neulab/tldr huggingface dataset:
dpkg is a tool to install, build, remove and manage Debian packages. The primary and more user-friendly front-end for dpkg is aptitude(8). dpkg itself is controlled entirely via command line parameters, which consist of exactly one action and zero or more options. The action-parameter tells dpkg what to do and options control the behavior of the action in some way.
dpkg can also be used as a front-end to dpkg-deb(1) and dpkg-query(1). The list of supported actions can be found later on in the ACTIONS section. If any such action is encountered dpkg just runs dpkg-deb or dpkg-query with the parameters given to it, but no specific options are currently passed to them, to use any such option the back-ends need to be called directly.
dpkg maintains some usable information about available packages. The information is divided in three classes: states, selection states and flags. These values are intended to be changed mainly with dselect.
Package states not-installed The package is not installed on your system.
config-files Only the configuration files or the postrm script and the data it needs to remove of the package exist on the system.
triggers-awaited The package awaits trigger processing by another package.
triggers-pending The package has been triggered.
installed The package is correctly unpacked and configured.
Package selection states install The package is selected for installation.
hold A package marked to be on hold is kept on the same version, that is, no automatic new installs, upgrades or removals will be performed on them, unless these actions are requested explicitly, or are permitted to be done automatically with the --force-hold option.
purge The package is selected to be purged (i.e. we want to remove everything from system directories, even configuration files).
unknown The package selection is unknown.  A package that is also in a not- installed state, and with an ok flag will be forgotten in the next database store.
Package flags ok  A package marked ok is in a known state, but might need further processing.
reinstreq A package marked reinstreq is broken and requires reinstallation. These packages cannot be removed, unless forced with option --force-remove-reinstreq.
-i, --install package-file... Install the package. If --recursive or -R option is specified, package-file must refer to a directory instead.
--unpack package-file... Unpack the package, but don't configure it. If --recursive or -R option is specified, package-file must refer to a directory instead.
--configure package...|-a|--pending Configure a package which has been unpacked but not yet configured. If -a or --pending is given instead of package, all unpacked but unconfigured packages are configured.
To reconfigure a package which has already been configured, try the dpkg-reconfigure(8) command instead.
1. Unpack the conffiles, and at the same time back up the old conffiles, so that they can be restored if something goes wrong.
--triggers-only package...|-a|--pending Processes only triggers (since dpkg 1.14.17).  All pending triggers will be processed.  If package names are supplied only those packages' triggers will be processed, exactly once each where necessary. Use of this option may leave packages in the improper triggers-awaited and triggers-pending states. This can be fixed later by running: dpkg --configure --pending.
-r, --remove package...|-a|--pending Remove an installed package.  This removes everything except conffiles and other data cleaned up by the postrm script, which may avoid having to reconfigure the package if it is reinstalled later (conffiles are configuration files that are listed in the DEBIAN/conffiles control file).  If there is no DEBIAN/conffiles control file nor DEBIAN/postrm script, this command is equivalent to calling --purge.  If -a or --pending is given instead of a package name, then all packages unpacked, but marked to be removed in file /var/lib/dpkg/status, are removed.
-P, --purge package...|-a|--pending Purge an installed or already removed package. This removes everything, including conffiles, and anything else cleaned up from postrm.  If -a or --pending is given instead of a package name, then all packages unpacked or removed, but marked to be purged in file /var/lib/dpkg/status, are purged.
Note: Some configuration files might be unknown to dpkg because they are created and handled separately through the configuration scripts. In that case, dpkg won't remove them by itself, but the package's postrm script (which is called by dpkg), has to take care of their removal during purge. Of course, this only applies to files in system directories, not configuration files written to individual users' home directories.
Purging of a package consists of the following steps:
1. Remove the package, if not already removed. See --remove for detailed information about how this is done.
2. Run postrm script.
-V, --verify [package-name...] Verifies the integrity of package-name or all packages if omitted, by comparing information from the files installed by a package with the files metadata information stored in the dpkg database (since dpkg 1.17.2).  The origin of the files metadata information in the database is the binary packages themselves. That metadata gets collected at package unpack time during the installation process.
Currently the only functional check performed is an md5sum verification of the file contents against the stored value in the files database.  It will only get checked if the database contains the file md5sum. To check for any missing metadata in the database, the --audit command can be used.
The output format is selectable with the --verify-format option, which by default uses the rpm format, but that might change in the future, and as such, programs parsing this command output should be explicit about the format they expect.
-C, --audit [package-name...] Performs database sanity and consistency checks for package-name or all packages if omitted (per package checks since dpkg 1.17.10).  For example, searches for packages that have been installed only partially on your system or that have missing, wrong or obsolete control data or files. dpkg will suggest what to do with them to get them fixed.
--update-avail [Packages-file] --merge-avail [Packages-file] Update dpkg's and dselect's idea of which packages are available. With action --merge-avail, old information is combined with information from Packages-file. With action --update-avail, old information is replaced with the information in the Packages-file. The Packages-file distributed with Debian is simply named «Packages». If the Packages-file argument is missing or named «-» then it will be read from standard input (since dpkg 1.17.7). dpkg keeps its record of available packages in /var/lib/dpkg/available.
