dpkg-deb(1)

📦
version 1.23.11 · 22 versions
, in arch rolling

okay so bestie, this is dpkg-deb(1) from the dpkg suite — the manual page for the Debian package archive (.deb) manipulation tool, and we’re gonna make it make sense 💅✨

🎀 NAME 🎀

dpkg-deb — Debian package archive (.deb) manipulation tool 🦋

✨ SYNOPSIS ✨

dpkg-deb [option...] command

🌈 DESCRIPTION 🌈

dpkg-deb packs, unpacks and provides information about Debian archives. That’s the whole vibe.

Use dpkg to install and remove packages from your system, bestie — dpkg-deb is not the installer, okay? 🔥

You can also invoke dpkg-deb by calling dpkg with whatever options you want to pass to dpkg-deb. dpkg will spot that you wanted dpkg-deb and run it for you. Love that for us 🫶

For most commands taking an input archive argument, the archive can be read from standard input if the archive name is given as a single minus character (-); otherwise lack of support will be documented in their respective command description. Yes, - means stdin sometimes — iconic but not universal 🎀

💅 COMMANDS 💅

  • -b, --build binary-directory [archive|directory] — creates a debian archive from the filesystem tree stored in binary-directory. binary-directory must have a DEBIAN subdirectory, which contains the package metadata files such as the binary package control file. This directory will not appear in the binary package’s filesystem archive, but instead the files in it will be put in the binary package’s control information area.

Unless you specify --no-check, dpkg-deb will read DEBIAN/control and parse it. It will check the file for syntax errors and other problems, and display the name of the binary package being built. dpkg-deb will also check the permissions of the maintainer scripts and other files found in the DEBIAN package metadata directory.

If no archive is specified then dpkg-deb will write the package into the file binary-directory.deb.

If the archive to be created already exists it will be overwritten. (yes, zero hesitation 💀)

If the second argument is a directory then dpkg-deb will write to the file directory/package_version_arch.deb. When a target directory is specified, rather than a file, the --no-check option may not be used (since dpkg-deb needs to read and parse the package control file to determine which filename to use).

  • -I, --info archive [control-file-name...] — provides information about a binary package archive.

If no control-file-names are specified then it will print a summary of the contents of the package as well as its control file.

If any control-file-names are specified then dpkg-deb will print them in the order they were specified; if any of the components weren’t present it will print an error message to stderr about each one and exit with status 2.

  • -W, --show archive — provides information about a binary package archive in the format specified by the --showformat argument. The default format displays the package’s name and version on one line, separated by a tabulator.
  • -f, --field archive [control-field-name...] — extracts control file information from a binary package archive.

If no control-field-names are specified then it will print the whole control file.

If any are specified then dpkg-deb will print their contents, in the order in which they appear in the control file. If more than one control-field-name is specified then dpkg-deb will precede each with its field name (and a colon and space).

No errors are reported for fields requested but not found. Ghosted fields don’t get a complaint 🙈

  • -c, --contents archive — lists the contents of the filesystem tree archive portion of the package archive. It is currently produced in the format generated by tar’s verbose listing.
  • -x, --extract archive directory — extracts the filesystem tree from a package archive into the specified directory.
Note: extracting a package to the root directory will not result in a correct installation! Use dpkg to install packages.

directory (but not its parents) will be created if necessary, and its permissions modified to match the contents of the package.

  • -X, --vextract archive directory — is like --extract (-x) with --verbose (-v) which prints a listing of the files extracted as it goes.
  • -R, --raw-extract archive directory — extracts the filesystem tree from a package archive into a specified directory, and the package metadata files into a DEBIAN subdirectory of the specified directory.

The target directory (but not its parents) will be created if necessary.

The input archive is not processed sequentially, so reading it from standard input (-) is not supported. So no sneaky stdin for this one 😤

Supported since dpkg 1.16.1.

