Fix Corrupted Binaries in Debian with debsums and apt

System file corruption in Debian can lead to unpredictable behavior, application crashes, or system instability. This guide explains how to detect altered, missing, or corrupted binary executables using the debsums utility and how to restore them to their original state using Debian's native package manager, apt.

1. Install debsums

Debian packages maintain MD5 checksums for installed files within their metadata. The debsums tool verifies these checksums against the actual files on your filesystem.

Install the utility using:

sudo apt update
sudo apt install debsums

2. Scan and Identify Corrupted Files

Run debsums to scan the filesystem for corrupted binaries. To avoid viewing thousands of successfully verified files, use flags that filter the output:

List only corrupted or modified files:
```
sudo debsums -c
```
Silent scan (only reports errors, missing files, or checksum failures):
```
sudo debsums -s
```

If you suspect a specific binary is failing (for example, /bin/ls), you can test that individual file directly:

debsums -s /bin/ls

3. Identify the Owning Package

Before you can reinstall the corrupted binary, you must determine which package owns it. Use dpkg -S followed by the absolute path to the corrupted file reported by debsums:

dpkg -S /path/to/corrupted_binary

Example:

dpkg -S /bin/ls

Output:

coreutils: /bin/ls

In this example, coreutils is the package that contains the binary.

4. Reinstall the Package Using apt

Once the package name is identified, force apt to download a fresh copy and overwrite the corrupted files without removing configuration settings or dependencies:

sudo apt install --reinstall <package_name>

Example:

sudo apt install --reinstall coreutils

If you suspect that the local package cache itself may be corrupted, clear the cache before reinstalling:

sudo apt clean
sudo apt update
sudo apt install --reinstall <package_name>

5. Verify the Repair

After the reinstallation completes, run debsums against the affected package to confirm that the binaries now match their upstream checksums:

debsums <package_name>

If the repair was successful, all files associated with the package will report an OK status.