A simpler one-shot command to retrieve and update the available file is dselect update. Note that this file is mostly useless if you don't use dselect but an APT-based frontend: APT has its own system to keep track of available packages.
-A, --record-avail package-file... Update dpkg and dselect's idea of which packages are available with information from the package package-file. If --recursive or -R option is specified, package-file must refer to a directory instead.
--forget-old-unavail Now obsolete and a no-op as dpkg will automatically forget uninstalled unavailable packages (since dpkg 1.15.4), but only those that do not contain user information such as package selections.
--clear-avail Erase the existing information about what packages are available.
--get-selections [package-name-pattern...] Get list of package selections, and write it to stdout. Without a pattern, non-installed packages (i.e. those which have been previously purged) will not be shown.
--set-selections Set package selections using file read from stdin. This file should be in the format “package state”, where state is one of install, hold, deinstall or purge. Blank lines and comment lines beginning with ‘#’ are also permitted.
The available file needs to be up-to-date for this command to be useful, otherwise unknown packages will be ignored with a warning. See the --update-avail and --merge-avail commands for more information.
--clear-selections Set the requested state of every non-essential package to deinstall (since dpkg 1.13.18).  This is intended to be used immediately before --set-selections, to deinstall any packages not in list given to --set-selections.
--yet-to-unpack Searches for packages selected for installation, but which for some reason still haven't been installed.
Note: This command makes use of both the available file and the package selections.
--predep-package Print a single package which is the target of one or more relevant pre-dependencies and has itself no unsatisfied pre-dependencies.
If such a package is present, output it as a Packages file entry, which can be massaged as appropriate.
Returns 0 when a package is printed, 1 when no suitable package is available and 2 on error.
--add-architecture architecture Add architecture to the list of architectures for which packages can be installed without using --force-architecture (since dpkg 1.16.2). The architecture dpkg is built for (i.e. the output of --print-architecture) is always part of that list.
--remove-architecture architecture Remove architecture from the list of architectures for which packages can be installed without using --force-architecture (since dpkg 1.16.2). If the architecture is currently in use in the database then the operation will be refused, except if --force-architecture is specified. The architecture dpkg is built for (i.e. the output of --print-architecture) can never be removed from that list.
--print-architecture Print architecture of packages dpkg installs (for example, “i386”).
--print-foreign-architectures Print a newline-separated list of the extra architectures dpkg is configured to allow packages to be installed for (since dpkg 1.16.2).
--assert-feature Asserts that dpkg supports the requested feature.  Returns 0 if the feature is fully supported, 1 if the feature is known but dpkg cannot provide support for it yet, and 2 if the feature is unknown.  The current list of assertable features is:
support-predepends Supports the Pre-Depends field (since dpkg 1.1.0).
working-epoch Supports epochs in version strings (since dpkg 1.4.0.7).
long-filenames Supports long filenames in deb(5) archives (since dpkg 1.4.1.17).
multi-conrep Supports multiple Conflicts and Replaces (since dpkg 1.4.1.19).
multi-arch Supports multi-arch fields and semantics (since dpkg 1.16.2).
versioned-provides Supports versioned Provides (since dpkg 1.17.11).
protected-field Supports the Protected field (since dpkg 1.20.1).
--validate-thing string Validate that the thing string has a correct syntax (since dpkg 1.18.16).  Returns 0 if the string is valid, 1 if the string is invalid but might be accepted in lax contexts, and 2 if the string is invalid.  The current list of validatable things is:
pkgname Validates the given package name (since dpkg 1.18.16).
trigname Validates the given trigger name (since dpkg 1.18.16).
archname Validates the given architecture name (since dpkg 1.18.16).
version Validates the given version (since dpkg 1.18.16).
--compare-versions ver1 op ver2 Compare version numbers, where op is a binary operator. dpkg returns true (0) if the specified condition is satisfied, and false (1) otherwise. There are two groups of operators, which differ in how they treat an empty ver1 or ver2. These treat an empty version as earlier than any version: lt le eq ne ge gt. These treat an empty version as later than any version: lt-nl le-nl ge-nl gt-nl. These are provided only for compatibility with control file syntax: < << <= = >= >> >. The < and > operators are obsolete and should not be used, due to confusing semantics. To illustrate: 0.1 < 0.1 evaluates to true.
-?, --help Display a brief help message.
--force-help Give help about the --force-thing options.
-Dh, --debug=help Give help about debugging options.
--version Display dpkg version information.
When used with --robot, the output will be the program version number in a dotted numerical format, with no newline.
dpkg-deb actions See dpkg-deb(1) for more information about the following actions, and other actions and options not exposed by the dpkg front-end.
-b, --build directory [archive|directory] Build a deb package.
-c, --contents archive List contents of a deb package.
-e, --control archive [directory] Extract control-information from a package.
-x, --extract archive directory Extract the files contained by package.
-X, --vextract archive directory Extract and display the filenames contained by a package.
