What is inside a Debian .deb file?
A modern Debian binary package is an ar archive. Its first member, debian-binary, declares the package format. The control tar contains package metadata and optional maintainer scripts, conffiles and other control files. The data tar holds the files intended for installation.
This preflight checks member ordering, archive bounds, tar header checksums, normalized paths, duplicate members, permissions and link chains. Script findings retain exact source lines. Tar offsets refer to the expanded control or data archive, rather than the compressed .deb byte offset.
Review maintainer scripts and conffiles together
The preinst, postinst, prerm and postrm programs can run during package transitions. A debconf config script can also be present. Inspect commands that change accounts, permissions, capabilities, services, other packages, or files outside the expected installation paths.
Normal conffiles are absolute paths to regular payload files. A remove-on-upgrade entry instead identifies an old conffile that must be absent from the payload. Literal conffile references near write/delete commands are review candidates, since package configuration handling can depend on upgrade state and shell conditions.
Scope of the review
A package with no reported structural errors still needs approval. This tool does not verify publisher identity, signatures, package hashes or md5sums, Zstandard content checksums, dependency satisfiability, target dpkg behavior or the behavior of installed executables. Sparse archives, legacy bzip2/LZMA compression and unsupported tar layouts are refused.
Link resolution covers exact payload paths and link chains; links inside a target path's parent directories, existing host paths, ACL effects and filesystem races need target review. PAX attributes do not establish what dpkg will preserve. Static script patterns can miss indirect, encoded or multiline actions and can flag harmless literals.
Frequently asked questions
Does this install the package or run maintainer scripts?
No. The browser reads archive bytes in a cancellable local worker. It does not extract files to your filesystem, execute scripts, contact package repositories or install software.
Which compression formats are supported?
Plain tar, gzip, single-stream XZ and Zstandard control/data archives are supported. Legacy bzip2 and LZMA, sparse tar members and unsupported tar extensions stop inspection. Limits are 64 MiB input, 8 MiB expanded control, 128 MiB expanded data, 30,000 entries per archive, 1 MiB per text metadata file and 30 seconds. XZ dictionaries are limited to 64 MiB.
What does remove-on-upgrade mean in conffiles?
The remove-on-upgrade flag, supported since dpkg 1.20.6, marks a conffile for removal on upgrade. Its path must not exist in the payload. Normal conffiles must be absolute paths to regular packaged files.
Does a clean preflight mean the package is safe?
No. Findings cover bounded structural and static pattern checks. Obfuscated or indirect script behavior, repository trust, payload digests, signatures, dependency resolution and target-specific installation behavior need separate verification.
Can a .deb contain file capabilities?
The tool decodes recognized security.capability PAX attributes if present and flags literal setcap actions in scripts. Absence of archive attributes does not prove absence of installed capabilities; dpkg preservation and runtime effects are unverified.
Format references and related checks
See the Debian package format, conffiles format and Debian maintainer-script policy. For other packaging and privilege reviews, try the Python wheel auditor, JAR signature auditor or sudoers rule tester.