Debian Incoming Queue Package Verification

This article provides an overview of the incoming package verification workflow in the Debian operating system, detailing how developer uploads are received, cryptographically authenticated, and transitioned through the archive management system. It covers the role of the Debian Archive Kit (DAK), the verification of GPG signatures against the official keyring, the validation checks executed on incoming files, and the progression of packages from the staging queues to the public mirrors.

The Debian Archive Kit (DAK)

Debian relies on a centralized suite of archive maintenance scripts known as DAK (Debian Archive Kit) to process, validate, and publish all packages uploaded to the official repositories. DAK manages the software lifecycle from initial ingestion to distribution across mirrors worldwide.

Initial Upload and the Staging Queue

When a Debian maintainer or developer uploads a package using upload utilities such as dput or dupload, the package artifacts are sent securely via SSH or HTTPS to an ingestion server (such as ftp-master.debian.org).

The uploaded artifacts typically include:

  • A cryptographic summary file (.changes)
  • Source packaging descriptions (.dsc)
  • Compressed source archives (.tar.xz, .tar.gz)
  • Binary packages (.deb, .udeb)

Upon arrival, the files are placed into an incoming staging directory, often referenced as the unchecked queue. Files remain in this holding area until scheduled DAK automated routines parse them.

Cryptographic Signature Verification

The critical security gate of the incoming queue is the automated execution of dak process-upload.

DAK first inspects the uploaded .changes and .dsc files for a valid OpenPGP/GPG cryptographic signature. This verification is performed strictly against official Debian keyrings:

  • debian-keyring: Contains the active public keys of Debian Developers (DDs) and Debian Maintainers (DMs).
  • debian-maintainers: Contains restricted keys for maintainers allowed to upload specific source packages without full project membership.

If the GPG signature does not match an active, trusted key in the official keyring, or if the signature is malformed, DAK rejects the upload immediately. An automated error notice is dispatched to the uploader, and the files are routed to a reject staging area to prevent unauthorized code execution or archive contamination.

Integrity and Policy Checks

Once cryptographic identity is confirmed, DAK executes a sequence of structural and policy validations:

  1. Checksum Verification: DAK computes the cryptographic checksums (typically SHA-256 and MD5) of all referenced binary and source files and compares them with the hashes listed in the signed .changes file to guarantee data integrity.
  2. Version and Architecture Sanity: The upload is checked to ensure that the package version strictly increases over the currently published version and targets an appropriate distribution suite (such as unstable, experimental, or stable-security).
  3. Permission Checks: For uploads signed by Debian Maintainers, DAK verifies whether the key holder has explicit upload rights granted for the specific package name.

The NEW Queue vs. Automatic Acceptance

After passing technical verification, the upload is assigned to one of two paths:

  • Accepted Queue: If the package is an update to an existing package and introduces no new binary names, it is moved to the accepted queue. From there, it is integrated into the package pool during the next archive processing cycle (dinstall).
  • The NEW Queue: If the upload introduces a brand-new source package or adds a new binary package name that has not previously existed in the archive, it is held in the NEW queue. Packages in NEW require human review by the Debian FTP Master team. FTP Masters examine the package’s copyright statement, licensing terms (debian/copyright), and overall Debian Free Software Guidelines (DFSG) compliance before manually approving or rejecting the upload.

Final Distribution

Once approved—either automatically or through the NEW review process—the package files are copied into the permanent /pool directory structure. During the periodic dinstall (Debian installer/archive run) process, DAK regenerates repository metadata, updates Packages and Sources index files, signs the release files using the official Debian archive signing key, and synchronizes the updates with external mirror networks.