dpkg-www(8)

📦

version 2.66 · 5 versions

2.66 · ubuntu stonking (latest)
2.62 · ubuntu jammy
2.64 · debian bookworm
2.65build1 · ubuntu resolute
2.65 · debian trixie, ubuntu noble, ubuntu questing

💖 NAME 💖

okay bestie, gather round 🫶 — this is dpkg-www(8), the manual for dpkg-www and dpkg-www-installer, aka the WWW Debian package browser. yes the whole vibe is "browse your packages like it's a website". iconic honestly 👑

✨ SYNOPSIS ✨

https://<hostname>/cgi-bin/dpkg

🌸 DESCRIPTION 🌸

so here's the situation: a typical Debian system can have like hundreds of installed packages and thousands available for installation 😭. you can usually get info about installed and available packages with the dpkg(1) command, sure, but navigating through the package dependencies and the documentation files? that is a very frustrating and time-consuming task. it's giving "why am I doing this by hand".

but with the dpkg-www CGI you can instead browse Debian packages info with a web browser 🌈 — following package dependencies and locating documentation (man pages, Info files, READMEs, and so on) with just a few mouse clicks. and if you have superuser privileges you can even install, upgrade or remove packages right from your web browser 💅. the output that dpkg-www gives you is basically that of dpkg(1) but with the addition of HREF's for packages dependencies and documentation files. obsessed.

the CGI program can take an optional query argument, which you can give in the URL or type into the query field of the HTML form. bestie, that argument can be:

empty — lists concisely all installed packages.
* (asterisk) — lists concisely all installed and available packages.
list of packages — lists concisely the requested packages.
wildcard expession — lists concisely all packages whose name matches the expression. for example '*image*' will find all packages which contain the string 'image' 🦋.
package — lists verbosely a package and, if the package is installed, all its files. if the package is not installed and web installation is enabled you can install it by clicking on the 'Install' button. and if the package IS installed you can remove it or upgrade to a new version (if available) by clicking on the respective buttons 🔥.
absolute pathname — lists all the packages owners of a file. you'd use this for example to find which package installed a program. iykyk.
/regexp — lists all the packages owners of a file. the regexp form can be used to find which packages own a non installed file ✨.
field=value — lists all the packages with control field matching value. if the field name is omitted the value is searched in any control field. the default search is a case-insensitive fixed substring match, but it can be changed with the GREP_DCTRL_OPTS option in the config file. heads up though: this feature works only if the grep-dctrl(1) package is installed 🙈.
? (question mark) — shows a concise help about the CGI usage.
space (a single space) — prints only the input form, for use from window-manager menus.

🎀 Configuration 🎀

dpkg-www can be configured by the local system administrator via the optional /etc/dpkg-www.conf file. this file is a simple Bourne shell (/bin/sh) script that defines some or all of the following variables (defaults are used if the file doesn't exist, or doesn't define the variable):

CHECK_BUTTONS — if this option is enabled dpkw-www will add a small 'install' check-button for each package shown in the package list. Default is 0 (disabled) because the resulting interface is not very nice. the use of this option is therefore not recommended 💀.
INSTALL_BUTTON — if this option is set, the 'Install' or 'Upgrade' and 'Remove' buttons will be added to the verbose info of a package. by clicking on these button you will start the installation of removal the package as described in the section Web Installation. since this option can potentially introduce security holes it is disabled (0) by default. use at your own risk ⚠️. if the variable is set to "top" the button will be located before the file list, default is the bottom of the page.
SHOW_LOCAL_FILES — if this variable is set, dpkg-www will use file:/ style URL's to access html files — bypassing the CGI script. this is faster on slow machines. Default is not defined, which means use local files for connection from localhost and https:// URL's for remote connections.
CHECK_PACKAGE_VERSION — if this variable is set, dpkg-www will check if a newer version of an installed package is available. on slow machines you may want to set this option to false since it can considerably slow down the execution 🐌.
LIST_UNAVAILABLE — this option enables listing also unavailable packages in the packages list. disabled by default.
LIST_DOCUMENTATION — this option enables the display of references to documents registered with install-docs(8) to the detailed package info, providing a quick path to relevant package documentation. unfortunately this feature is not totally reliable because currently there is no way to find documents registered by a package with install-docs(8) and the search is done with an ugly hack 😭. hopefully things will change in woody. this option is enabled (1) by default.
FORCE_SSH_PASSWD — this option forces ssh passwd prompt for package installation on a remote host even if an ssh agent holds the private key 🔐.
GREP_DCTRL_OPTS — these options are passed to grep-dctrl(1) when doing a query by field. Default is "-i" for case-insensitive fixed substring match. see grep-dctrl(1) for more info.
DPKG — command providing the dpkg(1) query functionalities. this can be dpkg(1) or dlocate(1), or auto. Default is auto, meaning that the CGI will use dlocate(1) if installed, otherwise revert to dpkg(1) which should always be available on a Debian system. by specifying this option you can force the use of one of the two program.
MAN — Man page to HTML translation command. can be dwww(7), man2html or auto. Default is auto, meaning that the CGI will use man2thml if installed, otherwise revert to dwww(7). by specifying this option you can force the use of one of the two program.
DEBIAN_CONTENTS — optional list of one or more Contents-xxx.gz files mapping each file available in the Debian system to the package from which it originates. if available these files are used to find the owner packages of non installed files. this can be useful for quickly finding the package to install when a needed command is missing 🌟.
BGCOLOR — Background color of the HTML body.
DEBUG — Internal option used only for debugging. Disabled by default since it is useless for normal users.
DWWW_PATH — Path on web server to dwww(7) cgi-bin.
INFO2WWW_PATH — Path on web server to info2www(1) cgi-bin.

