to eleven 💥 it turns on forced parallel mode by stuffing the make -j option, with the computed number of parallel jobs, into the MAKEFLAGS environment variable.

Which means every make invocation after that inherits it, forcing the parallel setting onto the packaging (and possibly onto the upstream build system too, if that one uses make(1)) whether or not they actually support parallel builds. And yeah — that can straight up cause build failures. 😭

Note: any Makefile that isn't parallel-safe should be considered buggy. Make it parallel-safe, or mark it as not safe with the make(1) .NOTPARALLEL target. No exceptions, bestie.

Supported since dpkg 1.21.10.

  • -D, --check-builddeps — check build dependencies and conflicts, and abort if they're not satisfied. This is the default behaviour, so it's already doing this for you, queen 🫶

Support for long option since dpkg 1.18.8.

  • -d, --no-check-builddeps — do not check build dependencies and conflicts. Living dangerously, love that for you.

Support for long option since dpkg 1.18.8.

  • --ignore-builtin-builddeps — don't check built-in build dependencies and conflicts. These are the distribution-specific implicit build dependencies that a build environment usually requires, aka the so-called Build-Essential package set.

Supported since dpkg 1.18.2.

  • --rules-requires-root — do not honour the Rules-Requires-Root field, falling back to its legacy default value binary-targets.

Supported since dpkg 1.19.1.

  • -nc, --no-pre-clean — don't clean the source tree before building. Implies -b if nothing else has been selected among -F, -g, -G, -B, -A or -S. Implies -d with -S (since dpkg 1.18.0).

Support for long option since dpkg 1.18.8.

  • --pre-clean — clean the source tree before building. This is the default behaviour, so things stay tidy ✨

Supported since dpkg 1.18.8.

  • -tc, --post-clean — clean the source tree after the package has been built (using gain-root-command debian/rules clean).

Support for long option since dpkg 1.18.8.

  • --no-post-clean — don't clean the source tree after the package has been built. This is the default behaviour.

Supported since dpkg 1.19.1.

  • --sanitize-env — sanitize the build environment. It resets or removes environment variables, umask, and any other process attributes that might otherwise mess with the build of packages 😤 Because the official entry point for building packages is debian/rules, packages can't rely on these settings being in place, and should work even when they're not. What gets sanitized is vendor specific.

Supported since dpkg 1.20.0.

  • -r, --root-command=gain-root-command — when dpkg-buildpackage needs to run part of the build process as root, it prefixes the command it executes with gain-root-command, if one has been specified. If none has been specified, fakeroot gets used by default, if the command is present. gain-root-command should start with the name of a program on the PATH, and it receives as arguments the name of the real command to run plus the arguments it should take. gain-root-command can include parameters (they must be space-separated) but no shell metacharacters. Typically gain-root-command might be fakeroot, sudo, super or really. su is not suitable, because it can only invoke the user's shell with -c instead of passing arguments individually to the command to be run. 💀

Support for long option since dpkg 1.18.8.

  • -R, --rules-file=rules-file — building a Debian package usually means invoking debian/rules as a command with several standard parameters. With this option you can use a different program invocation to build the package instead (it can include space-separated parameters). Or you can use it to execute the standard rules file with another make program — for example by using /usr/local/bin/make -f debian/rules as rules-file. Iconic flexibility behaviour 👑

Support for short option since dpkg 1.14.17. Support for long option since dpkg 1.18.8.

  • --check-command=check-command — the command used to check the .changes file itself and any artifact built that's referenced in the file. The command should take the .changes pathname as an argument. This command will usually be lintian.

Supported since dpkg 1.17.6.

  • --check-option=opt — pass option opt to the check-command specified with DEB_CHECK_COMMAND or --check-command. Can be used multiple times, stack 'em up 🎀

Supported since dpkg 1.17.6.

  • --hook-hook-name=hook-command — set the specified shell code hook-command as the hook hook-name, which runs at the times specified in the run steps. The hooks always get executed even if the following action isn't performed (except for the binary hook). All the hooks run in the unpacked source directory.

Some hooks can receive additional information through environment variables (since dpkg 1.22.0). All hooks get the hook name in the DPKG_BUILDPACKAGE_HOOK_NAME environment variable (since dpkg 1.22.0).

Note: hooks can affect the build process, and cause build failures if their commands fail, so watch out for unintended consequences. Fr fr, be careful.

