dpkg(1)

📦
version 1.23.11 · 22 versions
, in arch rolling

🎀 NAME 🎀

dpkg — the package manager for Debian, bestie. This is the manual page for it (from the dpkg suite, okurr).

✨ SYNOPSIS ✨

dpkg [option...] command

💀 WARNING 💀

Okay so read this before you @ me: this manual is for users who wanna actually understand dpkg's command-line options and package states in more detail than what dpkg --help gives you. It's giving "deep dive" energy.

It is not for package maintainers trying to understand how dpkg installs their packages, ngl. The descriptions of what dpkg does when installing and removing packages are, and I quote, "particularly inadequate" for that. So if you're a maintainer, this is not the manual you're looking for 🙈.

🦋 DESCRIPTION 🦋

So dpkg is a medium-level tool to install, build, remove and manage Debian packages. Think of it as the backstage crew — iconic, but not the main character.

The primary, more user-friendly front-end for dpkg as a CLI (command-line interface) is apt(8), and as a TUI (terminal user interface) it's aptitude(8). Slay for them.

dpkg itself is controlled entirely via command line parameters, which consist of exactly one command and zero or more options. The command-parameter tells dpkg what to do, and options control the behavior of the command in some way. Periodt.

Also, dpkg can be used as a front-end to dpkg-deb(1) and dpkg-query(1). The list of supported commands is later in the COMMANDS section. If any such command is encountered, dpkg just runs dpkg-deb or dpkg-query with the parameters given to it — but heads up: no specific options are currently passed to them, so if you need any such option, the back-ends need to be called directly. Iykyk.

🌸 INFORMATION ABOUT PACKAGES 🌸

dpkg maintains some usable info about available packages. That info is divided into three classes: states, selection states and flags. These values are intended to be changed mainly with dselect.

💜 Package states

  • not-installed — the package is not installed on your system. It's giving "never met her."
  • config-files — only the configuration files, or the postrm script and the data it needs to remove, of the package exist on the system. The rest? Gone 💅.
  • half-installed — the installation of the package has been started, but not completed, for some reason 😭. Halfway there, living on a prayer.
  • unpacked — the package is unpacked, but not configured. She's out of the box, not dressed yet.
  • half-configured — the package is unpacked and configuration has been started, but not yet completed, for some reason. Again, crying.
  • triggers-awaited — the package awaits trigger processing by another package. Waiting on her friend, fr fr.
  • triggers-pending — the package has been triggered. ✨
  • installed — the package is correctly unpacked and configured. The full slay. 👑

🧚 Package selection states

  • install — the package is selected for installation.
  • hold — a package marked to be on hold is kept on the same version, that is, no automatic new installs, upgrades or removals will be performed on them, unless these actions are requested explicitly, or are permitted to be done automatically with the --force-hold option. She's on a break, do not disturb 🫶.
  • deinstall — the package is selected for deinstallation (i.e. we want to remove all files, except configuration files).
  • purge — the package is selected to be purged (i.e. we want to remove everything from system directories, even configuration files). Nothing left, not even the memories 💀.
  • unknown — the package selection is unknown. A package that is also in a not-installed state, and with an ok flag, will be forgotten in the next database store. Ghosted.

⭐ Package flags

  • ok — a package marked ok is in a known state, but might need further processing. She's fine, but keep an eye on her.
  • reinstreq — a package marked reinstreq is broken and requires reinstallation. These packages cannot be removed, unless forced with option --force-remove-reinstreq. Like, actually cannot. Read that again 🔥.

👑 COMMANDS 👑

💖 -i, --install package-file...

Install the package. If --recursive or -R option is specified, package-file must refer to a directory instead.

Installation consists of the following steps:

  1. Extract the control files of the new package.
  2. If another version of the same package was installed before the new installation, execute prerm script of the old package.
  3. Run preinst script, if provided by the package.
  4. Unpack the new files, and at the same time back up the old files, so that if something goes wrong, they can be restored.
  5. If another version of the same package was installed before the new installation, execute the postrm script of the old package. Note that this script is executed after the preinst script of the new package, because new files are written at the same time old files are removed. Sneaky little timeline, but ok.
  6. Configure the package. See --configure for detailed information about how this is done.

🍓 --unpack package-file...

Unpack the package, but don't configure it. If --recursive or -R option is specified, package-file must refer to a directory instead.

Will process triggers for Pre-Depends unless --no-triggers has been specified.

🌈 --configure package...|-a|--pending

Configure a package which has been unpacked but not yet configured. If -a or --pending is given instead of package, all unpacked but unconfigured packages are configured.

To reconfigure a package which has already been configured, try the dpkg-reconfigure(8) command instead (which is part of the debconf project). Not this one, bestie 💅.

Configuring consists of the following steps:

  1. Unpack the conffiles, and at the same time back up the old conffiles, so that they can be restored if something goes wrong.
  2. Run postinst script, if provided by the package.

Will process triggers unless --no-triggers has been specified.

🦄 --triggers-only package...|-a|--pending

Processes only triggers. All pending triggers will be processed. If package names are supplied, only those packages' triggers will be processed, exactly once each where necessary.

⚠️ Use of this option may leave packages in the improper triggers-awaited and triggers-pending states. This can be fixed later by running: dpkg --configure --pending. So don't panic, there's a fix 💀.

Supported since dpkg 1.14.17.

🎀 -r, --remove package...|-a|--pending

Remove an installed package. This removes everything except conffiles and other data cleaned up by the postrm script, which may avoid having to reconfigure the package if it is reinstalled later (conffiles are configuration files that are listed in the DEBIAN/conffiles control file).

