Debian Build Toolchain - Source Packages

Source Packages

A typical Debian source package consists of three files:

• The original tarball (orig.tar) — a mere copy of the upstream source tarball if it is in tar format and no changes are necessary, or a repacked tarball. The latter can happen if it contains a snapshot from a version control system that was never released in tarball form, or if the maintainer needs to remove files not compatible with the Debian Free Software Guidelines.
• The debian.tar file, which contains changes to the upstream source made by the package maintainer. This includes the entire debian directory. Any modified files outside it are aggregated into patch files inside the debian/patches directory, that are automatically applied before building.
• The dsc file, which is a text file with metadata, such as the names of all files constituting the source package and their SHA256 checksums. It also contains the signature of the creator of the source package.

For example, a source package named foo with upstream version 1.2.3 and Debian revision 4 can consist of the following files:

• foo_1.2.3.orig.tar.gz
• foo_1.2.3-4.debian.tar.gz
• foo_1.2.3-4.dsc

A source package is created using the dpkg-buildpackage tool or its wrapper debuild. When invoked to create a source package, dpkg-buildpackage calls the maintainer's rules to clean the source tree of any intermediate files, does various sanity checks, and finally, signs the dsc file with the packager's key using the debsign utility.

The reverse process — producing the unpacked source tree from a source package — is accomplished using the dpkg-source utility, which extracts the original tarball to a subdirectory, extracts the debian.tar tarball inside it, and applies any quilt patches present. This is the first step that a build system does when building binary packages from a source package.

Older source packages (using Source Format 1) have a .diff.gz file instead of the debian.tar. This is a unified diff that contains the debian directory and any changes to the upstream source that aren't managed by a patch system.