The current *hook-name*s supported are:

  • preinit
  • init
  • preclean
  • source — gets DPKG_BUILDPACKAGE_HOOK_SOURCE_OPTIONS with the space-separated lists of options that will be passed to the dpkg-source call.
  • build — gets DPKG_BUILDPACKAGE_HOOK_BUILD_TARGET with the name of the debian/rules build target called. Before dpkg 1.22.7 the variable was only set if the target was called.
  • binary — gets DPKG_BUILDPACKAGE_HOOK_BINARY_TARGET with the name of the debian/rules binary target called, but only if called.
  • buildinfo — gets DPKG_BUILDPACKAGE_HOOK_BUILDINFO_OPTIONS with the space-separated lists of options that will be passed to the dpkg-genbuildinfo call.
  • changes — gets DPKG_BUILDPACKAGE_HOOK_CHANGES_OPTIONS with the space-separated lists of options that will be passed to the dpkg-genchanges call.
  • postclean
  • check — gets DPKG_BUILDPACKAGE_HOOK_CHECK_OPTIONS with the space-separated lists of options that will be passed to the check command call.
  • sign
  • done

The hook-command supports the following substitution format string, which gets applied to it before execution:

  • %% — a single % character.
  • %a — a boolean value (0 or 1), representing whether the following action is being performed.
  • %p — the source package name.
  • %v — the source package version.
  • %s — the source package version (without the epoch).
  • %u — the upstream version.

Supported since dpkg 1.17.6.

  • --buildinfo-file=filename — set the filename for the generated .buildinfo file.

Supported since dpkg 1.21.0.

  • --buildinfo-option=opt — pass option opt to dpkg-genbuildinfo. Can be used multiple times.

Supported since dpkg 1.18.11.

  • --sign-backend=sign-backend — specify an OpenPGP backend interface to use when invoking the sign-command.

The default is auto, where the best current backend available gets used. The specific OpenPGP backends supported, in order of preference, are:

  • sop — any conforming Stateless OpenPGP (SOP) implementation, such as sqop, rsop, gosop, hop or pgpainless-cli.
  • sq — from Sequoia-PGP.
  • gpg — from GnuPG.

Supported since dpkg 1.21.10.

  • -p, --sign-command=sign-command — when dpkg-buildpackage needs to execute an OpenPGP backend command to sign a source control (.dsc) file, a .buildinfo file or a .changes file, it runs sign-command (searching the PATH if necessary) instead of the default or auto-detected backend command. sign-command gets all the backend specific arguments according to the --sign-backend selected. sign-command should not contain spaces or any other shell metacharacters.

Support for long option since dpkg 1.18.8.

  • -k, --sign-keyid=key-id — specify an OpenPGP key-ID (either a fingerprint or a user-ID) for the secret key to use when signing packages 🔑

Support for long option since dpkg 1.21.10.

  • --sign-key=key-id — deprecated since dpkg 1.23.8, replaced by --sign-keyid. Supported since dpkg 1.18.8.
  • --sign-keyfile=key-file — specify an OpenPGP key-file containing the secret key to use when signing packages.
Note: for security reasons the key-file is best kept locked with a password. Please bestie 🙈

Supported since dpkg 1.21.10.

  • -us, --unsigned-source — do not sign the source package.

Support for long option since dpkg 1.18.8.

  • -ui, --unsigned-buildinfo — do not sign the .buildinfo file.

Supported since dpkg 1.18.19.

  • -uc, --unsigned-changes — do not sign the .buildinfo and .changes files.

Support for long option since dpkg 1.18.8.

  • --no-sign — do not sign any file — this includes the source package, the .buildinfo file and the .changes file. Nothing gets a signature, we're going fully anonymous 🫥

Supported since dpkg 1.18.20.

  • --force-sign — force the signing of the resulting files, regardless of -us, --unsigned-source, -ui, --unsigned-buildinfo, -uc, --unsigned-changes or other internal heuristics. It overrides the overrides ✨

Supported since dpkg 1.17.0.

  • -sn, -ss, -sA, -sk, -su, -sr, -sK, -sU, -sR — passed unchanged to dpkg-source. See its manual page.
  • -i, --diff-ignore[=regex], -I, --tar-ignore[=pattern], -z, --compression-level=level, -Z, --compression=compressor — passed unchanged to dpkg-source. See its manual page.

Support for long options since dpkg 1.18.8.

  • --source-option=opt — pass option opt to dpkg-source. Can be used multiple times.

Supported since dpkg 1.15.6.

  • --changes-file=filename — set the filename for the generated .changes file.

Supported since dpkg 1.21.0.

  • --changes-option=opt — pass option opt to dpkg-genchanges. Can be used multiple times.

Supported since dpkg 1.15.6.

  • --admindir=dir, --admindir dir — change the location of the dpkg database. The default location is /var/lib/dpkg.

Supported since dpkg 1.14.0.

  • -?, --help — show the usage message and exit.
  • --version — show the version and exit.

