5.3. Structure of a Source Package

5.3.1. Format

A source package is usually comprised of three files, a .dsc, a .orig.tar.gz, and a .debian.tar.xz (or .diff.gz). They allow creation of binary packages (.deb files described above) from the source code files of the program, which are written in a programming language.

The .dsc (Debian Source Control) file is a short text file containing an RFC 2822 header (just like the control file studied in Section 5.2.1, “Description: the control File”) which describes the source package and indicates which other files are part thereof. It is signed by its maintainer, which guarantees authenticity. See Section 6.6, “Checking Package Authenticity” for further details on this subject.

Example 5.1. A .dsc file

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 3.0 (quilt)
Source: zim
Binary: zim
Architecture: all
Version: 0.75.1-1
Maintainer: Zim Package Maintainers <zim@packages.debian.org>
Uploaders: Raphaël Hertzog <hertzog@debian.org>
Homepage: https://zim-wiki.org
Standards-Version: 4.6.1
Vcs-Browser: https://salsa.debian.org/debian/zim
Vcs-Git: https://salsa.debian.org/debian/zim.git
Build-Depends: debhelper-compat (= 13), python3, python3-gi, python3-xdg, gir1.2-gtk-3.0, dh-python
Package-List:
 zim deb x11 optional arch=all
Checksums-Sha1:
 b4baa294ebc28b07393739875d94fab9557a2e5e 2510821 zim_0.75.1.orig.tar.gz
 e592c9ab8b12276283c6a7bed2246f2e9a843093 10416 zim_0.75.1-1.debian.tar.xz
Checksums-Sha256:
 88e175d7f7e141896f9e958989d252d722556af17bc4bc6f065e7d54287d0385 2510821 zim_0.75.1.orig.tar.gz
 30847b58bb2503b707f1d5c5c356eead31e61db09e677348f07383fcdda3bcb3 10416 zim_0.75.1-1.debian.tar.xz
Files:
 cc73838c1312b5e161d15a51ae4247c4 2510821 zim_0.75.1.orig.tar.gz
 ad84c5ac373071e4957490caf03f3a8b 10416 zim_0.75.1-1.debian.tar.xz

-----BEGIN PGP SIGNATURE-----
Comment: Signed by Raphael Hertzog

iQEzBAEBCgAdFiEE1823g1EQnhJ1LsbSA4gdq+vCmrkFAmO15esACgkQA4gdq+vC
mrkB4AgAj2tYiDW4aQdZfJHr/GGU9rHL99+lTL1VmrXr/I6Z8ggig0JGbTH4Z3lg
QNRu1PbFDJgdO1ho+c0b474iOsT4QTIUu9vHX/enwJ1MiQw8wGDNlsJIS+S33j5n
745p9Y782LTyKaaKPnilHst7pTIGNjmFRlqJr9E8K3gRjZjpTg6HE420epZ6haf1
+gk2npbsy2Psu1LsrbDUCa415COsogar6fpU3Kui3/p8ijT1ED1y9CqoNxATequp
nHkwpnwmi24Y5+RV79SXKW3ECOHTHGKCRWGFtSwCFg0LcAq69cTwnyphXt0gW/+Z
RtG81/jI+mMeRUGsdzdjAVlLK7K75w==
=0po3
-----END PGP SIGNATURE-----

Note that the source package also has dependencies (Build-Depends) completely distinct from those of binary packages, since they indicate tools required to compile the software in question and construct its binary package.

CULTURE Why divide into several packages

Quite frequently, a source package (for a given software) can generate several binary packages. The split is justified by the possibility to use (parts of) the software in different contexts. Consider a shared library, it may be installed to make an application work (for example, libc6), or it can be installed to develop a new program (libc6-dev will then be the correct package). We find the same logic for client/server services where we want to install the server part on one machine and the client part on others (this is the case, for example, of openssh-server and openssh-client).