the following is an example /etc/dpkg-www.conf file:

  # Enable install check-buttons in package list.
  CHECK_BUTTONS=0

  # Enable install, upgrade and remove buttons in package info.
  INSTALL_BUTTON=1

  # List registered package documentation.
  LIST_DOCUMENTATION=1

  # Options passed to grep-dctrl in queryPackagesByField()
  GREP_DCTRL_OPTS="-i"

  # Show local files directly. Automatically set.
  SHOW_LOCAL_FILES=auto

  # Force ssh passwd prompt even if an ssh agent holds
  # the private key.
  FORCE_SSH_PASSWD=true

  # List of Contents-xxx.gz files, if available.
  DEBIAN_CONTENTS="
    /debian/dists/bookworm/main/Contents-amd64.gz
    /debian/dists/bookworm-updates/main/Contents-amd64.gz
    /debian-security/dists/bookworm-security/main/Contents-amd64.gz"

  # Dpkg command (dpkg|dlocate|auto). Automatically detected.
  # DPKG=auto

  # Manpage conversion command (dwww|man2html|auto). Automatically detected.
  # MAN=auto

  # HTML background color.
  # BGCOLOR="#c0c0c0"

  # Enable CGI debugging. Not really useful.
  # DEBUG=1

🔐 CGI access 🔐

listen. the information provided by dpkg-www and the ability to install or remove packages also remotely can potentially give useful information to crackers and open security holes 💀. for these reasons access to this CGI program should be allowed only from localhost and trusted hosts or domains. unfortunately this configuration is dependent on the particular installed web server 🙃. the dpkg-www package configures the apache server, if installed, to allow access only from localhost. other web servers must be configured manually by the system administrator to restrict access to trusted hosts. if you administer many Debian system on a local network you may want to enable access to the CGI from your network and browse packages on any host from any other machine ✨.

💅 Web installation 💅

if this option is enabled in the /etc/dpkg-www.conf file, the 'Install', 'Upgrade' and 'Remove' buttons are added to the info page of installed or uninstalled packages. by clicking on this button the system administrator — or more precisely any user who has the ability to become system administrator (since you don't want to run a web browser as root!) — will be able to install or remove a package on the fly, provided he has properly configured his browser for web installation 👑

for security reasons the installation is done entirely from the browser side, so that you don't need to gain root privileges from the CGI program which is run on the server 🌈. the only thing done on the server is to generate an installation request which is downloaded to the browser for the execution, which is started under control of the user and with his privileges. the real installation is done by a small helper script run from the user's browser when a document with content-type 'application/dpkg-www-installer' is received from the web server. the helper script opens an XTerm on the user's display and runs a script which becomes superuser, after asking the root password, and execs an apt-get(8) command to install the requested packages 🔥.

the web browser must have been configured to handle the above content-type by running the command "/usr/sbin/dpkg-www-installer -x -f '%s'", which must obviously be installed also on the client side if installing remotely 🦋. if the dpkg-www package is not installed on the browser client you can simply copy the script /usr/sbin/dpkg-www-installer and hope it works... 😭 (no cap, that's what it says)

you can configure your Firefox browser from the General -> Application menu of the Preferences window. you must add a new item with MIME type "application/dpkg-www-installer" and application "/usr/sbin/dpkg-www-installer -x -f '%s'". this should add the following line to your Firefox mailcap file:

 application/dpkg-www-installer;/usr/sbin/dpkg-www-installer -x -f '%s'

the dpkg-www web installation has been successfully tested only with Firefox. with other web browsers it is untested and it may not work correctly 🙈.

So here's the tea: to actually install anything, you need the root password — the one it asks for with su root when you're doing it on the local server 💅. If you're installing from a remote client instead, you need to be able to ssh as root to the remote host. That's the vibe check. No password, no packages, periodt.

Ngl, let's talk security for a sec because this part actually matters, bestie. Executing a web installation is functionally equivalent to opening a shell in an XTerm, becoming superuser after supplying the proper password, and running apt-get(8) as root to install or remove the packages you want. Same energy, fr fr. Starting this from the web could be potentially vulnerable to man-in-the-middle (MITM) attacks, but since it requires a password on the client it seems quite safe. 😌 And if you're really paranoid? Connect to a secure server from an SSL-enabled browser. That's the move. 🛡️

Also important, and I need you to hear me on this one: the dpkg-www web installation is not intended to replace the normal use of apt-get(8) from the shell 🙅‍♀️. It's provided only as a shortcut — a little ✨convenience era✨ — to let you install a package after you've located it with the browser, without needing to open a root shell and run apt-get(8) manually. For normal package maintenance and system upgrade, the use of apt-get(8) from the shell is recommended. That's the honest truth, no cap. 🔥

🌿 ENVIRONMENT 🌿

DPKG_WWW_HOST — the hostname to use. That's it, that's the whole env var 🫶

📁 FILES 📁

/etc/dpkg-www.conf — the configuration file for dpkg-www. And here's the cute part: it does not need to exist 😌 there are sensible defaults for everything, so if it's missing, we cope. Slay. 💜

👀 SEE ALSO 👀

Go read these when you're done here, bestie:

dpkg(1)
dwww(1)
dwww(7)
dlocate(1)
man2html(8)
grep-dctrl(1)

And that's a wrap on the whole page, babes. This lil masterpiece is version 2.66, dated 2026-05-10 — so go forth, grep responsibly, and remember: reading the manpage is main character energy. Mwah 💅✨🎀

📦 where this page comes from

ubuntu stonking: dpkg-www 2.66
💖 girlified by deepseek-ai/DeepSeek-V4.1-Flash on 2026-11-03: a language model's rewrite of the original, under its terms