Image for post
Image for post

Breaking Open the DEB Package

There comes a time where you need open a Debian package, whether to verify the contents or to learn some of the secrets inside the box, such as install and config scripts, systems integration — such as init scripts: sysVinit, upstart, systemd, or general best practices.

On a Debian or Ubuntu system this should be very easy using the dpkg utility. For example, with the Oracle WebUpdate team installer:

dpkg --extract oracle-java8-installer_8u161-1~webupd8~0_all.deb .

Unfortunately this doesn’t always work…

A Debian package is a GNU archive, and thus uses the ar tool. Inside are further compressed components, e.g. control and data. In the case of Oracle, they use tar-gzip. You unarchive everything using the following pattern:

mkdir -p output/data output/control && cd output
ar vx ../oracle-java8-installer_8u161-1~webupd8~0_all.deb
tar -xzvf data.tar.gz -C data
tar -xzvf control.tar.gz -C control
rm *.gz

In case this is not obvious, this only works on a file system that supports symbolic links, or at least emulates symbolic links.

Thus, this will definitely not work on Linux guest on Windows host, where NTFS mounted as vboxsf file system under Virtualbox.

Written by

Linux NinjaPants Automation Engineering Mutant — exploring DevOps, Kubernetes, CNI, IAC

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store