If there is no DEBIAN/conffiles control file nor DEBIAN/postrm script, this command is equivalent to calling --purge.

If -a or --pending is given instead of a package name, then all packages unpacked, but marked to be removed in file /var/lib/dpkg/status, are removed.

Removing of a package consists of the following steps:

  1. Run prerm script.
  2. Remove the installed files.
  3. Run postrm script.

Will process triggers unless --no-triggers has been specified.

💅 -P, --purge package...|-a|--pending

Purge an installed or already removed package. This removes everything, including conffiles, and anything else cleaned up from postrm.

If -a or --pending is given instead of a package name, then all packages unpacked or removed, but marked to be purged in file /var/lib/dpkg/status, are purged.

Note: Some configuration files might be unknown to dpkg because they are created and handled separately through the configuration scripts. In that case, dpkg won't remove them by itself, but the package's postrm script (which is called by dpkg) has to take care of their removal during purge. This only applies to files in system directories, not configuration files written to individual users' home directories. So keep that in mind 🫶.

Purging of a package consists of the following steps:

  1. Remove the package, if not already removed. See --remove for detailed information about how this is done.
  2. Run postrm script.

Will process triggers unless --no-triggers has been specified.

🔥 -V, --verify [package-name...]

Verifies the integrity of package-name, or all packages if omitted, by comparing information from the files installed by a package with the files metadata information stored in the dpkg database. The origin of the files metadata information in the database is the binary packages themselves. That metadata gets collected at package unpack time during the installation process.

Currently the only functional check performed is an md5sum verification of the file contents against the stored value in the files database. It will only get checked if the database contains the file md5sum. To check for any missing metadata in the database, the --audit command can be used.

⚠️ This is only an integrity check and should not be considered as any kind of security verification. Do not use this as your security moment, it's not that girl.

The output format is selectable with the --verify-format option, which by default uses the rpm format, but that might change in the future, and as such, programs parsing this command output should be explicit about the format they expect. Fr fr, be explicit.

Supported since dpkg 1.17.2.

🌟 -C, --audit [package-name...]

Performs database sanity and consistency checks for package-name, or all packages if omitted (per package checks since dpkg 1.17.10). For example, searches for packages that have been installed only partially on your system, or that have missing, wrong or obsolete control data or files. dpkg will suggest what to do with them to get them fixed. She's got your back 💜.

⭐ --update-avail [Packages-file]

⭐ --merge-avail [Packages-file]

Update dpkg's and dselect's idea of which packages are available.

  • With the --merge-avail command, old information is combined with information from Packages-file.
  • With the --update-avail command, old information is replaced with the information in the Packages-file.

The Packages-file distributed with Debian is named «Packages». If the Packages-file argument is missing or named «-», then it will be read from standard input (since dpkg 1.17.7). dpkg keeps its record of available packages in /var/lib/dpkg/available.

A simpler one-shot command to retrieve and update the available file is dselect update.

Note: this file is mostly useless if you don't use dselect but an APT-based frontend — APT has its own system to keep track of available packages. So like, don't come for dpkg when APT does its own thing 🫶.

🧚 -A, --record-avail package-file...

Update dpkg and dselect's idea of which packages are available with information from the package package-file. If --recursive or -R option is specified, package-file must refer to a directory instead.

💀 --forget-old-unavail

Now obsolete and a no-op, as dpkg will automatically forget uninstalled unavailable packages — but only those that do not contain user information such as package selections. So yeah, she's retired, but she's still in the manpage. Respect the legacy 💅.

Obsolete since dpkg 1.15.4. 💀 (that's the tail of the last one, bestie — it's ancient history now)
  • --clear-avail — wipes the existing info about which packages are available. Like clearing your camera roll but for package metadata ✨
  • --get-selections [package-name-pattern...] — grabs the list of package selections and writes it straight to stdout. Here's the tea though: if you don't give it a pattern, non-installed packages whose state is neither deinstall nor purge (basically the ones that were previously purged) just won't show up. They're not invited to the party 🙈
  • --set-selections — sets your package selections from a file it reads on stdin. That file's format is “*package state*”, where state is one of install, hold, deinstall or purge. Blank lines are fine, and comment lines starting with # are also permitted. Very demure, very mindful 🎀

Heads up: the available file needs to be up-to-date for this command to actually be useful — otherwise unknown packages get ignored with a warning. Go check the --update-avail and --merge-avail commands for the full story.

  • --clear-selections — sets the requested state of every non-essential package to deinstall. The whole point is to run it right before --set-selections, so anything that isn't in the list you hand over gets deinstalled. Ruthless. Iconic. 💅

Supported since dpkg 1.13.18.

  • --yet-to-unpack — hunts down packages that were selected for installation but for some reason still haven't been installed. The flaky ones. The no-shows. 😭

Note: this command makes use of both the available file and the package selections.

Deprecated since dpkg 1.23.8 — use dpkg-query --show instead. (We don't use it anymore, bestie, it's giving retired.)

  • --predep-package — prints a single package that is the target of one or more relevant pre-dependencies and has, itself, no unsatisfied pre-dependencies. Very "main character with zero unresolved baggage" energy 👑

If such a package exists, it's output as a Packages file entry, which you can then massage however you like.

Note: this command makes use of both the available file and the package selections.

Returns 0 when a package is printed, 1 when no suitable package is available, and 2 on error. Exit codes are literally its love language.

