Debian Source Package Files Explained

A Debian source package provides the necessary code and instructions to compile and build binary .deb packages for the Debian operating system. In the Debian archive, a standard source package typically consists of two to three distinct files: a control file (.dsc), an upstream source tarball (.orig.tar.*), and a Debian-specific packaging tarball (.debian.tar.*). This modular structure separates the original software author's code from the Debian-specific modifications, facilitating easier maintenance and transparent tracking of downstream changes.

The Debian Source Control File (.dsc)

The .dsc (Debian Source Control) file is a lightweight, human-readable text file that functions as the manifest for the entire source package. It is cryptographically signed using GnuPG by the package maintainer or the Debian build daemon. Key contents include:

  • Package Metadata: Package name, version, maintainer contact details, and source standards version.
  • Build Dependencies: A list of software packages and libraries required to build the source code (defined by Build-Depends).
  • Binary Packages: Names and architectures of the binary packages that this source generates.
  • File Checksums: File names, sizes, and cryptographic hashes (MD5, SHA-1, and SHA-256) of all accompanying files belonging to the source package, ensuring integrity and preventing tampering.

The Upstream Tarball (.orig.tar.*)

For non-native software (software created outside of Debian), the upstream source code is packaged in an original tarball. This file usually has the extension .orig.tar.gz, .orig.tar.bz2, or .orig.tar.xz.

  • Purity: It represents the pristine, unmodified release archive distributed by the upstream developers.
  • Multiple Tarballs: In cases where upstream projects distribute components across multiple archives, Debian supports multiple upstream tarballs using the format <package>_<version>.orig-<component>.tar.xz.

The Debian Packaging Tarball (.debian.tar.*)

In the modern standard "3.0 (quilt)" source format, all Debian-specific changes are packaged in a separate archive named <package>_<version>.debian.tar.xz (or .gz/.bz2). This archive unpacks directly into a debian/ directory inside the extracted source root and contains:

  • Control Files: Files such as control (package descriptions and dependencies), rules (the executable Makefile that orchestrates the build process), and changelog (history of package updates).
  • Copyright and Documentation: License documentation (copyright) and distribution-specific manuals or notes.
  • Patches: A patches/ directory managed by the quilt tool, storing downstream bug fixes or compatibility patches applied cleanly on top of the upstream source during build time.

Variations: Native Packages and Legacy Formats

  • Native Debian Packages: For software developed specifically for Debian (such as dpkg or apt), there is no concept of separate "upstream" code. A native package consists of only two files: the .dsc file and a single <package>_<version>.tar.xz file containing both the source code and the debian/ directory.
  • Legacy "1.0" Format: In older archives, Debian non-native packages used a .diff.gz file instead of a .debian.tar.* file. This format stored all Debian files and upstream code modifications as a single monolithic diff against the .orig.tar.gz archive. While still readable by Debian package management tools, modern development strictly favors the cleaner "3.0 (quilt)" split.