🌈 ENVIRONMENT 🌈

okay bestie, this is where dpkg-buildpackage reads the vibes from the world around it. There are two whole layers: the external env vars you can set yourself, and the internal ones the tool exports for the build. Let’s get into it. 🫶

💖 External environment 💖

These are the ones you can set in your shell, CI, whatever — the main character env vars. ✨

  • DEB_CHECK_COMMAND — if it’s set, it’s the command used to check the .changes file. The --check-command option overrides it. Supported since dpkg 1.17.6. 💅
  • DEB_SIGN_KEYID — if set, it signs the .changes, .buildinfo and .dsc files. The --sign-keyid option overrides it. Supported since dpkg 1.17.2.
  • DEB_SIGN_KEYFILE — if set, it signs the .changes, .buildinfo and .dsc files. The --sign-keyfile option overrides it. Supported since dpkg 1.21.10. 🎀
  • DEB_BUILD_OPTIONS — this one is the big group-chat of build options, fr fr. If set, it holds a space-separated list of options that affect how some dpkg tools behave during package building, and might affect the package build process if the code in debian/rules honors them. Options can have parameters right after an equal sign (=). For options that support multiple parameters, those parameters are not separated by spaces — spaces are reserved for separating options. The following are the options known and supported by dpkg tools; other options honored by debian/rules might be defined by distribution-specific policies.
    • parallel=N — the debian/rules in the packaging might use this option to set up the build process with N parallel jobs. It’s overridden by the --jobs and --jobs-force options. 🔥
    • nocheck — dpkg-buildpackage will ignore the DEB_CHECK_COMMAND variable. The debian/rules in the packaging is not expected to run test suites during the build.
    • noopt — if debian/rules calls dpkg-buildflags to set up the build flags, those flags will be set to not enable any optimizations.
    • nostrip — the debian/rules in the packaging should ensure that objects do not get their debugging information stripped. If debian/rules includes the mk/buildtools.mk make fragment, the STRIP make variable will respect this option. 💅
    • terse — dpkg-buildpackage will append the --no-print-directory make(1) flag to the MAKEFLAGS environment variable. The debian/rules in the packaging should reduce verbosity, while not being completely quiet. 🤫
    • hardening=feature-spec, reproducible=feature-spec, abi=feature-spec, future=feature-spec, qa=feature-spec, optimize=feature-spec, sanitize=feature-spec — these are feature areas that control build flag features. See dpkg-buildflags(1) for further details. ⭐
  • DEB_BUILD_PROFILES — if set, it’s used as the active build profile(s) for the package being built. It’s a space separated list of profile names, without any exclamation marks. The -P option overrides it. Supported since dpkg 1.17.2. 🌸
  • DPKG_COLORS — sets the color mode. The currently accepted values are: auto (default), always and never. Supported since dpkg 1.18.5. 🌈
  • DPKG_NLS — if set, it decides whether to activate Native Language Support, also known as internationalization (or i18n) support. The accepted values are: 0 and 1 (default). Supported since dpkg 1.19.0. ✨

🦋 Internal environment 🦋

Now for the backstage variables. Even though dpkg-buildpackage exports some variables, debian/rules should not rely on their presence, and should instead use the respective interface to retrieve the needed values — because that file is the main entry point to build packages, and running it standalone should be supported. iykyk. 💜

  • DEB_BUILD_*, DEB_HOST_*, DEB_TARGET_* — dpkg-architecture is called with the -a and -t parameters forwarded. Any variable that is output by its -s option is integrated in the build environment.
  • DEB_RULES_REQUIRES_ROOT — this variable is set to the value obtained from the Rules-Requires-Root field, the dpkg-build-api level or from the command-line. When set, it will be a valid value for the Rules-Requires-Root field. It is used to notify debian/rules whether the rootless-builds.txt specification is supported.
  • DEB_GAIN_ROOT_CMD — this variable is set to gain-root-command when the field Rules-Requires-Root is set to a value different to no and binary-targets.
  • SOURCE_DATE_EPOCH — this variable is set to the Unix timestamp since the epoch of the latest entry in debian/changelog, if it is not already defined. ⏳

🎀 FILES 🎀

  • /etc/dpkg/buildpackage.conf — system wide configuration file. 🗂️
  • $XDG_CONFIG_HOME/dpkg/buildpackage.conf, $HOME/.config/dpkg/buildpackage.conf — user configuration file.

🔥 NOTES 🔥

A couple of glow-ups and receipts you should know about. 👀

💀 Compiler flags are no longer exported 💀

Between dpkg 1.14.17 and 1.16.1, dpkg-buildpackage exported compiler flags (CFLAGS, CXXFLAGS, FFLAGS, CPPFLAGS and LDFLAGS) with values as returned by dpkg-buildflags. That is no longer the case. Not me finding out the old way. 😭

🎯 Default build targets 🎯

dpkg-buildpackage is using the build-arch and build-indep targets since dpkg 1.16.2. Before dpkg 1.22.7, there was code to try to detect the missing targets and fall back on the build target. Those targets are thus mandatory. No cap. 🫶

🔐 SECURITY 🔐

Building binary or source packages should only be performed over trusted source data. That’s the whole vibe check: trust the source, bestie. 💅

🐛 BUGS 🐛

It should be possible to specify spaces and shell metacharacters and initial arguments for gain-root-command and sign-command. That’s the bug note — act accordingly. 🙈

🌟 SEE ALSO 🌟

That’s the whole page, bestie — source: dpkg-buildpackage(1), version 1.23.11-dirty, dated 2026-09-09. Slay. 💖✨

📦 where this page comes from