-f, --field  archive [control-field...] Display control field(s) of a package.
--ctrl-tarfile archive Output the control tar-file contained in a Debian package.
--fsys-tarfile archive Output the filesystem tar-file contained by a Debian package.
-I, --info archive [control-file...] Show information about a package.
dpkg-query actions See dpkg-query(1) for more information about the following actions, and other actions and options not exposed by the dpkg front-end.
-l, --list package-name-pattern... List packages matching given pattern.
-s, --status package-name... Report status of specified package.
-L, --listfiles package-name... List files installed to your system from package-name.
-S, --search filename-search-pattern... Search for a filename from installed packages.
-p, --print-avail package-name... Display details about package-name, as found in /var/lib/dpkg/available. Users of APT-based frontends should use apt show package-name instead.
All options can be specified both on the command line and in the dpkg configuration file /etc/dpkg/dpkg.cfg or fragment files (with names matching this shell pattern '[0-9a-zA-Z_-]*') on the configuration directory /etc/dpkg/dpkg.cfg.d/. Each line in the configuration file is either an option (exactly the same as the command line option but without leading hyphens) or a comment (if it starts with a ‘#’).
-B, --auto-deconfigure When a package is removed, there is a possibility that another installed package depended on the removed package. Specifying this option will cause automatic deconfiguration of the package which depended on the removed package.
-Doctal, --debug=octal Switch debugging on. octal is formed by bitwise-ORing desired values together from the list below (note that these values may change in future releases). -Dh or --debug=help display these debugging values.
Number   Description 1   Generally helpful progress information 2   Invocation and status of maintainer scripts 10   Output for each file processed 100   Lots of output for each file processed 20   Output for each configuration file 200   Lots of output for each configuration file 40   Dependencies and conflicts 400   Lots of dependencies/conflicts output 10000   Trigger activation and processing 20000   Lots of output regarding triggers 40000   Silly amounts of output regarding triggers 1000   Lots of drivel about e.g. the dpkg/info dir 2000   Insane amounts of drivel
--force-things --no-force-things, --refuse-things Force or refuse (no-force and refuse mean the same thing) to do some things. things is a comma separated list of things specified below. --force-help displays a message describing them.  Things marked with (*) are forced by default.
all: Turns on (or off) all force options.
Warning: At present dpkg does not do any dependency checking on downgrades and therefore will not warn you if the downgrade breaks the dependency of some other package. This can have serious side effects, downgrading essential system components can even make your whole system unusable. Use with care.
hold: Allow automatic installs, upgrades or removals of packages even when marked to be on “hold”.  Note: This does not prevent these actions when requested explicitly.
remove-reinstreq: Remove a package, even if it's broken and marked to require reinstallation. This may, for example, cause parts of the package to remain on the system, which will then be forgotten by dpkg.
remove-protected: Remove, even if the package is considered protected (since dpkg 1.20.1).  Protected packages contain mostly important system boot infrastructure.  Removing them might cause the whole system to be unable to boot, so use with caution.
depends: Turn all dependency problems into warnings.  This affects the Pre-Depends and Depends fields.
depends-version: Don't care about versions when checking dependencies.  This affects the Pre-Depends and Depends fields.
breaks: Install, even if this would break another package (since dpkg 1.14.6).  This affects the Breaks field.
conflicts: Install, even if it conflicts with another package. This is dangerous, for it will usually cause overwriting of some files. This affects the Conflicts field.
confmiss: Always install the missing conffile without prompting. This is dangerous, since it means not preserving a change (removing) made to the file.
confnew: If a conffile has been modified and the version in the package did change, always install the new version without prompting, unless the --force-confdef is also specified, in which case the default action is preferred.
confold: If a conffile has been modified and the version in the package did change, always keep the old version without prompting, unless the --force-confdef is also specified, in which case the default action is preferred.
confdef: If a conffile has been modified and the version in the package did change, always choose the default action without prompting. If there is no default action it will stop to ask the user unless --force-confnew or --force-confold is also been given, in which case it will use that to decide the final action.
confask: If a conffile has been modified always offer to replace it with the version in the package, even if the version in the package did not change (since dpkg 1.15.8).  If any of --force-confnew, --force-confold, or --force-confdef is also given, it will be used to decide the final action.
overwrite-dir: Overwrite one package's directory with another's file.
statoverride-add: Overwrite an existing stat override when adding it (since dpkg 1.19.5).
statoverride-remove: Ignore a missing stat override when removing it (since dpkg 1.19.5).
security-mac(*): Use platform-specific Mandatory Access Controls (MAC) based security when installing files into the filesystem (since dpkg 1.19.5).  On Linux systems the implementation uses SELinux.
unsafe-io: Do not perform safe I/O operations when unpacking (since dpkg 1.15.8.6).  Currently this implies not performing file system syncs before file renames, which is known to cause substantial performance degradation on some file systems, unfortunately the ones that require the safe I/O on the first place due to their unreliable behaviour causing zero-length files on abrupt system crashes.