  • --add-architecture architecture — adds architecture to the list of architectures you can install packages for without needing --force-architecture. The architecture dpkg itself was built for (i.e. whatever --print-architecture spits out) is always part of that list, no negotiation. 🦋

Supported since dpkg 1.16.2.

  • --remove-architecture architecture — takes architecture off that list. If the architecture is currently in use in the database the operation gets refused, unless you specify --force-architecture. And the architecture dpkg is built for (i.e. the output of --print-architecture) can never be removed from that list. Not today, not ever 💀

Supported since dpkg 1.16.2.

  • --print-architecture — prints the architecture of the packages dpkg installs (for example, “i386”). Short, sweet, slays.
  • --print-foreign-architectures — prints a newline-separated list of the extra architectures dpkg is configured to allow packages to be installed for. It's giving ✨bonus levels✨

Supported since dpkg 1.16.2.

  • --assert-help — gives you help about the --assert-feature options.

Supported since dpkg 1.21.0.

  • --assert-feature — asserts that dpkg actually supports the feature you're asking about. Returns 0 if the feature is fully supported, 1 if the feature is known but dpkg can't provide support for it yet, and 2 if the feature is unknown. The current list of assertable features is:
    • support-predepends — supports the Pre-Depends field, since dpkg 1.1.0.
    • working-epoch — supports epochs in version strings, since dpkg 1.4.0.7.
    • long-filenames — supports long filenames in deb(5) archives, since dpkg 1.4.1.17.
    • multi-conrep — supports multiple Conflicts and Replaces, since dpkg 1.4.1.19.
    • multi-arch — supports multi-arch fields and semantics, since dpkg 1.16.2.
    • versioned-provides — supports versioned Provides, since dpkg 1.17.11.
    • protected-field — supports the Protected field, since dpkg 1.20.1.
  • --validate-thing string — validates that the thing string has correct syntax. Returns 0 if the string is valid, 1 if the string is invalid but might be accepted in lax contexts, and 2 if the string is invalid. The current list of validatable things is:

Supported since dpkg 1.18.16. 🌸

  • pkgname — validates the given package name. Supported since dpkg 1.18.16.
  • trigname — validates the given trigger name. Supported since dpkg 1.18.16.
  • archname — validates the given architecture name. Supported since dpkg 1.18.16.
  • version — validates the given version. Supported since dpkg 1.18.16.
  • --compare-versions ver1 op ver2 — compares version numbers, where op is a binary operator. dpkg returns true (0) if the specified condition is satisfied, and false (1) otherwise. Ngl this one has lore 😭 There are two groups of operators, and they differ in how they treat an empty ver1 or ver2:
    • These treat an empty version as earlier than any version: lt le eq ne ge gt
    • These treat an empty version as later than any version: lt-nl le-nl ge-nl gt-nl
    • These are provided only for compatibility with control file syntax: < << <= = >= >> >
The < and > operators are obsolete and should not be used, due to confusing semantics. To illustrate: 0.1 < 0.1 evaluates to true. Yeah. Make it make sense. 🙈
  • -?, --help — displays a brief help message.
  • --force-help — gives help about the --force-thing options.
  • -Dh, --debug=help — gives help about debugging options.
  • --version — displays dpkg version information. 🎀

When used with --robot, the output will be the program version number in a dotted numerical format, with no newline. Sneaky but valid.

🧰 dpkg-deb commands

See dpkg-deb(1) for more info about the following commands, and about other commands and options that just aren't exposed by the dpkg front-end. (They exist! They're just shy.)

  • -b, --build directory [archive|directory] — build a deb package.
  • -c, --contents archive — list contents of a deb package.
  • -e, --control archive [directory] — extract control-information from a package.
  • -x, --extract archive directory — extract the files contained by package.
  • -X, --vextract archive directory — extract and display the filenames contained by a package.
  • -f, --field archive [control-field...] — display control field(s) of a package.
  • --ctrl-tarfile archive — output the control tar-file contained in a Debian package.
  • --fsys-tarfile archive — output the filesystem tar-file contained by a Debian package.
  • -I, --info archive [control-file...] — show information about a package.

🔍 dpkg-query commands

See dpkg-query(1) for more info about the following commands, and about other commands and options that aren't exposed by the dpkg front-end.

  • -l, --list package-name-pattern... — list packages matching given pattern.
  • -s, --status package-name... — report status of specified package.
  • -L, --listfiles package-name... — list files installed to your system from package-name.
  • -S, --search filename-search-pattern... — search for a filename from installed packages.
  • -p, --print-avail package-name... — display details about package-name, as found in /var/lib/dpkg/available. Users of APT-based frontends should use apt show package-name instead. (Yes bestie, that means you. Use the apt one. 💖)

✨ OPTIONS ✨

Okay so here's the vibe: all options can be specified both on the command line and in the dpkg configuration file /etc/dpkg/dpkg.cfg or in fragment files on the configuration directory /etc/dpkg/dpkg.cfg.d/ (fragment file names match this shell pattern: '[0-9a-zA-Z_-]*'). Each line in the configuration file is either an option (exactly the same as the command line option but without the leading hyphens) or a comment (if it starts with a #). So chill, you can set your faves once and forget 🫶

