4.1 Debian Low-Level Package Management with dpkg (102.4)

4.1 Debian Low-Level Package Management with dpkg (102.4)

Quick Summary: The dpkg (Debian Package) utility is the fundamental low-level tool responsible for installing, querying, building, and removing Debian .deb packages. Operating directly on local package files or the internal package database (/var/lib/dpkg/), dpkg does not download software from remote network repositories and does not automatically resolve or install missing prerequisite dependencies. High-level package managers like apt and apt-get rely on dpkg under the hood to perform actual filesystem modifications.

---

1. Debian Package Architecture & The .deb Binary Format

A Debian package is a standard Unix ar archive containing three distinct files. Understanding this internal archive layout is essential for troubleshooting broken packages and grasping how dpkg processes software assets.

┌────────────────────────────────────────────────────────┐
│            example-package_2.4.1_amd64.deb             │
│                      (ar archive)                      │
├───────────────────┬───────────────────┬────────────────┤
│  debian-binary    │  control.tar.xz   │  data.tar.xz   │
│   (Text format    │   (Package meta,  │  (Application  │
│    version: 2.0)  │  scripts & checks)│   binaries &   │
│                   │                   │   file tree)   │
└───────────────────┴───────────────────┴────────────────┘

The Core Components of a .deb Archive

1. debian-binary: A small plain-text file containing the deb package format version (typically 2.0).
2. control.tar.xz (or .tar.gz): A compressed tarball containing control metadata and maintainer scripts:
   • control: Key package metadata, including package name, version, architecture, maintainer, description, and dependency rules (Depends, Pre-Depends, Recommends, Suggests, Conflicts, Provides).
   • preinst: Shell script executed before unpacking the package files onto the target filesystem.
   • postinst: Shell script executed after unpacking to complete service registration, link creation, or initial configuration.
   • prerm: Shell script executed before removing package binaries.
   • postrm: Shell script executed after removing package binaries (and during purge to remove residual data).
   • conffiles: List of configuration files managed by the package that dpkg should protect from being overwritten silently during upgrades.
   • md5sums: MD5 verification checksums for every file installed by the package.
3. data.tar.xz (or .tar.gz / .tar.zst): A compressed archive containing the actual filesystem payload (binaries in /usr/bin, libraries in /usr/lib, man pages in /usr/share/man, configuration files in /etc).

---

2. The dpkg Command Matrix: Core Operations & Flags

dpkg operates in distinct modes based on whether you are managing local .deb files or querying/modifying installed packages in the local database.

💡 LPIC-1 Exam Fill-in-the-Blank Alert: Note the strict distinction between querying installed packages vs. uninstalled .deb archive files:

• To list files from an installed package: dpkg -L <package_name>
• To search which installed package owns a file: dpkg -S <path_to_file>
• To list files inside an uninstalled .deb file: dpkg -c <filename.deb>
• To view control/metadata information of an uninstalled .deb file: dpkg -I <filename.deb>

---

3. Package Status Flags & Status Database Inspection

The status of all packages known to the system is tracked in /var/lib/dpkg/status. When executing dpkg -l (or dpkg --list), dpkg displays a summary table where the first three characters of each line indicate the precise state of that package.

$ dpkg -l "nginx*"
Desired=Unknown/Install/Remove/Purge/Hold
| Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend
|/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
||/ Name           Version         Architecture Description
+++-==============-===============-============-====================================
ii  nginx          1.22.1-9        amd64        small, powerful, scalable web/proxy server
rc  nginx-common   1.18.0-6        all          small, powerful, scalable web/proxy server - common files
un  nginx-doc      <none>          all          (no description available)

The 3-Character Flag Breakdown

1. Column 1: Desired Action (What the administrator or system requested)

   • u: Unknown (no specific target state requested)
   • i: Install (package is marked for installation)
   • r: Remove (package is marked for de-installation)
   • p: Purge (package is marked to be purged along with configurations)
   • h: Hold (package is locked at its current version and must not be upgraded)