Note: For ext4, the main offender, consider using instead the mount option nodelalloc, which will fix both the performance degradation and the data safety issues, the latter by making the file system not produce zero-length files on abrupt system crashes with any software not doing syncs before atomic renames.
Warning: Using this option might improve performance at the cost of losing data, use with care.
script-chrootless: Run maintainer scripts without chroot(2)ing into instdir even if the package does not support this mode of operation (since dpkg 1.18.5).
Warning: This can destroy your host system, use with extreme care.
architecture: Process even packages with wrong or no architecture.
bad-version: Process even packages with wrong versions (since dpkg 1.16.1).
--ignore-depends=package,... Ignore dependency-checking for specified packages (actually, checking is performed, but only warnings about conflicts are given, nothing else).  This affects the Pre-Depends, Depends and Breaks fields.
--no-act, --dry-run, --simulate Do everything which is supposed to be done, but don't write any changes. This is used to see what would happen with the specified action, without actually modifying anything.
Be sure to give --no-act before the action-parameter, or you might end up with undesirable results. (e.g. dpkg --purge foo --no-act will first purge package “foo” and then try to purge package ”--no-act”, even though you probably expected it to actually do nothing).
-R, --recursive Recursively handle all regular files matching pattern *.deb found at specified directories and all of its subdirectories. This can be used with -i, -A, --install, --unpack and --record-avail actions.
-G  Don't install a package if a newer version of the same package is already installed. This is an alias of --refuse-downgrade.
--admindir=dir Set the administrative directory to directory.  This directory contains many files that give information about status of installed or uninstalled packages, etc.  Defaults to «/var/lib/dpkg».
--instdir=dir Set the installation directory, which refers to the directory where packages are to be installed. instdir is also the directory passed to chroot(2) before running package's installation scripts, which means that the scripts see instdir as a root directory.  Defaults to «/».
--root=dir Set the root directory to directory, which sets the installation directory to «dir» and the administrative directory to «dir/var/lib/dpkg».
-O, --selected-only Only process the packages that are selected for installation. The actual marking is done with dselect or by dpkg, when it handles packages. For example, when a package is removed, it will be marked selected for deinstallation.
-E, --skip-same-version Don't install the package if the same version of the package is already installed.
--pre-invoke=command --post-invoke=command Set an invoke hook command to be run via “sh -c” before or after the dpkg run for the unpack, configure, install, triggers-only, remove, purge, add-architecture and remove-architecture dpkg actions (since dpkg 1.15.4; add-architecture and remove-architecture actions since dpkg 1.17.19). This option can be specified multiple times. The order the options are specified is preserved, with the ones from the configuration files taking precedence.  The environment variable DPKG_HOOK_ACTION is set for the hooks to the current dpkg action.
Note: Front-ends might call dpkg several times per invocation, which might run the hooks more times than expected.
--path-exclude=glob-pattern --path-include=glob-pattern Set glob-pattern as a path filter, either by excluding or re- including previously excluded paths matching the specified patterns during install (since dpkg 1.15.8).
Warning: Take into account that depending on the excluded paths you might completely break your system, use with caution.
The glob patterns use the same wildcards used in the shell, were ‘*’ matches any sequence of characters, including the empty string and also ‘/’.  For example, «/usr/*/READ*» matches «/usr/share/doc/package/README».  As usual, ‘?’ matches any single character (again, including ‘/’).  And ‘[’ starts a character class, which can contain a list of characters, ranges and complementations. See glob(7) for detailed information about globbing.  Note: The current implementation might re-include more directories and symlinks than needed, to be on the safe side and avoid possible unpack failures; future work might fix this.
This can be used to remove all paths except some particular ones; a typical case is:
--path-exclude=/usr/share/doc/* --path-include=/usr/share/doc/*/copyright
to remove all documentation files except the copyright files.
These two options can be specified multiple times, and interleaved with each other. Both are processed in the given order, with the last rule that matches a file name making the decision.
The filters are applied when unpacking the binary packages, and as such only have knowledge of the type of object currently being filtered (e.g. a normal file or a directory) and have not visibility of what objects will come next.  Because these filters have side effects (in contrast to find(1) filters), excluding an exact pathname that happens to be a directory object like /usr/share/doc will not have the desired result, and only that pathname will be excluded (which could be automatically reincluded if the code sees the need). Any subsequent files contained within that directory will fail to unpack.
Hint: make sure the globs are not expanded by your shell.
--verify-format format-name Sets the output format for the --verify command (since dpkg 1.17.2).
The only currently supported output format is rpm, which consists of a line for every path that failed any check.  The lines start with 9 characters to report each specific check result, a ‘?’ implies the check could not be done (lack of support, file permissions, etc), ‘.’ implies the check passed, and an alphanumeric character implies a specific check failed; the md5sum verification failure (the file contents have changed) is denoted with a ‘5’ on the third character. The line is followed by a space and an attribute character (currently ‘c’ for conffiles), another space and the pathname.