  • --abort-after=number — changes after how many errors dpkg will abort. The default is 50. Fifty strikes and you're out ✨
  • -B, --auto-deconfigure — when a package is removed there's a possibility that another installed package depended on the removed package. Specifying this option causes automatic deconfiguration of the package that depended on the removed one. It's giving "break up but stay friends" 💅
  • -Doctal, --debug=octal — switches debugging on. octal is formed by bitwise-ORing the desired values together from the list below (note that these values may change in future releases). -Dh or --debug=help displays these debugging values. 🐛
    • 1 — Generally helpful progress information
    • 2 — Invocation and status of maintainer scripts
    • 10 — Output for each file processed
    • 100 — Lots of output for each file processed
    • 20 — Output for each configuration file
    • 200 — Lots of output for each configuration file
    • 40 — Dependencies and conflicts
    • 400 — Lots of dependencies/conflicts output
    • 10000 — Trigger activation and processing
    • 20000 — Lots of output regarding triggers
    • 40000 — Silly amounts of output regarding triggers
    • 1000 — Lots of drivel about for example the dpkg/info dir
    • 2000 — Insane amounts of drivel
  • --force-things
  • --no-force-things, --refuse-things

Force or refuse (no-force and refuse mean the exact same thing) to do some things. things is a comma separated list of things specified below. --force-help displays a message describing them. Things marked with (*) are forced by default.

Warning: These options are mostly intended to be used by experts only. Using them without fully understanding their effects may break your whole system. Like, actually break it. Your whole system. 💀🔥

all:

Turns on (or off) all force options. All of them. Every single one. No thoughts, head empty.

downgrade(*):

Install a package, even if a newer version of it is already installed.

Warning: At present dpkg does not do any dependency checking on downgrades and therefore will not warn you if the downgrade breaks the dependency of some other package. This can have serious side effects — downgrading essential system components can even make your whole system unusable. Use with care. Fr fr, be careful 😭

configure-any:

Configure also any unpacked but unconfigured packages on which the current package depends.

hold:

Allow automatic installs, upgrades or removals of packages even when marked to be on “hold”. Note: when these actions are requested explicitly, the “hold” package selection state always gets ignored.

  • remove-reinstreq — removes a package even when it's broken and marked as needing reinstallation 💀. Heads up: this can leave bits of the package sitting on your system, and then dpkg just... forgets they exist. Rude, but that's the deal.
  • remove-protected — removes the thing even if the package counts as protected 🛡️. Protected packages are mostly the important system boot infrastructure, or they're custom system-local meta-packages. Nuking them might leave the whole system unable to boot, or you lose required functionality to actually operate it — so like, use with caution, bestie.

Supported since dpkg 1.20.1.

  • remove-essential — removes it even if the package is considered essential 😭. Essential packages are mostly the very basic Unix commands — stuff the packaging system needs, stuff the system generally needs to operate, or stuff needed during boot (though honestly the boot ones should be converted into protected packages instead). Removing them might cause the entire system to stop working, so caution, please.
  • depends — turns all dependency problems into warnings 🫶. This affects the Pre-Depends and Depends fields.
  • depends-version — stops caring about versions when checking dependencies ✨. This affects the Pre-Depends and Depends fields.
  • breaks — installs even if doing so would break another package 💅. This affects the Breaks field.

Supported since dpkg 1.14.6.

  • conflicts — installs even if it conflicts with another package 🔥. This one is dangerous, because it will usually cause some files to get overwritten. This affects the Conflicts field.
  • confmiss — always installs the missing conffile without prompting 🙈. Dangerous, because it means a change (a removal) made to that file does not get preserved.
  • confnew — if a conffile has been modified and the version in the package did change, always install the new version without prompting — unless --force-confdef is also specified, in which case the default action is preferred 🎀.
  • confold — if a conffile has been modified and the version in the package did change, always keep the old version without prompting — unless --force-confdef is also specified, in which case the default action is preferred 🌸.
  • confdef — if a conffile has been modified and the version in the package did change, always choose the default action without prompting. If there is no default action, it will stop and ask the user — unless --force-confnew or --force-confold is also given, in which case it uses that to decide the final action ⭐.
  • confask — if a conffile has been modified, always offer to replace it with the version in the package, even if the version in the package didn't change. If any of --force-confnew, --force-confold, or --force-confdef is also given, that gets used to decide the final action 💖.

Supported since dpkg 1.15.8.

  • overwrite — overwrites one package's file with another's file 🦋.
  • overwrite-dir — overwrites one package's directory with another's file.
  • overwrite-diverted — overwrites a diverted file with an undiverted version 🧚.
  • statoverride-add — overwrites an existing stat override when adding it 👑

Supported since dpkg 1.19.5.

  • statoverride-remove — ignores a missing stat override when removing it 💜

Supported since dpkg 1.19.5.

  • security-mac(*) — uses platform-specific Mandatory Access Controls (MAC) based security when installing files into the filesystem 🔒. On Linux systems the implementation uses SELinux.

Supported since dpkg 1.19.5.

  • unsafe-io — does not perform safe I/O operations when unpacking 😬. Right now this means it skips file system syncs before file renames, which is known to cause substantial performance degradation on some file systems — and unfortunately, those are exactly the ones that needed the safe I/O in the first place, because of their unreliable behaviour that causes zero-length files on abrupt system crashes.
Note: for ext4, the main offender, consider using the mount option nodelalloc instead. That fixes both the performance degradation and the data safety issues — the latter by making the file system not produce zero-length files on abrupt system crashes with any software that isn't doing syncs before atomic renames.
Warning: using this option might improve performance at the cost of losing data. Use with care, fr.

Supported since dpkg 1.15.8.6.

  • script-chrootless — runs maintainer scripts without chroot(2)ing into instdir, even if the package doesn't support this mode of operation 🫣.
Warning: this can destroy your host system. Use with extreme care.