  • --ctrl-tarfile archive — extracts the control data from a binary package and sends it to standard output in tar format. Together with tar(1) this can be used to extract a particular control file from a package archive.

The input archive might be processed non-sequentially if possible, and will fall back to be processed sequentially at the cost of fewer robustness or security checks.

Supported since dpkg 1.17.14.

  • --fsys-tarfile archive — extracts the filesystem tree data from a binary package and sends it to standard output in tar format. Together with tar(1) this can be used to extract a particular file from a package archive.

The input archive might be processed non-sequentially if possible, and will fall back to be processed sequentially at the cost of fewer robustness or security checks.

  • -e, --control archive [directory] — extracts the package metadata files from a package archive into the specified directory.

If no directory is specified then a subdirectory DEBIAN in the current directory is used.

The target directory (but not its parents) will be created if necessary.

  • -?, --help — show the usage message and exit.
  • --version — show the version and exit.

🌸 OPTIONS 🌸

  • --showformat=format — this option is used to specify the format of the output --show will produce. The format is a string that will be output for each package listed.

The string may reference any status field using the ${field-name} form, a list of the valid fields can be easily produced using -I on the same package. A complete explanation of the formatting options (including escape sequences and field tabbing) can be found in the explanation of the --showformat option in dpkg-query(1).

The default for this field is ${Package}\t${Version}\n. Yes, that’s tab and newline coded in there, bestie ✨

  • -z, --compression-level=compress-level — specify which compression level to use on the compressor backend, when building a package (default is 9 for gzip, 6 for xz, 3 for zstd). The accepted values are compressor specific. For gzip, from 0-9 with 0 being mapped to compressor none. For xz from 0-9. For zstd from 0-22, with levels from 20 to 22 enabling its ultra mode. Before dpkg 1.16.2 level 0 was equivalent to compressor none for all compressors.

Support for long option since dpkg 1.22.9.

  • -S, --compression-strategy=compress-strategy — specify which compression strategy to use on the compressor backend, when building a package. Allowed values are none (since dpkg 1.16.4), filtered, huffman, rle and fixed for gzip (since dpkg 1.17.0) and extreme for xz.

Support for short option since dpkg 1.16.2. Support for long option since dpkg 1.22.9.

  • -Z, --compression=compress-type — specify which compression type to use when building a package. Allowed values are gzip, xz (since dpkg 1.15.6), zstd (since dpkg 1.21.18) and none (default is xz).

Support for long option since dpkg 1.22.9.

  • --uniform-compression — specify that the same compression parameters should be used for all archive members (i.e. control.tar and data.tar).

The only supported compression types allowed to be uniformly used are none, gzip, xz and zstd.

Uniform compression is the default (since dpkg 1.19.0).

Supported since dpkg 1.17.6.

  • --no-uniform-compression — specify that only the data.tar archive member will use the compression parameters specified. The control.tar archive member will use gzip in its default compression parameters.

Supported since dpkg 1.19.0.

  • --threads-max=threads — sets the maximum number of threads allowed for compressors that support multi-threaded operations.

Supported since dpkg 1.21.9.

  • --root-owner-group — set the owner and group for each entry in the filesystem tree data to root with id 0.
Note: this option can be useful for rootless builds (see rootless-builds.txt), but should not be used when the entries have an owner or group that is not root. Support for these will be added later in the form of a meta manifest.

Supported since dpkg 1.19.0.

  • --deb-format=format — set the archive format version used when building. Allowed values are 2.0 for the new format, and 0.939000 for the old one (default is 2.0).

The old archive format is less easily parsed by non-Debian tools and is now obsolete; its only use is when building packages to be parsed by versions of dpkg older than 0.93.76 (September 1995), which was released as i386 a.out only.

Supported since dpkg 1.17.0.

  • --no-check — inhibits dpkg-deb --build’s usual checks on the proposed contents of an archive. You can build any archive you want, no matter how broken, this way.