--status-fd n Send machine-readable package status and progress information to file descriptor n. This option can be specified multiple times. The information is generally one record per line, in one of the following forms:
status: package: status Package status changed; status is as in the status file.
status: package : error : extended-error-message An error occurred. Any possible newlines in extended-error- message will be converted to spaces before output.
status: file : conffile-prompt : 'real-old' 'real-new' useredited distedited User is being asked a conffile question.
processing: stage: package Sent just before a processing stage starts. stage is one of upgrade, install (both sent before unpacking), configure, trigproc, disappear, remove, purge.
--status-logger=command Send machine-readable package status and progress information to the shell command's standard input, to be run via “sh -c” (since dpkg 1.16.0).  This option can be specified multiple times.  The output format used is the same as in --status-fd.
--log=filename Log status change updates and actions to filename, instead of the default /var/log/dpkg.log. If this option is given multiple times, the last filename is used. Log messages are of the form:
YYYY-MM-DD HH:MM:SS startup type command For each dpkg invocation where type is archives (with a command of unpack or install) or packages (with a command of configure, triggers-only, remove or purge).
YYYY-MM-DD HH:MM:SS status state pkg installed-version For status change updates.
YYYY-MM-DD HH:MM:SS action pkg installed-version available-version For actions where action is one of install, upgrade, configure, trigproc, disappear, remove or purge.
YYYY-MM-DD HH:MM:SS conffile filename decision For conffile changes where decision is either install or keep.
--robot Use a machine-readable output format. This provides an interface for programs that need to parse the output of some of the commands that do not otherwise emit a machine-readable output format. No localization will be used, and the output will be modified to make it easier to parse.
The only currently supported command is --version.
--no-pager Disables the use of any pager when showing information (since dpkg 1.19.2).
--no-debsig Do not try to verify package signatures.
--no-triggers Do not run any triggers in this run (since dpkg 1.14.17), but activations will still be recorded.  If used with --configure package or --triggers-only package then the named package postinst will still be run even if only a triggers run is needed. Use of this option may leave packages in the improper triggers-awaited and triggers-pending states. This can be fixed later by running: dpkg --configure --pending.
--triggers Cancels a previous --no-triggers (since dpkg 1.14.17).
0   The requested action was successfully performed.  Or a check or assertion command returned true.
1   A check or assertion command returned false.
External environment PATH This variable is expected to be defined in the environment and point to the system paths where several required programs are to be found. If it's not set or the programs are not found, dpkg will abort.
HOME If set, dpkg will use it as the directory from which to read the user specific configuration file.
TMPDIR If set, dpkg will use it as the directory in which to create temporary files and directories.
SHELL The program dpkg will execute when starting a new interactive shell, or when spawning a command via a shell.
PAGER DPKG_PAGER The program dpkg will execute when running a pager, which will be executed with «$SHELL -c», for example when displaying the conffile differences.  If SHELL is not set, «sh» will be used instead.  The DPKG_PAGER overrides the PAGER environment variable (since dpkg 1.19.2).
DPKG_FORCE Sets the force flags (since dpkg 1.19.5).  When this variable is present, no built-in force defaults will be applied.  If the variable is present but empty, all force flags will be disabled.
DPKG_ADMINDIR If set and the --admindir or --root options have not been specified, it will be used as the dpkg administrative directory (since dpkg 1.20.0).
DPKG_FRONTEND_LOCKED Set by a package manager frontend to notify dpkg that it should not acquire the frontend lock (since dpkg 1.19.1).
Internal environment LESS Defined by dpkg to “-FRSXMQ”, if not already set, when spawning a pager (since dpkg 1.19.2).  To change the default behavior, this variable can be preset to some other value including an empty string, or the PAGER or DPKG_PAGER variables can be set to disable specific options with «-+», for example DPKG_PAGER="less -+F".
DPKG_ROOT Defined by dpkg on the maintainer script environment to indicate which installation to act on (since dpkg 1.18.5).  The value is intended to be prepended to any path maintainer scripts operate on. During normal operation, this variable is empty.  When installing packages into a different instdir, dpkg normally invokes maintainer scripts using chroot(2) and leaves this variable empty, but if --force-script-chrootless is specified then the chroot(2) call is skipped and instdir is non-empty.
DPKG_ADMINDIR Defined by dpkg on the maintainer script environment to indicate the dpkg administrative directory to use (since dpkg 1.16.0).  This variable is always set to the current --admindir value.
DPKG_FORCE Defined by dpkg on the subprocesses environment to all the currently enabled force option names separated by commas (since dpkg 1.19.5).
DPKG_SHELL_REASON Defined by dpkg on the shell spawned on the conffile prompt to examine the situation (since dpkg 1.15.6).  Current valid value: conffile-prompt.
DPKG_CONFFILE_OLD Defined by dpkg on the shell spawned on the conffile prompt to examine the situation (since dpkg 1.15.6).  Contains the path to the old conffile.
DPKG_CONFFILE_NEW Defined by dpkg on the shell spawned on the conffile prompt to examine the situation (since dpkg 1.15.6).  Contains the path to the new conffile.
