What Is a DEB File? Read the First Bytes, Then Open the Package Inside

6 How Do You Open DEB Files? dpkg-deb, ar with tar or 7-Zip, with nothing installed

DEB files have no viewer of their own, and a double click may start an installer. If you only want to look inside, use a program that unpacks archives. The table lists what we tried and what we only read about.

Open DEB files with dpkg-deb

This is the program made for the job. Option -I prints the control data. Option -c lists the files. Option -x saves them to a folder, option -e saves the control files and option -R saves both. None of them installs anything. The dpkg-deb manual page lists every option.

dpkg-deb -I g02-gzip.deb
dpkg-deb -c g02-gzip.deb
dpkg-deb -x g02-gzip.deb files
dpkg-deb -e g02-gzip.deb control
dpkg-deb -R g02-gzip.deb both

dpkg-deb -I g02-gzip.deb
 new Debian package, version 2.0.
 size 201504 bytes: control archive=486 bytes.
      21 bytes,     1 lines      conffiles
     210 bytes,     8 lines      control
     234 bytes,     4 lines      md5sums
 Package: g02-gzip
 Version: 1.0-1
 Architecture: all
 Maintainer: Test Maker <test@example.invalid>
 Description: Test package g02-gzip

Our dpkg-deb -c listed 16 entries for the test DEB file: 4 files, a link and 11 folders. It worked on all 11 good DEB files, the old format and the empty package too.

Open DEB files with ar and tar

Without dpkg you can still split a package. The command ar x saves three members into the current folder. Then tar opens the archives, and it spots gzip, xz, bzip2, lzma and zstd by itself. This worked on 9 of 10 DEB files. The old format is the one that failed.

mkdir out && cd out
ar x ../g02-gzip.deb
tar -xf data.tar.*
mkdir control && tar -xf control.tar.* -C control

Using tar on the DEB file itself does not work. GNU tar said "This does not look like a tar archive".

Open DEB files with 7-Zip

Install 7-Zip, then open your DEB file as an archive, or use the command line. A DEB file has archives inside an archive, so plan on two or three passes.

7z l g02-gzip.deb
7z x g02-gzip.deb -oout1
7z x out1/data.tar -oout2

On gzip and xz DEB files the first pass gave data.tar. On DEB files with no compression it gave control.tar and data.tar. On bzip2 and lzma DEB files it gave all three members, and the data archive needed two more passes. On the three zstd DEB files it saved the two members and the next pass failed with exit code 2. For those, use dpkg-deb or ar with tar.

Reference pages

These four links open outside pages: the deb(5) format page, the dpkg-deb page, Wikipedia and FileInfo.

7 How Do You Install a DEB File? apt install, dpkg -i and what happens to dependencies

Installing is different from opening. An install copies files to system folders, saves a package record and calls the scripts from the control archive. The two usual commands are apt install and dpkg -i.

1. 1 Check the DEB file first with dpkg-deb -I. Read its name, version, architecture and Depends line.
2. 2 Install it with sudo apt install ./file.deb. The ./ matters, because without it apt looks for a package of that name in its lists.
3. 3 Or use sudo dpkg -i file.deb when you have the dependencies ready. If one is missing, dpkg stops and leaves the package unconfigured.
4. 4 List what it added with dpkg -L, and remove it with dpkg -r or dpkg -P.

dpkg-deb -I g14-needs-tree.deb
sudo apt install ./g14-needs-tree.deb
# or, when the dependencies are already in place
sudo dpkg -i g14-needs-tree.deb
dpkg -L g14-needs-tree
sudo dpkg -r g14-needs-tree
sudo dpkg -P g14-needs-tree

When a dependency is missing

The control file can name other packages the program needs. We built a DEB file that needs a package that does not exist. dpkg -i unpacked it, printed the message below and left it unconfigured. When apt meets a package left like that, it suggests apt --fix-broken install.

sudo dpkg -i g12-deps.deb
dpkg: dependency problems prevent configuration of g12-deps:
 g12-deps depends on g12-missing-lib (>= 1.0); however:
  Package g12-missing-lib is not installed.
dpkg: error processing package g12-deps (--install):
 dependency problems - leaving unconfigured

With apt the dependency is fetched for you, if the archive has it. We built a second DEB file that needs tree. A simulated install planned to add tree first and our DEB file second. Without the ./ in front of the name, apt said "Unable to locate package". We only simulated apt, so no package changed.

apt-get install --simulate ./g14-needs-tree.deb
Inst tree (2.1.1-2ubuntu3.24.04.2 Ubuntu:24.04/noble-updates [amd64])
Inst g14-needs-tree (1.0-1 local-deb [all])
Conf tree (2.1.1-2ubuntu3.24.04.2 Ubuntu:24.04/noble-updates [amd64])
Conf g14-needs-tree (1.0-1 local-deb [all])

What dpkg -r and dpkg -P leave behind

The dpkg manual page says removal keeps the settings files named in conffiles, and purging removes them. We saw both. After dpkg -r, /etc/hello-test.conf was still there. After dpkg -P, it was gone.