2. Column 2: Current Status (Actual physical state on the filesystem)

   • n: Not-installed (package is not present on the system)
   • c: Config-files (package binaries were removed, but configuration files still remain)
   • u: Unpacked (files have been unpacked to disk, but post-install configuration has not run)
   • f: Half-configured (configuration script started but failed or was interrupted)
   • h: Half-installed (installation began but failed before unpacking finished)
   • w: Triggers-awaited (package is waiting for trigger processing by another package)
   • t: Triggers-pending (package has triggers that must be executed)
   • i: Installed (package is completely unpacked and successfully configured)

3. Column 3: Error Flag (Condition requiring manual intervention)

   • <space>: No error condition
   • R: Reinst-required (package is broken; must be reinstalled before removal or upgrade)

Crucial Status Combinations for the Exam

• ii: Desired Install, Current Installed — Package is healthy, functional, and fully configured.
• rc: Desired Remove, Current Config-files — Package binaries were removed (e.g., via dpkg -r or apt remove), but configuration files remain on disk.
• un: Desired Unknown, Current Not-installed — The package is referenced by dependencies but has never been installed.
• hi: Desired Hold, Current Installed — Package is installed and pinned to prevent automatic upgrades.

⚠️ LPIC-1 Trap: A package in state rc still has configuration files in /etc. To completely eliminate those lingering files and clean up the database, you must run dpkg -P <package_name> (or apt purge <package_name>).

---

4. Two-Stage Installation & Package State Management

Under the hood, dpkg -i performs installation in two distinct phases: unpacking and configuring.

┌─────────────────┐       dpkg --unpack       ┌─────────────────┐       dpkg --configure       ┌─────────────────┐
│  .deb Archive   │ ────────────────────────> │ Unpacked State  │ ───────────────────────────> │ Installed State │
│  (On File Sys)  │                           │ (Files on disk) │                              │  (ii - Active)  │
└─────────────────┘                           └─────────────────┘                              └─────────────────┘

1. dpkg --unpack <file.deb>

Extracts files from data.tar.xz into the live filesystem and copies control files into /var/lib/dpkg/info/, but does not execute the postinst script. The package enters the iU (Install / Unpacked) state.

2. dpkg --configure <pkg> (or dpkg --configure -a)

Runs the postinst script, establishes symbolic links, updates system caches (such as ldconfig), and registers services. The --configure -a (or --configure --pending) command instructs dpkg to configure all unpacked but unconfigured packages—frequently used to recover from interrupted installations.

# Configure all pending, unpacked packages
sudo dpkg --configure -a

3. dpkg --get-selections and dpkg --set-selections

These commands allow administrators to export the installation state of every package on a reference machine and replicate that exact configuration onto a new host:

# On reference machine: export package selection state
dpkg --get-selections > installed_packages.txt

# On target machine: import package selection state into dpkg database
sudo dpkg --set-selections < installed_packages.txt

# Execute APT to download and install all selected packages
sudo apt-get dselect-upgrade

4. dpkg-reconfigure <pkg>

If a package has already been installed and configured, running dpkg-reconfigure <pkg> re-opens its interactive configuration dialogs (managed by the debconf system), allowing administrators to alter timezone settings, keyboard layouts, or service parameters without reinstalling.

# Reconfigure system timezone interactively
sudo dpkg-reconfigure tzdata

# Reconfigure system locale settings
sudo dpkg-reconfigure locales

---

5. The Low-Level Dependency Trap

dpkg lacks a repository client, dependency resolver, or network stack. If you attempt to install a .deb package that requires libraries or utilities not currently present on the system, dpkg -i will unpack the files, fail during dependency checks, and abort without configuring the package.

$ sudo dpkg -i tree_1.8.0-1_amd64.deb
Selecting previously unselected package tree.
(Reading database ... 184520 files and directories currently installed.)
Preparing to unpack tree_1.8.0-1_amd64.deb ...
Unpacking tree (1.8.0-1) ...
dpkg: dependency problems prevent configuration of tree:
 tree depends on libc6 (>= 2.34); however:
  Version of libc6:amd64 on system is 2.31-13.
dpkg: error processing package tree (--install):
 dependency problems - leaving unconfigured
Errors were encountered while processing:
 tree

To fix a system left in this broken dependency state, high-level APT tools must be invoked with the --fix-broken flag:

sudo apt-get -f install
# OR using modern syntax
sudo apt --fix-broken install

APT will query configured network repositories, download all missing prerequisite libraries, configure them via dpkg, and finally configure the target package.