Supported since dpkg 1.18.5.

  • architecture — processes even packages with the wrong architecture, or with none at all 🌈.
  • bad-version — processes even packages with wrong versions 💀.

Supported since dpkg 1.16.1.

  • bad-path — PATH is missing important programs, so problems are likely 😭.
  • not-root — tries to (de)install things even when you're not root 👀.
  • bad-verify — installs a package even if it fails the authenticity check 🙃.
  • --ignore-depends=package,... — ignores dependency-checking for the specified packages. Okay, technically the checking still happens, but all you get are warnings about conflicts and nothing else 🫶. This affects the Pre-Depends, Depends and Breaks fields.
  • --no-act, --dry-run, --simulate — does everything that's supposed to be done, but writes zero changes 🙅. It's literally for seeing what would happen with the command you specified, without actually modifying anything.
Bestie, please give --no-act before the command-parameter or you might end up with undesirable results. Like, dpkg --purge foo --no-act will first purge package “foo” and then try to purge package ”--no-act”, even though you probably expected it to actually do nothing 😭.
  • -R, --recursive — recursively handles all regular files matching the pattern *.deb found at the specified directories and all of their subdirectories 🎀. You can use it with -i, -A, --install, --unpack and --record-avail commands.
  • -G — doesn't install a package if a newer version of the same package is already installed. It's an alias of --refuse-downgrade 💅.
  • --admindir=directory — sets the administrative directory to directory 🗂️. This directory holds many files that give info about the status of installed or uninstalled packages, etc. Defaults to «/var/lib/dpkg» if DPKG_ADMINDIR has not been set.
  • --instdir=directory — sets the installation directory, which is the directory where packages are going to be installed ✨. instdir is also the directory passed to chroot(2) before running the package's installation scripts — which means those scripts see instdir as the root directory. Defaults to «/» if DPKG_ROOT has not been set (since dpkg 1.21.10).
  • --root=directory — sets the root directory to directory, which sets the installation directory to «*directory*» and the administrative directory to «*directory*/var/lib/dpkg» if DPKG_ROOT has not been set (since dpkg 1.21.10) 🌸.
  • -O, --selected-only — only processes the packages that are selected for installation ⭐. The actual marking is done with dselect or by dpkg itself, when it handles packages. For example: when a package is removed, it gets marked as selected for deinstallation.
  • -E, --skip-same-version — doesn't install the package if the same version and architecture of the package is already installed 🦋.

Since dpkg 1.21.10, the architecture is also taken into account, which makes it possible to cross-grade packages, or to install additional co-installable instances with the same version but a different architecture 🔥.

  • --pre-invoke=command, --post-invoke=command — sets an invoke hook command to be run via sh -c before or after the dpkg run, for the unpack, configure, install, triggers-only, remove and purge actions (since dpkg 1.15.4), and the add-architecture and remove-architecture actions (since dpkg 1.17.19) 🎀. This option can be specified multiple times. The order the options are specified in is preserved, with the ones from the configuration files taking precedence. The environment variable DPKG_HOOK_ACTION is set for the hooks to the current dpkg action.

The invoke hooks are not executed when --no-act is specified, or when running as non-root without --force-not-root 🙈.

Note: front-ends might call dpkg several times per invocation, which might run the hooks more times than expected.

Supported since dpkg 1.15.4.

  • --path-exclude=glob-pattern, --path-include=glob-pattern — sets glob-pattern as a path filter, either excluding or re-including previously excluded paths matching the specified patterns during install 🧚.
Warning: keep in mind that depending on which paths you exclude, you might completely break your system. Use with caution.

The glob patterns use the same wildcards as the shell, where ‘*’ matches any sequence of characters — including the empty string and also ‘/’ 👑. For example, «/usr/*/READ*» matches «/usr/share/doc/package/README». As usual, ‘?’ matches any single character (again, including ‘/’). And ‘[’ starts a character class, which can contain a list of characters, ranges and complementations. See glob(7) for detailed info about globbing. Note: the current implementation might re-include more directories and symlinks than needed — in particular when there's a more specific re-inclusion — to be on the safe side and avoid possible unpack failures; future work might fix this 💜.

You can use this to remove all paths except some particular ones. A typical case is:

--path-exclude=/usr/share/doc/*
--path-include=/usr/share/doc/*/copyright

which removes all documentation files except the copyright files ✨.

These two options can be specified multiple times, and interleaved with each other. Both are processed in the given order, with the last rule that matches a file name making the decision 🌈.

okay so real talk about these path filters for a sec, because they are not like regular filters and the vibes are important 👀

The filters get applied when unpacking the binary packages, which means they only know about the type of object currently being filtered (like a normal file or a directory) and they have zero visibility into what objects are coming next. And because these filters have side effects (unlike find(1) filters, bestie, those are a whole different genre), excluding an exact pathname that happens to be a directory object like /usr/share/doc will not do what you want it to do. Only that pathname gets excluded (and it could even be automatically reincluded if the code decides it needs to), and then any subsequent files contained within that directory will fail to unpack. 😭

Hint: make sure the globs are not expanded by your shell. fr fr, let the shell keep its hands off them.