Why installing needs care

The scripts in the control archive are programs. The dpkg manual page lists prerm, preinst and configuring among the steps of an install. In our test, the postinst printed a line as root. A bad DEB file could do far more.

Install DEB files from the Debian or Ubuntu archives, or from a maker you know. To read scripts first, save the control files with dpkg-deb -e and open postinst and the others in a text editor.

8 How Do You Make a DEB File With dpkg-deb? A folder, a control file and one command

You need three things: the folder tree as it should appear on the target system, a DEBIAN folder and a control file. Our dpkg-deb refused to build without a Package, a Version or an Architecture line. Without a Maintainer or Description it built the DEB file and printed a warning.

1. 1 Make a folder named for the package, and copy your files into it with the paths they should have on the target system.
2. 2 Add a DEBIAN folder with a control file. Add md5sums, conffiles and scripts if you need them.
3. 3 Build with dpkg-deb --root-owner-group --build, the folder name and the new file name.
4. 4 Check the result with dpkg-deb -I and -c, then test an install on a machine you can reset.

Package: hello-test
Version: 1.0-1
Section: misc
Priority: optional
Architecture: all
Maintainer: Test Maker <test@example.invalid>
Description: A small test package
 A longer line starts with one space.

mkdir -p hello/DEBIAN hello/usr/bin
cp hello-test hello/usr/bin/
nano hello/DEBIAN/control
dpkg-deb --root-owner-group --build hello hello_1.0-1_all.deb
dpkg-deb -I hello_1.0-1_all.deb

Choose a compression

The option -Z picks the compression. We built the same folder with every choice. Our files are mostly 200,000 random bytes, which no compressor can shrink, so the sizes are close. Text and programs usually shrink more, so test your own files.

The same input gives the same file

We set SOURCE_DATE_EPOCH to one fixed number and built the same folder twice, with a pause of 2 seconds between the builds. The two DEB files had the same SHA-256 hash. That is how we made our test files repeatable.

Make an old format DEB file

Our dpkg-deb 1.22.6 can still write the old layout. Add the option --deb-format=0.939000. We used it for the old-format sample, and dpkg-deb read and installed the result. New DEB files should use the modern layout, because ar and 7-Zip cannot read the old one.

dpkg-deb --root-owner-group --deb-format=0.939000 --build hello hello_old.deb

9 How Do You Check a DEB File Is Sound? The md5sums list, dpkg -V and a download hash

The md5sums file lists an MD5 hash for every file the package installs. dpkg-deb -e saves it and md5sum -c reads it. This checks the files against the package's own list. It cannot show that someone changed both file and list, so also compare the hash of the entire DEB file with the one on the download page.

1. 1 Save the control files with dpkg-deb -e and the data files with dpkg-deb -x.
2. 2 Go into the data folder and check the files with md5sum -c.
3. 3 After you install, use dpkg -V to compare the installed files with the list dpkg saved.
4. 4 Hash the DEB file itself with sha256sum and compare it with the number on the download page.

dpkg-deb -e g02-gzip.deb control
dpkg-deb -x g02-gzip.deb files
cd files
md5sum -c ../control/md5sums
# after you install it
dpkg -V g02-gzip
sha256sum g02-gzip.deb

md5sum -c ../control/md5sums
etc/hello-test.conf: OK
usr/bin/hello-test: OK
usr/share/doc/g05-none/README: OK
usr/share/g05-none/photo.bin: FAILED
md5sum: WARNING: 1 computed checksum did NOT match

The ??5?????? line means the MD5 hash differs. The dpkg(1) page on verifying says the check uses data stored in the dpkg database. So it compares installed files with the list dpkg saved, and not with the DEB file. Lintian is a checker for package makers, and our bare test DEB files had no changelog or copyright file.

Signatures

Wikipedia lists debsigs, debsig-verify and dpkg-sig as tools that sign and check DEB files. We did not test them. For a DEB file from a web page, the hash on that page is the check you have.

11 How Do You Convert a DEB File to RPM or TAR? alien, dpkg-deb and the scripts that get left behind

Wikipedia lists alien as a program that converts DEB files and other packages to and from other formats. We tried it on our scripts DEB file. The option --to-rpm made an RPM file, and the option --to-tgz made a tarball. The table shows what the routes kept.

sudo alien --to-rpm --scripts g08-scripts.deb
sudo alien --to-tgz --scripts g08-scripts.deb
dpkg-deb --fsys-tarfile g08-scripts.deb > files.tar
rpm -qp --scripts g08-scripts-1.0-2.noarch.rpm

A converted package is not a native one. Dependencies and library names may differ between systems. We checked only that the files and the scripts came across. We did not install the RPM on a Red Hat system.

Change the compression of a DEB file

You can also pack the same files again. Save them with dpkg-deb -R, then build with another -Z choice. We built gzip, xz, zstd and uncompressed DEB files from one folder, and the sizes are in the make section. The deb(5) note on zstd says zstd needs dpkg 1.21.18 or newer, so choose gzip or xz when you share a DEB file with older systems.