DPKG_HOOK_ACTION Defined by dpkg on the shell spawned when executing a hook action (since dpkg 1.15.4).  Contains the current dpkg action.
DPKG_RUNNING_VERSION Defined by dpkg on the maintainer script environment to the version of the currently running dpkg instance (since dpkg 1.14.17).
DPKG_MAINTSCRIPT_PACKAGE Defined by dpkg on the maintainer script environment to the (non- arch-qualified) package name being handled (since dpkg 1.14.17).
DPKG_MAINTSCRIPT_PACKAGE_REFCOUNT Defined by dpkg on the maintainer script environment to the package reference count, i.e. the number of package instances with a state greater than not-installed (since dpkg 1.17.2).
DPKG_MAINTSCRIPT_ARCH Defined by dpkg on the maintainer script environment to the architecture the package got built for (since dpkg 1.15.4).
DPKG_MAINTSCRIPT_NAME Defined by dpkg on the maintainer script environment to the name of the script running, one of preinst, postinst, prerm or postrm (since dpkg 1.15.7).
DPKG_MAINTSCRIPT_DEBUG Defined by dpkg on the maintainer script environment to a value (‘0’ or ‘1’) noting whether debugging has been requested (with the --debug option) for the maintainer scripts (since dpkg 1.18.4).
/etc/dpkg/dpkg.cfg.d/[0-9a-zA-Z_-]* Configuration fragment files (since dpkg 1.15.4).
/var/log/dpkg.log Default log file (see /etc/dpkg/dpkg.cfg and option --log).
The status file is backed up daily in /var/backups. It can be useful if it's lost or corrupted due to filesystems troubles.
The format and contents of a binary package are described in deb(5).
To list installed packages related to the editor vi(1) (note that dpkg- query does not load the available file anymore by default, and the dpkg- query --load-avail option should be used instead for that):
dpkg -l '*vi*'
To see the entries in /var/lib/dpkg/available of two packages:
dpkg --print-avail elvis vim | less
To search the listing of packages yourself:
less /var/lib/dpkg/available
To remove an installed elvis package:
dpkg -r elvis
To install a package, you first need to find it in an archive or CDROM. The available file shows that the vim package is in section editors:
cd /media/cdrom/pool/main/v/vim dpkg -i vim_4.5-3.deb
To make a local copy of the package selection states:
dpkg --get-selections> myselections
You might transfer this file to another computer, and after having updated the available file there with your package manager frontend of choice (see <https://wiki.debian.org/Teams/Dpkg/FAQ> for more details), for example:
apt-cache dumpavail | dpkg --merge-avail
or with dpkg 1.17.6 and earlier:
avail=$(mktemp) apt-cache dumpavail> "$avail" dpkg --merge-avail "$avail" rm "$avail"
you can install it with:
dpkg --clear-selections dpkg --set-selections <myselections
Note that this will not actually install or remove anything, but just set the selection state on the requested packages. You will need some other application to actually download and install the requested packages. For example, run apt-get dselect-upgrade.
Ordinarily, you will find that dselect(1) provides a more convenient way to modify the package selection states.
aptitude(8), apt(8), dselect(1), dpkg-deb(1), dpkg-query(1), deb(5), deb- control(5), dpkg.cfg(5), and dpkg-reconfigure(8).
See /usr/share/doc/dpkg/THANKS for the list of people who have contributed to dpkg.
GPG2(1)                       GNU Privacy Guard 2.1                      GPG2(1)
gpg2 - OpenPGP encryption and signing tool
gpg2 [--homedir dir] [--options file] [options] command [args]
gpg2 is the OpenPGP part of the GNU Privacy Guard (GnuPG). It is a tool to provide digital encryption and signing services using the OpenPGP standard. gpg2 features complete key management and all the bells and whistles you would expect from a full OpenPGP implementation.
In contrast to the standalone command gpg from GnuPG 1.x, the 2.x version is commonly installed under the name gpg2.
The program returns 0 if everything was fine, 1 if at least a signature was bad, and other error codes for fatal errors.
Use a *good* password for your user account and a *good* passphrase to protect your secret key. This passphrase is the weakest part of the whole system. Programs to do dictionary attacks on your secret keyring are very easy to write and so you should protect your "~/.gnupg/" directory very well.
Keep in mind that, if this program is used over a network (telnet), it is *very* easy to spy out your passphrase!
If you are going to verify detached signatures, make sure that the program knows about it; either give both filenames on the command line or use '-' to specify STDIN.
gpg2 may be run with no commands. In this case it will perform a reasonable action depending on the type of file it is given as input (an encrypted message is decrypted, a signature is verified, a file containing keys is listed, etc.).
--encrypt -e     Encrypt data. This command may be combined with --sign (to sign and encrypt a message), --symmetric (to encrypt a message that can decrypted using a secret key or a passphrase), or --sign and --symmetric together (for a signed message that can be decrypted using a secret key or a passphrase).