Supported since dpkg 1.15.8. ✨

  • --verify-format format-name — Sets the output format for the --verify command. 💅

The only currently supported output format is rpm, which consists of a line for every path that failed any check. Those lines have the following format:

 missing   [c] pathname [(error-message)]
 ?M5?????? [c] pathname

The first 9 characters report the checks result — either the literal missing when the file is not present or its metadata cannot be fetched, or one of the following special characters that report the result for each check:

  • ‘?’ — Implies the check could not be done (lack of support, file permissions, etc).
  • ‘.’ — Implies the check passed.
  • ‘A-Za-z0-9’ — Implies a specific check failed. The following positions and alphanumeric characters are currently supported:
    • 1 ‘?’ — These checks are currently not supported, will always be ‘?’.
    • 2 ‘M’ — The file mode check failed. Because pathname metadata is currently not tracked, this check can only be partially emulated via a very simple heuristic for pathnames that have a known digest, which implies they should be regular files, where the check will fail if the pathname is not a regular file on the filesystem. This check will currently never succeed as it does not have enough information available. Supported since dpkg 1.21.0.
    • 3 ‘5’ — The digest check failed, which means the file contents have changed. This is only an integrity check and should not be considered as any kind of security verification. 🚨
    • 4-9 ‘?’ — These checks are currently not supported, will always be ‘?’.

The line is followed by a space and an attribute character. The following attribute character is supported:

  • ‘c’ — The pathname is a conffile.

Finally followed by another space and the pathname. 🌸

In case the entry was of the missing type, and the file was not actually present on the filesystem, then the line is followed by a space and the error message enclosed within parenthesis.

Supported since dpkg 1.17.2. ✨

  • --status-fd n — Send machine-readable package status and progress information to file descriptor n. This option can be specified multiple times. The information is generally one record per line, in one of the following forms: 📨
    • status: package: status — Package status changed; status is as in the status file.
    • status: package : error : extended-error-message — An error occurred. Any possible newlines in extended-error-message will be converted to spaces before output.
    • status: file : conffile-prompt : 'real-old' 'real-new' useredited distedited — User is being asked a conffile question.
    • processing: stage: package — Sent just before a processing stage starts. stage is one of upgrade, install (both sent before unpacking), configure, trigproc, disappear, remove, purge.
  • --status-logger=command — Send machine-readable package status and progress information to the shell command's standard input, to be run via sh -c. This option can be specified multiple times. The output format used is the same as in --status-fd. 🫶

The status loggers are not executed when --no-act is specified, or when running as non-root without --force-not-root.

Supported since dpkg 1.16.0. ✨

  • --log=filename — Log status change updates and actions to filename, instead of the default /var/log/dpkg.log. If this option is given multiple times, the last filename is used. Log messages are of the form: 📝
    • YYYY-MM-DD HH:MM:SS startup type command — For each dpkg invocation where type is archives (with a command of unpack or install) or packages (with a command of configure, triggers-only, remove or purge).
    • YYYY-MM-DD HH:MM:SS status state pkg installed-version — For status change updates.
    • YYYY-MM-DD HH:MM:SS action pkg installed-version available-version — For actions where action is one of install, upgrade, configure, trigproc, disappear, remove or purge.
    • YYYY-MM-DD HH:MM:SS conffile filename decision — For conffile changes where decision is either install or keep.
  • --robot — Use a machine-readable output format. This provides an interface for programs that need to parse the output of some of the commands that do not otherwise emit a machine-readable output format. No localization will be used, and the output will be modified to make it easier to parse. 🤖

The only currently supported command is --version.

  • --no-pager — Disables the use of any pager when showing information. no scrolling era, we read it raw 💅

Supported since dpkg 1.19.2. ✨

  • --no-debsig — Do not try to verify package signatures. (yes, that's the whole thing, and yes, it means what it says 🙈)
  • --no-triggers — Do not run any triggers in this run, but activations will still be recorded. If used with --configure package or --triggers-only package then the named package postinst will still be run even if only a triggers run is needed. Use of this option may leave packages in the improper triggers-awaited and triggers-pending states. This can be fixed later by running: dpkg --configure --pending. 🔥

Supported since dpkg 1.14.17. ✨

  • --triggers — Cancels a previous --no-triggers. the undo button, iconic 🎀

Supported since dpkg 1.14.17. ✨

✨ EXIT STATUS ✨

okay so when dpkg dips out, it leaves you one of these three receipts, and you should actually look at them bestie 👑

  • 0 — The requested command was successfully performed. Or a check or assertion command returned true. slay 💖
  • 1 — A check or assertion command returned false.
  • 2 — Fatal or unrecoverable error due to invalid command-line usage, or interactions with the system, such as accesses to the database, memory allocations, etc. 💀

🌿 ENVIRONMENT 🌿

okay so dpkg is literally reading your whole vibe from the environment, and there are two flavors: the ones you (or your shell) set for it, and the ones dpkg sets for other people. both iconic, both matter. let's go 💅

🌸 External environment 🌸

the ones you hand to dpkg, bestie:

  • PATH — this one is expected to be defined in the environment and to point at the system paths where several required programs live. If it's not set, or the programs aren't found, dpkg will abort. no cap, it just gives up 😭
  • HOME — if it's set, dpkg uses it as the directory from which to read the user specific configuration file. home sweet home 🏠
  • TMPDIR — if set, dpkg uses it as the directory where it creates temporary files and directories. it's giving "where the mess happens" ✨
  • SHELL — the program dpkg executes when starting a new interactive shell, or when spawning a command via a shell. your shell is the main character here 🐚
  • COLUMNS — sets the number of columns to expect in the --list output, so it can determine the padding to use, without causing any truncation. no cutting off your faves ✂️

Supported since dpkg 1.23.8.

  • PAGER, DPKG_PAGER — the program dpkg executes when running a pager, which gets executed with $SHELL -c — for example when displaying the conffile differences. If SHELL isn't set, sh gets used instead.

