validate a deb package before trying to install it

J'e

11/14/23, 6:44 PM

TL;DR How do a verify that a deb file is complete and without error?

I have an incomplete download of a deb package that will error out on install. Before trying to install it, I would like to check if it's valid. As noted in how-to-inspect-and-validate-a-deb-package-before-installation, I can use dpkg-deb --info <deb file> however this gives all the info but does not show any errors on my file.

In my particular case, I have the following file

# file is actually ~40MB, download the first 27MB
curl -r 0-28208916 https://download.docker.com/linux/ubuntu/dists/jammy/pool/stable/amd64/docker-ce-cli_20.10.21~3-0~ubuntu-jammy_amd64.deb

The following shows the info of the deb but does not report an incomplete file

dpkg-deb --info docker-ce-cli_20.10.21~3-0~ubuntu-jammy_amd64.deb

Output from dpkg-deb command,

 new Debian package, version 2.0.
 size 28208917 bytes: control archive=5436 bytes.
    1059 bytes,    24 lines      control
   14836 bytes,   195 lines      md5sums
 Package: docker-ce-cli
 Source: docker-ce
 Version: 5:20.10.21~3-0~ubuntu-jammy
 Architecture: amd64
 Maintainer: Docker <support@docker.com>
 Installed-Size: 145640
 Depends: libc6 (>= 2.34)
 Recommends: docker-scan-plugin
 Conflicts: docker (<< 1.5~), docker-engine, docker-engine-cs, docker.io, lxc-docker, lxc-docker-virtual-package
 Breaks: docker-ce (<< 5:0)
 Replaces: docker-ce (<< 5:0)
 Section: admin
 Priority: optional
 Homepage: https://www.docker.com
 Description: Docker CLI: the open-source application container engine
  Docker is a product for you to build, ship and run any application as a
  lightweight container
  .
  Docker containers are both hardware-agnostic and platform-agnostic. This means
  they can run anywhere, from your laptop to the largest cloud compute instance and
  everything in between - and they don't require you to use a particular
  language, framework or packaging system. That makes them great building blocks
  for deploying and scaling web apps, databases, and backend services without
  depending on a particular stack or provider.

109

0 + 2

dpkg

deb

software-installation

George

11/14/23, 10:29 PM

A similar issue is discussed [here]( https://unix.stackexchange.com/questions/630910/sha1-verification-of-external-deb-package-before-install). It discusses checking the package checksum.

J'e

11/14/23, 10:46 PM

So what you're saying, is that there is no way to verify a package without using an external hash?

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: validate a deb package before trying to install it

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.