Just as frequently, the documentation is provided in a dedicated package: the user may install it independently from the software, and may at any time choose to remove it to save disk space. Additionally, this also saves disk space on the Debian mirrors, since the documentation package will be shared among all of the architectures (instead of having the documentation duplicated in the packages for each architecture).

PERSPECTIVE Different source package formats

Originally there was only one source package format. This is the 1.0 format, which associates an .orig.tar.gz archive to a .diff.gz “debianization” patch (there is also a variant, consisting of a single .tar.gz archive, which is automatically used if no .orig.tar.gz is available).

Since Debian 6 Squeeze, Debian developers have the option to use new formats that correct many problems of the historical format. Format 3.0 (quilt) can combine multiple upstream archives in the same source package: in addition to the usual .orig.tar.gz, supplementary .orig-component.tar.gz archives can be included. This is useful with software that is distributed in several upstream components but for which a single source package is desired. These archives can also be compressed with xz rather than gzip, which saves disk space and network resources. Finally, the monolithic patch, .diff.gz is replaced by a .debian.tar.xz archive containing the compiling instructions and a set of upstream patches contributed by the package maintainer. These last are recorded in a format compatible with quilt — a tool that facilitates the management of a series of patches.

The .orig.tar.gz file is an archive containing the source code as provided by the original developer. Debian package maintainers are asked to not modify this archive in order to be able to easily check the origin and integrity of the file (by simple comparison with a checksum) and to respect the wishes of some authors.

The .debian.tar.xz contains all of the modifications made by the Debian maintainer, especially the addition of a debian directory containing the instructions to execute to construct one or more Debian binary packages.

TOOL Decompressing a source package

If you have a source package, you can use the dpkg-source command (from the dpkg-dev package) to decompress it:

$ dpkg-source -x zim_0.75.1-1.dsc
dpkg-source: info: extracting zim in zim-0.75.1
dpkg-source: info: unpacking zim_0.75.1.orig.tar.gz
dpkg-source: info: unpacking zim_0.75.1-1.debian.tar.xz

You can also use apt to download a source package and unpack it right away. It requires that the appropriate deb-src lines be present in the /etc/apt/sources.list file, however (for further details, see Section 6.1, “Filling in the sources.list File”). These are used to list the “sources” of source packages (meaning the servers on which a group of source packages are hosted).

$ apt source zim

Reading package lists... Done
NOTICE: 'zim' packaging is maintained in the 'Git' version control system at:
https://salsa.debian.org/debian/zim.git
Please use:
git clone https://salsa.debian.org/debian/zim.git
to retrieve the latest (possibly unreleased) updates to the package.
Need to get 2,523 kB of source archives.
Get:1 http://deb.debian.org/debian bookworm/main zim 0.75.1-1 (dsc) [1,580 B]
Get:2 http://deb.debian.org/debian bookworm/main zim 0.75.1-1 (tar) [2,511 kB]
Get:3 http://deb.debian.org/debian bookworm/main zim 0.75.1-1 (diff) [10.4 kB]
Fetched 2,523 kB in 0s (12.4 MB/s)
dpkg-source: info: extracting zim in zim-0.75.1
dpkg-source: info: unpacking zim_0.75.1.orig.tar.gz
dpkg-source: info: unpacking zim_0.75.1-1.debian.tar.xz

5.3.2. Usage within Debian

The source package is the foundation of everything in Debian. All Debian packages come from a source package, and each modification in a Debian package is the consequence of a modification made to the source package. The Debian maintainers work with the source package, knowing, however, the consequences of their actions on the binary packages. The fruits of their labors are thus found in the source packages available from Debian: you can easily go back to them and everything stems from them. Chapter 15, Creating a Debian Package contains some examples.

When a new version of a source package arrives on the Debian server, it will then be used by a network of machines of different architectures for compilation on the various architectures supported by Debian.

→ https://buildd.debian.org/