When non-empty, DPKG_PAGER overrides the PAGER environment variable. If none of the programs pointed at by DPKG_PAGER or PAGER are present, the following programs get tried in order (since dpkg 1.22.12): the default pager more, then less(1), more(1), and finally cat(1).

The cat value is special — it's equivalent to disabling paging entirely. straight up "no scrolling, we read it all" energy 📜

Support for DPKG_PAGER since dpkg 1.19.2.

  • DPKG_COLORS — sets the color mode. currently accepted values are: auto (the default), always and never. rainbow mode: unlocked 🌈

Supported since dpkg 1.18.5.

  • DPKG_NLS — if set, it's used to decide whether to activate Native Language Support, also known as internationalization (or i18n) support. accepted values are: 0 and 1 (default). speak your language, bestie 🗣️

Supported since dpkg 1.22.7.

  • DPKG_DEBUG — sets the debug mask from an octal value. the currently accepted flags are described in the --debug option. detective mode on 🔍

Supported since dpkg 1.21.10.

  • DPKG_FORCE — sets the force flags. when this variable is present, no built-in force defaults will be applied. if the variable is present but empty, all force flags get disabled. it's giving "I said what I said" 💀

Supported since dpkg 1.19.5.

  • DPKG_ROOT — if set and the --instdir or --root options haven't been specified, it gets used as the filesystem root directory.

Supported since dpkg 1.21.10.

  • DPKG_ADMINDIR — if set and the --admindir or --root options haven't been specified, it gets used as the dpkg administrative directory.

Supported since dpkg 1.20.0.

  • DPKG_FRONTEND_LOCKED — set by a package manager frontend to notify dpkg that it should not acquire the frontend lock. "I got this one, girl" 🤝

Supported since dpkg 1.19.1.

  • DPKG_PATH_PASSWD — sets the pathname for the system passwd file. this path is relative to the --root directory. the default is /etc/passwd.

Supported since dpkg 1.22.16.

  • DPKG_PATH_GROUP — sets the pathname for the system group file. this path is relative to the --root directory. the default is /etc/group.

Supported since dpkg 1.22.16.

🦋 Internal environment 🦋

and these? dpkg sets them itself — for maintainer scripts, subprocesses, shells, all that. it's dpkg being the loml and prepping everything for you 💖

  • LESS — defined by dpkg to -FRSXMQ, if not already set, when spawning a pager. to change the default behavior, this variable can be preset to some other value — including an empty string — or the PAGER or DPKG_PAGER variables can be set to disable specific options with -+, for example DPKG_PAGER="less -+F".

Supported since dpkg 1.19.2.

  • DPKG_ROOT — defined by dpkg on the maintainer script environment to indicate which installation to act on. the value is intended to be prepended to any path maintainer scripts operate on. during normal operation, this variable is empty. when installing packages into a different instdir, dpkg normally invokes maintainer scripts using chroot(2) and leaves this variable empty — but if --force-script-chrootless is specified, then the chroot(2) call is skipped and this variable gets set to instdir (which will be non-empty). plot twist 🎬

Supported since dpkg 1.18.5.

  • DPKG_ADMINDIR — defined by dpkg on the maintainer script environment to indicate the dpkg administrative directory to use. this variable is always set to the current --admindir value.

Supported since dpkg 1.16.0.

  • DPKG_FORCE — defined by dpkg on the subprocesses environment to all the currently enabled force option names, separated by commas.

Supported since dpkg 1.19.5.

  • DPKG_SHELL_REASON — defined by dpkg on the shell spawned on the conffile prompt to examine the situation. current valid value: conffile-prompt. "why are we here" energy 🫠

Supported since dpkg 1.15.6.

  • DPKG_CONFFILE_OLD — defined by dpkg on the shell spawned on the conffile prompt to examine the situation. contains the path to the old conffile.

Supported since dpkg 1.15.6.

  • DPKG_CONFFILE_NEW — defined by dpkg on the shell spawned on the conffile prompt to examine the situation. contains the path to the new conffile.

Supported since dpkg 1.15.6.

  • DPKG_HOOK_ACTION — defined by dpkg on the shell spawned when executing a hook action. contains the current dpkg action.

Supported since dpkg 1.15.4.

  • DPKG_RUNNING_VERSION — defined by dpkg on the maintainer script environment to the version of the currently running dpkg instance. ✨ version check ✨

Supported since dpkg 1.14.17.

  • DPKG_MAINTSCRIPT_PACKAGE — defined by dpkg on the maintainer script environment to the (non-arch-qualified) package name being handled.

Supported since dpkg 1.14.17.

  • DPKG_MAINTSCRIPT_PACKAGE_REFCOUNT — defined by dpkg on the maintainer script environment to the package reference count, i.e. the number of package instances with a state greater than not-installed. counting the girlies 🔢

Supported since dpkg 1.17.2.

  • DPKG_MAINTSCRIPT_ARCH — defined by dpkg on the maintainer script environment to the architecture the package got built for.

Supported since dpkg 1.15.4.

  • DPKG_MAINTSCRIPT_NAME — defined by dpkg on the maintainer script environment to the name of the script running, one of preinst, postinst, prerm or postrm. pick your fighter ⚔️

Supported since dpkg 1.15.7.

  • DPKG_MAINTSCRIPT_DEBUG — defined by dpkg on the maintainer script environment to a value ('0' or '1') noting whether debugging has been requested (with the --debug option) for the maintainer scripts.

Supported since dpkg 1.18.4.