--symmetric -c     Encrypt with a symmetric cipher using a passphrase. The default symmetric cipher used is AES-128, but may be chosen with the --cipher-algo option. This command may be combined with --sign (for a signed and symmetrically encrypted message), --encrypt (for a message that may be decrypted via a secret key or a passphrase), or --sign and --encrypt together (for a signed message that may be decrypted via a secret key or a passphrase).
With more than one argument, the first argument should specify a file with a detached signature and the remaining files should contain the signed data. To read the signed data from STDIN, use '-' as the second filename.  For security reasons, a detached signature will not read the signed material from STDIN if not explicitly specified.
Note: If the option --batch is not used, gpg2 may assume that a single argument is a file with a detached signature, and it will try to find a matching data file by stripping certain suffixes. Using this historical feature to verify a detached signature is strongly discouraged; you should always specify the data file explicitly.
Note: When verifying a cleartext signature, gpg2 verifies only what makes up the cleartext signed data and not any extra data outside of the cleartext signature or the header lines directly following the dash marker line.  The option --output may be used to write out the actual signed data, but there are other pitfalls with this format as well.  It is suggested to avoid cleartext signatures in favor of detached signatures.
--list-secret-keys -K     List the specified secret keys.  If no keys are specified, then all known secret keys are listed.  A # after the initial tags sec or ssb means that the secret key or subkey is currently not usable.  We also say that this key has been taken offline (for example, a primary key can be taken offline by exported the key using the command --export-secret-subkeys).  A > after these tags indicate that the key is stored on a smartcard.  See also --list- keys.
--list-signatures --list-sigs Same as --list-keys, but the signatures are listed too.  This command has the same effect as using --list-keys with --with-sig- list.
For each signature listed, there are several flags in between the "sig" tag and keyid. These flags give additional information about each signature. From left to right, they are the numbers 1-3 for certificate check level (see --ask-cert-level), "L" for a local or non-exportable signature (see --lsign-key), "R" for a nonRevocable signature (see the --edit-key command "nrsign"), "P" for a signature that contains a policy URL (see --cert-policy-url), "N" for a signature that contains a notation (see --cert-notation), "X" for an eXpired signature (see --ask-cert-expire), and the numbers 1-9 or "T" for 10 and above to indicate trust signature levels (see the --edit-key command "tsign").
--check-signatures --check-sigs Same as --list-signatures, but the signatures are verified.  Note that for performance reasons the revocation status of a signing key is not shown.  This command has the same effect as using --list-keys with --with-sig-check.
The status of the verification is indicated by a flag directly following the "sig" tag (and thus before the flags described above for --list-signatures).  A "!" indicates that the signature has been successfully verified, a "-" denotes a bad signature and a "%" is used if an error occurred while checking the signature (e.g. a non supported algorithm).
--locate-keys Locate the keys given as arguments.  This command basically uses the same algorithm as used when locating keys for encryption or signing and may thus be used to see what keys gpg2 might use.  In particular external methods as defined by --auto-key-locate may be used to locate a key.  Only public keys are listed.
--fingerprint List all keys (or the specified ones) along with their fingerprints. This is the same output as --list-keys but with the additional output of a line with the fingerprint. May also be combined with --list-signatures or --check-signatures.  If this command is given twice, the fingerprints of all secondary keys are listed too.  This command also forces pretty printing of fingerprints if the keyid format has been set to "none".
--delete-keys name Remove key from the public keyring. In batch mode either --yes is required or the key must be specified by fingerprint. This is a safeguard against accidental deletion of multiple keys.
--delete-secret-keys name Remove key from the secret keyring. In batch mode the key must be specified by fingerprint.  The option --yes can be used to advice gpg-agent not to request a confirmation.  This extra pre-caution is done because gpg2 can't be sure that the secret key (as controlled by gpg-agent) is only used for the given OpenPGP public key.
--delete-secret-and-public-key name Same as --delete-key, but if a secret key exists, it will be removed first. In batch mode the key must be specified by fingerprint.  The option --yes can be used to advice gpg-agent not to request a confirmation.
--export Either export all keys from all keyrings (default keyrings and those registered via option --keyring), or if at least one name is given, those of the given name. The exported keys are written to STDOUT or to the file given with option --output.  Use together with --armor to mail those keys.
--send-keys keyIDs Similar to --export but sends the keys to a keyserver. Fingerprints may be used instead of key IDs.  Option --keyserver must be used to give the name of this keyserver. Don't send your complete keyring to a keyserver --- select only those keys which are new or changed by you.  If no keyIDs are given, gpg2 does nothing.
--receive-keys keyIDs --recv-keys keyIDs Import the keys with the given keyIDs from a keyserver. Option --keyserver must be used to give the name of this keyserver.
--refresh-keys Request updates from a keyserver for keys that already exist on the local keyring. This is useful for updating a key with the latest signatures, user IDs, etc. Calling this with no arguments will refresh the entire keyring. Option --keyserver must be used to give the name of the keyserver for all keys that do not have preferred keyservers set (see --keyserver-options honor-keyserver- url).