Supported since dpkg 1.22.12.

  • --nocheck — this is an alias for --no-check.
  • -v, --verbose — enables verbose output. This currently only affects --extract making it behave like --vextract.

Supported since dpkg 1.16.1.

  • -D, --debug — enables debugging output. This is not very interesting. ngl the manual page said it, not me 💀

🦋 EXIT STATUS 🦋

  • 0 — the requested action was successfully performed. Slay ✅
  • 2 — fatal or unrecoverable error due to invalid command-line usage, or interactions with the system, such as accesses to the database, memory allocations, etc. Oof 😭

🌸 ENVIRONMENT 🌸

okay so these are the env vars that vibe with dpkg-deb, and yeah, each one is a whole personality 💅

  • DPKG_DEB_THREADS_MAX — sets the max number of threads allowed for compressors that support multi-threaded operations. the --threads-max option overrides this value, so like, the flag wins, periodt. supported since dpkg 1.21.9.
  • DPKG_DEB_COMPRESSOR_TYPE — sets the compressor type to use. the -Z option overrides this value. supported since dpkg 1.21.10.
  • DPKG_DEB_COMPRESSOR_LEVEL — sets the compressor level to use. the -z option overrides this value. supported since dpkg 1.21.10.
  • DPKG_COLORS — sets the color mode ✨ the currently accepted values are: auto (default), always and never. supported since dpkg 1.18.5.
  • DPKG_NLS — if set, it's used to decide whether to activate Native Language Support, also known as internationalization (or i18n) support. the accepted values are: 0 and 1 (default). supported since dpkg 1.22.7.
  • DPKG_PATH_PASSWD — sets the pathname for the system passwd file. this path is relative to the --root directory. the default is /etc/passwd. supported since dpkg 1.22.16.
  • DPKG_PATH_GROUP — sets the pathname for the system group file. this path is relative to the --root directory. the default is /etc/group. supported since dpkg 1.22.16.
  • TMPDIR — if set, dpkg-deb will use it as the directory in which to create temporary files and directories. your temp zone, your rules 🫶
  • SOURCE_DATE_EPOCH — if set, it's used as the timestamp (as seconds since the epoch) in the deb(5)'s ar(5) container, and also used to clamp the mtime in the tar(5) file entries. supported since dpkg 1.18.8.

💀 NOTES 💀

do not attempt to use just dpkg-deb to install software! 😭 like, i'm begging you. you must use dpkg proper to ensure that all the files are correctly placed and the package's scripts run and its status and contents recorded.

no shortcuts bestie, the real dpkg is the main character here 👑

🔥 SECURITY 🔥

okay this part is serious, so listen up 🫶

examining untrusted package archives, or extracting them into staging directories, should be considered a security boundary — and any breakage of that boundary stemming from these operations should be considered a security vulnerability. so, yes, it's giving "real consequences" energy.

but handling untrusted package archives should not be done lightly, because the surface area includes any compression library supported, in addition to the archive formats and control files themselves. that's a lot of surface, ngl.

performing these operations over untrusted data as root is strongly discouraged. like, don't. just don't 🙈

and building package archives should only be performed over trusted data. no cap.

🐛 BUGS 🐛

  • dpkg-deb -I package1.deb package2.deb does the wrong thing. yeah. it just does 💀
  • there is no authentication on .deb files; there isn't even a straightforward checksum. (higher level tools like APT support authenticating .deb packages retrieved from a given repository, and most packages nowadays provide an md5sum control file generated by debian/rules. though this is not directly supported by the lower level tools.)

so like… the low-level tools are out here raw-dogging it, checksum-wise. iykyk 😭

🦋 SEE ALSO 🦋

and that's the whole page bestie! go forth and archive responsibly 🌈💖

this was dpkg-deb(1) from the 1.23.11-dirty source, dated 2026-09-09 — screenshot it, cite it, stan it ✨🎀

📦 where this page comes from