🎀 FILES 🎀

the whole cast of characters, bestie:

  • /etc/dpkg/dpkg.cfg.d/[0-9a-zA-Z_-]* — configuration fragment files. little config crumbles ✨

Supported since dpkg 1.15.4.

  • /etc/dpkg/dpkg.cfg — configuration file with default options. the default-options headquarters.
  • /var/log/dpkg.log — default log file (see /etc/dpkg/dpkg.cfg and option --log). receipts, always 🧾

The other files listed below are in their default directories — see option --admindir to see how to change locations of these files.

  • /var/lib/dpkg/available — list of available packages.
  • /var/lib/dpkg/status — statuses of available packages. this file contains information about whether a package is marked for removing or not, whether it's installed or not, etc. see section "INFORMATION ABOUT PACKAGES" for more info.

The status file is backed up daily in /var/backups. it can be useful if it's lost or corrupted due to filesystems troubles. thank u backup, very cool 🫶

The format and contents of a binary package are described in deb(5).

🧚 Filesystem filenames 🧚

so during unpacking and configuration, dpkg uses various filenames for backup and rollback purposes. here's the simplified explanation of how these filenames get used during package installation — lowkey fascinating ngl:

  • *.dpkg-new — during unpack, dpkg extracts new filesystem objects into pathname.dpkg-new (except for existing directories or symlinks to directories, which get skipped), once that's done and after having performed backups of the old objects, the objects get renamed to pathname.
  • *.dpkg-tmp — during unpack, dpkg makes backups of the old filesystem objects into pathname.dpkg-tmp after extracting the new objects. these backups are performed as either a rename for directories (but only if they switch file type), a new symlink copy for symlinks, or a hard link for any other filesystem object — except for conffiles, which get no backups because they're processed at a later stage.

In case of needing to rollback, these backups get used to restore the previous contents of the objects. these get removed automatically after the installation is complete. bye bestie 👋

  • *.dpkg-old — during configuration, when installing a new version, dpkg can make a backup of the previous modified conffile into pathname.dpkg-old.
  • *.dpkg-dist — during configuration, when keeping the old version, dpkg can make a backup of the new unmodified conffile into pathname.dpkg-dist.

🔥 SECURITY 🔥

okay this part is serious, bestie, pay attention 👀

Any operation that needs write access to the database or the filesystem is considered a privileged operation that might allow root escalation. These operations must never be delegated to an untrusted user or be done on untrusted packages, as that might allow root access to the system. like, fr fr, don't do it 💀

Some operations (such as package verification) might need root privileges to be able to access files on the filesystem that would otherwise be inaccessible due to restricted permissions, but should otherwise work normally and produce appropriate messages in those cases.

Query operations should never require root, and delegating their execution to unprivileged users via some gain-root command can have security implications (such as privilege escalation) — for example when a pager is automatically invoked by the tool. so like... be careful out there 🙈

See also the SECURITY section of the dpkg-deb(1) and dpkg-split(1) manual pages.

💀 BUGS 💀

  • --no-act usually gives less information than might be helpful. it's giving "I tried my best" 😭 that's it, that's the bug.

✨ EXAMPLES ✨

Okay bestie, real-world receipts incoming 💅 these are like the group-chat screenshots of dpkg usage.

  • To list installed packages related to the editor vi(1) — and note that dpkg-query does not load the available file anymore by default, so you should use the dpkg-query --load-avail option instead for that:
dpkg -l '*vi*'
  • To see the entries in /var/lib/dpkg/available of two packages — yes literally just two, we're being specific:
dpkg --print-avail vim neovim | less
  • To search the listing of packages yourself — go off, scroll around, it's giving researcher energy 🔍:
dpkg --print-avail | less
  • To remove an installed neovim package — bye bestie 🫶:
dpkg -r neovim
  • To install a package, you first need to find it in an archive or media disc. When you're using an archive based on a pool structure, knowing the archive area and the name of the package is genuinely enough to infer the pathname:
dpkg -i /media/bdrom/pool/main/v/vim/vim_9.0.2018-1_amd64.deb
  • To make a local copy of the package selection states — little screenshot of your vibes, but for package states:
dpkg --get-selections >myselections

You might transfer this file to another computer, and after having updated the available file there with your package manager frontend of choice (peep <https://wiki.debian.org/Teams/Dpkg/FAQ#set-selections> for more details), for example:

apt-cache dumpavail | dpkg --merge-avail

then you can install it with:

dpkg --clear-selections
dpkg --set-selections <myselections
⚠️ Heads up bestie: this will not actually install or remove anything — it just sets the selection state on the requested packages. You'll need some other application to actually download and install the requested packages. For example, run apt-get dselect-upgrade.

Ordinarily, you'll find that dselect(1) provides a more convenient way to modify the package selection states. Like, it's the whole point of it, iykyk 💁‍♀️

🌈 ADDITIONAL FUNCTIONALITY 🌈

Additional functionality can be gained by installing any of the following packages, no cap: apt, aptitude and debsig-verify. Little upgrade to your toolkit, periodt ✨

🦋 SEE ALSO 🦋

Go read these next, they're all iconic in their own way 👑

👑 AUTHORS 👑

See /usr/share/doc/dpkg/THANKS for the list of people who have contributed to dpkg. Absolute legends, every single one, we stan 💖

And that's the whole page bestie!! 🎀 This edition was dpkg version 1.23.11-dirty, dated 2026-09-09, and it's the dpkg(1) manual — go forth and manage your packages like the main character you are 💅✨

📦 where this page comes from