--search-keys names Search the keyserver for the given names. Multiple names given here will be joined together to create the search string for the keyserver.  Option --keyserver must be used to give the name of this keyserver.  Keyservers that support different search methods allow using the syntax specified in "How to specify a user ID" below. Note that different keyserver types support different search methods. Currently only LDAP supports them all.
--export-ownertrust Send the ownertrust values to STDOUT. This is useful for backup purposes as these values are the only ones which can't be re- created from a corrupted trustdb.  Example: gpg2 --export-ownertrust > otrust.txt
--import-ownertrust Update the trustdb with the ownertrust values stored in files (or STDIN if not given); existing values will be overwritten.  In case of a severely damaged trustdb and if you have a recent backup of the ownertrust values (e.g. in the file ‘otrust.txt’), you may re- create the trustdb using these commands: cd ~/.gnupg rm trustdb.gpg gpg2 --import-ownertrust < otrust.txt
--quick-generate-key user-id [algo [usage [expire]]] This is a simple command to generate a standard key with one user id.  In contrast to --generate-key the key is generated directly without the need to answer a bunch of prompts.  Unless the option --yes is given, the key creation will be canceled if the given user id already exists in the keyring.
If this command is used with --batch, --pinentry-mode has been set to loopback, and one of the passphrase options (--passphrase, --passphrase-fd, or passphrase-file) is used, the supplied passphrase is used for the new key and the agent does not ask for it.  To create a key without any protection --passphrase '' may be used.
algo may be any of the supported algorithms or curve names given in the format as used by key listings.  To use the default algorithm the string ``default'' or ``-'' can be used.  Supported algorithms are ``rsa'', ``dsa'', ``elg'', ``ed25519'', ``cv25519'', and other ECC curves.  For example the string ``rsa'' adds an RSA key with the default key length; a string ``rsa4096'' requests that the key length is 4096 bits.  The string ``future- default'' is an alias for the algorithm which will likely be used as default algorithm in future versions of gpg.
setpref string Set the list of user ID preferences to string for all (or just the selected) user IDs. Calling setpref with no arguments sets the preference list to the default (either built-in or set via --default-preference-list), and calling setpref with "none" as the argument sets an empty preference list. Use gpg2 --version to get a list of available algorithms. Note that while you can change the preferences on an attribute user ID (aka "photo ID"), GnuPG does not select keys via attribute user IDs so these preferences will not be used by GnuPG.
save   Save all changes to the keyrings and quit.
quit   Quit the program without updating the keyrings.
The listing shows you the key with its secondary keys and all user ids.  The primary user id is indicated by a dot, and selected keys or user ids are indicated by an asterisk.  The trust value is displayed with the primary key: the first is the assigned owner trust and the second is the calculated trust value. Letters are used for the values:
-      No ownertrust assigned / not yet calculated.
e      Trust calculation has failed; probably due to an expired key.
q      Not enough information for calculation.
n      Never trust this key.
m      Marginally trusted.
f      Fully trusted.
u      Ultimately trusted.
The command --quick-lsign-key marks the signatures as non- exportable.  If such a non-exportable signature already exists the --quick-sign-key turns it into a exportable signature.
--change-passphrase user-id --passwd user-id Change the passphrase of the secret key belonging to the certificate specified as user-id.  This is a shortcut for the sub- command passwd of the edit key menu.
gpg2 features a bunch of options to control the exact behaviour and to change the default configuration.
These options are used to change the configuration and are usually found in the option file.
--no-default-recipient Reset --default-recipient and --default-recipient-self.
--no-verbose Reset verbose level to 0.
-q, --quiet Try to be as quiet as possible.
--batch --no-batch Use batch mode.  Never ask, do not allow interactive commands. --no-batch disables this option.  Note that even with a filename given on the command line, gpg might still need to read from STDIN (in particular if gpg figures that the input is a detached signature and no data file has been specified).  Thus if you do not want to feed data via STDIN, you should connect STDIN to g‘/dev/null’.
It is highly recommended to use this option along with the options --status-fd and --with-colons for any unattended use of gpg.
--yes  Assume "yes" on most questions.
--no   Assume "no" on most questions.
--list-options parameters This is a space or comma delimited string that gives options used when listing keys and signatures (that is, --list-keys, --list- signatures, --list-public-keys, --list-secret-keys, and the --edit-key functions).  Options can be prepended with a no- (after the two dashes) to give the opposite meaning.  The options are:
show-photos Causes --list-keys, --list-signatures, --list-public-keys, and --list-secret-keys to display any photo IDs attached to the key.  Defaults to no. See also --photo-viewer.  Does not work with --with-colons: see --attribute-fd for the appropriate way to get photo data for scripts and other frontends.
show-policy-urls Show policy URLs in the --list-signatures or --check- signatures listings.  Defaults to no.
show-notations show-std-notations show-user-notations Show all, IETF standard, or user-defined signature notations in the --list-signatures or --check-signatures listings. Defaults to no.
show-keyserver-urls Show any preferred keyserver URL in the --list-signatures or --check-signatures listings. Defaults to no.
show-sig-expire Show signature expiration dates (if any) during --list- signatures or --check-signatures listings. Defaults to no.